Inbound messages

Received messages for one inbox, with raw MIME and attachments.

Messages an inbox has received and not yet purged, newest first, up to 200. The list omits raw and each attachment's content_base64. Show includes both. On a webhook inbox, raw and content_base64 are null after the webhook delivers or gives up, and the attachment download then returns 410. You can also download one attachment as a file by its 1-based position in the attachments array. drain_status is pending, stored, retrying, delivered, dead, or held. held means the message looked like a mail loop, so PostShiba stored it but did not send the webhook or forward it. thread_id comes from the plus tag, else In-Reply-To, References, or Message-ID. expires_at is when the message is purged. authentication carries the SPF, DKIM, DMARC, and ARC results PostShiba measured on receipt. Use it instead of any Authentication-Results header inside raw, which the sender controls. A token whose user is not a team admin gets the same view as a non-admin in the dashboard: digits in subject, text, and html are masked, raw and content_base64 are null, and the attachment download returns 404.

GET /api/v1/inboxes/:inbox_id/inbound_messages

List alive messages for a live inbox.

inbox_id: Public inbox id

request.sh

1curl -sS -X GET \ 2 -H 'Authorization: Bearer YOUR_API_KEY' \ 3 https://app.postshiba.com/api/v1/inboxes/:inbox_id/inbound_messages

response.json

1[ 2 { 3 "id": "GxTyVu", 4 "inbox_id": "PqRzMn", 5 "to": "inbabc123@inbound.capsule.test", 6 "from": "sender@example.com", 7 "subject": "Hello", 8 "text": "Hi", 9 "html": "<p>Hi</p>", 10 "thread_id": "thread", 11 "headers": {}, 12 "envelope": { 13 "mail_from": "sender@example.com", 14 "rcpt_to": "inbabc123@inbound.capsule.test", 15 "plus_tag": "thread" 16 }, 17 "authentication": { 18 "spf": { 19 "result": "pass", 20 "domain": "example.com" 21 }, 22 "dkim": [ 23 { 24 "result": "pass", 25 "domain": "example.com", 26 "selector": "google" 27 } 28 ], 29 "dmarc": { 30 "result": "pass", 31 "policy": "none", 32 "aligned": true 33 }, 34 "arc": { 35 "result": "none" 36 } 37 }, 38 "attachments": [ 39 { 40 "filename": "photo.png", 41 "content_type": "image/png", 42 "size": 70 43 } 44 ], 45 "expires_at": "2026-08-30T00:00:00Z", 46 "drain_status": "stored" 47 } 48]

GET /api/v1/inboxes/:inbox_id/inbound_messages/:id

Get one alive message, including raw MIME and attachment content_base64. Both are null after a webhook inbox delivers or gives up.

inbox_id: Public inbox id
id: Public inbound message id

request.sh

1curl -sS -X GET \ 2 -H 'Authorization: Bearer YOUR_API_KEY' \ 3 https://app.postshiba.com/api/v1/inboxes/:inbox_id/inbound_messages/:inbound_message_id

response.json

1{ 2 "id": "GxTyVu", 3 "inbox_id": "PqRzMn", 4 "to": "inbabc123@inbound.capsule.test", 5 "from": "sender@example.com", 6 "subject": "Hello", 7 "text": "Hi", 8 "html": "<p>Hi</p>", 9 "thread_id": "thread", 10 "headers": {}, 11 "envelope": { 12 "mail_from": "sender@example.com", 13 "rcpt_to": "inbabc123@inbound.capsule.test", 14 "plus_tag": "thread" 15 }, 16 "authentication": { 17 "spf": { 18 "result": "pass", 19 "domain": "example.com" 20 }, 21 "dkim": [ 22 { 23 "result": "pass", 24 "domain": "example.com", 25 "selector": "google" 26 } 27 ], 28 "dmarc": { 29 "result": "pass", 30 "policy": "none", 31 "aligned": true 32 }, 33 "arc": { 34 "result": "none" 35 } 36 }, 37 "attachments": [ 38 { 39 "filename": "photo.png", 40 "content_type": "image/png", 41 "size": 70, 42 "content_base64": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==" 43 } 44 ], 45 "expires_at": "2026-08-30T00:00:00Z", 46 "drain_status": "stored", 47 "raw": "From: sender@example.com\n" 48}

GET /api/v1/inboxes/:inbox_id/inbound_messages/:id/attachments/:index

Download one attachment as the decoded file. Index is 1-based and matches the attachments array. Returns 410 after a webhook inbox delivers or gives up.

inbox_id: Public inbox id
id: Public inbound message id
index: 1-based attachment position from the message attachments array

request.sh

1curl -sS -X GET \ 2 -H 'Authorization: Bearer YOUR_API_KEY' \ 3 https://app.postshiba.com/api/v1/inboxes/:inbox_id/inbound_messages/:inbound_message_id/attachments/:index