---
title: "Extend the lease"
description: "Another hour on the expiry, up to the day a lease is capped at. No body."
url: "https://openemail.uk/docs/api/temp-mail/extend"
area: "API"
category: "Disposable inboxes"
---

# Extend the lease

Another hour on the expiry, up to the day a lease is capped at. No body.

`POST /temp-mail/inboxes/{id}/extend`

## POST /temp-mail/inboxes/{id}/extend

Another hour on the expiry, up to the day a lease is capped at. No body.

## The inbox token

**shell**

```
export OE=https://api.openemail.uk
export INBOX="Authorization: Bearer oe_inbox_kQ8v…"
```

Every call below carries the token `POST /temp-mail/inboxes` returned, in the same `Authorization: Bearer` header an API key uses. The address itself authorises nothing, and that separation is the point of the feature rather than a formality: a disposable address is handed to the party you are keeping at arm’s length the moment it is issued.

> The id in the path has to name the same inbox the token does. The token alone identifies one, so this is belt and braces, but it means a caller that muddles two inboxes gets a 404 instead of quietly reading the wrong mail.

## Example

The hour is added to `expiresAt`, not to now, so extending with time still on the clock keeps that time.

**curl**

```
curl -X POST "$OE/temp-mail/inboxes/tinb_9c2f41ab7d3e4c118a0f5d72/extend" -H "$INBOX"
```

**Response**

```
{
  "object": "temp_inbox",
  "id": "tinb_9c2f41ab7d3e4c118a0f5d72",
  "address": "octopus-signup@freemailaddress.com",
  "domain": "freemailaddress.com",
  "createdAt": "2026-09-01T10:00:00.000Z",
  "expiresAt": "2026-09-01T13:00:00.000Z",
  "extensionsLeft": 21,
  "messageCount": 3,
  "messageLimit": 50,
  "lastMessageAt": "2026-09-01T10:31:04.000Z"
}
```

> Twenty-three extensions, and the new expiry is also clamped to 24 hours after `createdAt`, so the last one may buy less than a full hour, and a lease created at the cap has none at all. `extensionsLeft` already counts both ceilings; read it and `expiresAt` back rather than counting your own calls.

> At the cap it answers 409 `conflict_error` / `extension_limit`. That is the end of it: take a new address, or a real mailbox, which does not expire.