Retrieve a message
One message with its body. Retrieving it does not mark it seen.
Runs the real call on your workspace.
GET /temp-mail/inboxes/{id}/messages/{messageId}
One message with its body. Retrieving it does not mark it seen.
The inbox token
export OE=https://api.nextmail.shexport INBOX="Authorization: Bearer oe_inbox_kQ8v…"Every call below carries the token POST /temp-mail/inboxes returned, in the same Authorization: Bearer header an API key uses. The address itself authorises nothing, and that separation is the point of the feature rather than a formality: a disposable address is handed to the party you are keeping at arm’s length the moment it is issued.
The token alone decides which inbox a call reads. The id in the path is not checked against it, so a caller juggling two inboxes has to keep each token with its own id.
Example
The message is checked against the lease before anything is returned: it has to be delivered to this address, after this lease began, and not moved to the bin. Anything else is 404, because a message id is not a permission.
curl "$OE/temp-mail/inboxes/tinb_octopus-signup/messages/thr_4b81c07d2fa9418e93c6a13f" \ -H "$INBOX"{ "object": "temp_message", "id": "thr_4b81c07d2fa9418e93c6a13f", "from": { "name": "Acme", "email": "no-reply@acme.com" }, "to": "octopus-signup@freemailaddress.com", "subject": "Confirm your email", "snippet": "Your code is 481923…", "spam": false, "seen": false, "attachmentCount": 1, "sizeBytes": 8241, "receivedAt": "2026-09-01T10:31:04.000Z", "message": { "decodedBody": "<p>Your code is 481923</p>", "verificationCode": "481923", "…": "…" }, "truncated": false}Render message.decodedBody. body and processedHtml are empty strings on a locally-ingested message, which is every message that can reach a disposable inbox. Reading either of those and finding nothing is the mistake this note exists to prevent.
message is the same object the real mailbox stores, passed through without projection: the shape IS the storage schema, and a hand-written field list here would be a second description of it that goes stale. It is also attacker-supplied HTML, so render it out of your own origin.
truncated is always false. The body is never cut here.
A message this lease cannot see answers 404 resource_not_found, and while the pool cannot be read the answer is 503 not_configured.
message.verificationCode is the sign-in code of a verification email, as you would type it, when Nextmail is sure of it, and null otherwise. It is the quickest way to finish a sign-up without reading the body.
Google Workspace
Fastmail