---
title: "List messages"
description: "What has arrived, newest first, metadata only. This is the call to poll."
url: "https://openemail.uk/docs/api/temp-mail/messages"
area: "API"
category: "Disposable inboxes"
---

# List messages

What has arrived, newest first, metadata only. This is the call to poll.

`GET /temp-mail/inboxes/{id}/messages`

## GET /temp-mail/inboxes/{id}/messages

What has arrived, newest first, metadata only. This is the call to poll.

## The inbox token

**shell**

```
export OE=https://api.openemail.uk
export INBOX="Authorization: Bearer oe_inbox_kQ8v…"
```

Every call below carries the token `POST /temp-mail/inboxes` returned, in the same `Authorization: Bearer` header an API key uses. The address itself authorises nothing, and that separation is the point of the feature rather than a formality: a disposable address is handed to the party you are keeping at arm’s length the moment it is issued.

> The id in the path has to name the same inbox the token does. The token alone identifies one, so this is belt and braces, but it means a caller that muddles two inboxes gets a 404 instead of quietly reading the wrong mail.

## Example

Everything a list draws is a column on one indexed table, and no stored body is read. `limit` is 1 to 50 and optional; the lease comes back on the same response, so a poller does not need a second call to know when to stop.

**curl**

```
curl "$OE/temp-mail/inboxes/tinb_9c2f41ab7d3e4c118a0f5d72/messages?limit=25" -H "$INBOX"
```

**Response**

```
{
  "object": "list",
  "data": [
    {
      "object": "temp_message",
      "id": "tmail_4b81c07d2fa9418e93c6a13f",
      "from": { "name": "Acme", "email": "no-reply@acme.com" },
      "to": "octopus-signup@freemailaddress.com",
      "subject": "Confirm your email",
      "snippet": "Your code is 481923…",
      "spam": false,
      "seen": false,
      "attachmentCount": 0,
      "sizeBytes": 8241,
      "receivedAt": "2026-09-01T10:31:04.000Z"
    }
  ],
  "expiresAt": "2026-09-01T12:00:00.000Z"
}
```

> `snippet` is the first 400 characters of the body as text, which is usually the whole reason the inbox exists. A confirmation code is generally visible without opening anything.

> `spam` is what the shared heuristic thought. It is a flag and nothing else: nothing was filed away, moved or suppressed, and the message is in this list either way.

> `seen` flips when the message is retrieved, not when it is listed. Polling this endpoint never marks anything read.