List messages
What has arrived, newest first, metadata only. This is the call to poll.
Runs the real call against your workspace, with your own key.
GET /temp-mail/inboxes/{id}/messages
What has arrived, newest first, metadata only. This is the call to poll.
The inbox token
export OE=https://api.openemail.ukexport INBOX="Authorization: Bearer oe_inbox_kQ8v…"Every call below carries the token POST /temp-mail/inboxes returned, in the same Authorization: Bearer header an API key uses. The address itself authorises nothing, and that separation is the point of the feature rather than a formality: a disposable address is handed to the party you are keeping at arm’s length the moment it is issued.
The id in the path has to name the same inbox the token does. The token alone identifies one, so this is belt and braces, but it means a caller that muddles two inboxes gets a 404 instead of quietly reading the wrong mail.
Example
Everything a list draws is a column on one indexed table, and no stored body is read. limit is 1 to 50 and optional; the lease comes back on the same response, so a poller does not need a second call to know when to stop.
curl "$OE/temp-mail/inboxes/tinb_9c2f41ab7d3e4c118a0f5d72/messages?limit=25" -H "$INBOX"{ "object": "list", "data": [ { "object": "temp_message", "id": "tmail_4b81c07d2fa9418e93c6a13f", "from": { "name": "Acme", "email": "[email protected]" }, "to": "[email protected]", "subject": "Confirm your email", "snippet": "Your code is 481923…", "spam": false, "seen": false, "attachmentCount": 0, "sizeBytes": 8241, "receivedAt": "2026-09-01T10:31:04.000Z" } ], "expiresAt": "2026-09-01T12:00:00.000Z"}snippet is the first 400 characters of the body as text, which is usually the whole reason the inbox exists. A confirmation code is generally visible without opening anything.
spam is what the shared heuristic thought. It is a flag and nothing else: nothing was filed away, moved or suppressed, and the message is in this list either way.
seen flips when the message is retrieved, not when it is listed. Polling this endpoint never marks anything read.