List attachments
The parts on one message: names, types and sizes, and no bytes.
Runs the real call on your workspace.
GET /temp-mail/inboxes/{id}/messages/{messageId}/attachments
The parts on one message: names, types and sizes, and no bytes.
The inbox token
export OE=https://api.nextmail.shexport INBOX="Authorization: Bearer oe_inbox_kQ8v…"Every call below carries the token POST /temp-mail/inboxes returned, in the same Authorization: Bearer header an API key uses. The address itself authorises nothing, and that separation is the point of the feature rather than a formality: a disposable address is handed to the party you are keeping at arm’s length the moment it is issued.
The token alone decides which inbox a call reads. The id in the path is not checked against it, so a caller juggling two inboxes has to keep each token with its own id.
Example
Metadata only. No route on a disposable inbox serves the bytes of an attachment, and there is no per-part fetch.
curl "$OE/temp-mail/inboxes/tinb_octopus-signup/messages/thr_4b81c07d2fa9418e93c6a13f/attachments" \ -H "$INBOX"{ "object": "list", "data": [ { "object": "attachment", "attachmentId": "msg_7d3e4c118a0f5d729c2f41ab-0", "filename": "invoice.pdf", "mimeType": "application/pdf", "size": 12345, "body": "", "headers": [] } ]}body is always an empty string and headers always empty. size is the decoded size of the part.
filename and mimeType are what an anonymous sender declared. Treat them as claims.
Google Workspace
Fastmail