# List received messages

`GET /v1/inbound/messages`

- Authentication: required (Bearer token)
- Required scope: `api.inbound.view`

One page of mail your org RECEIVED, newest first, folded to the latest
state per (message, receiving domain). A message that parked and was
later redelivered is one row saying `delivered`, not two rows to
reconcile; the states it passed through are on the detail route.

**PII.** Every row carries the sender's address, the recipient's address
and the real subject line. Nothing is masked and no further scope
unmasks anything — an inbound log that could not say who wrote in could
not answer the question it exists for.

`outcome` is `delivered`, `rejected`, `dropped`, `no_route` or `parked`,
and only `parked` is NOT terminal: the raw message is still in your own
S3 bucket and a replay can still deliver it. `no_route` means the
recipient did not match the domain's `allow_patterns`, `dropped` means a
verdict posture discarded it, and `rejected` means your endpoint
answered with a 4xx that was not 429 — it said no, definitively, so
nothing retried.

`verdicts` values may be the empty string, which is a real value rather
than a missing one: a replayed message carries no verdicts at all,
because SES's results live only in the original notification.

## Query parameters

- `from` (string<date-time>, optional) — Window start (RFC 3339). Defaults to 30 days ago.
- `to` (string<date-time>, optional) — Window end (RFC 3339). Defaults to now.
- `limit` (integer, optional) — Page size (1–200). Default 50.
- `cursor` (string, optional) — Opaque cursor returned from the previous page.
- `domain` (string, optional) — Narrow to one receiving domain, by name.
- `outcome` (string enum, optional) — Narrow to one outcome. An unknown value is 422, not an empty page.
- `verdict` (string enum, optional) — Narrow to messages that failed one SES check.
- `q` (string, optional) — Free-text match over sender, recipient and subject.

## Example request

```bash
curl 'https://api.sendops.dev/v1/inbound/messages' \
  -H "Authorization: Bearer $SENDOPS_API_KEY"
```

## Responses

### 200 — Cursor-paginated list of received messages

Content type: `application/json`

```json
{
  "data": [
    {
      "message_id": "string",
      "domain": "string",
      "recipient": "string",
      "recipients": [
        "string"
      ],
      "from": "string",
      "subject": "string",
      "received_at": "2026-05-17T20:00:00Z",
      "outcome": "delivered",
      "reason": "string",
      "detail": "string",
      "verdicts": {
        "spam": "",
        "virus": "",
        "spf": "",
        "dkim": "",
        "dmarc": ""
      },
      "webhook_status": 0,
      "attempts": 0,
      "is_auto_reply": true,
      "is_reply": true
    }
  ],
  "pagination": {
    "has_more": true,
    "next_cursor": "string"
  }
}
```

### 401 — Missing, malformed, or unknown API key

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 403 — Key lacks the required scope or plan limit violated

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 422 — A query parameter, path value or body field failed validation.

The body is a `validation_failed` Problem. When the refusal is about a
reference — a segment key, template slug, topic or attribute name the
organization does not have — it additionally carries `validation_code`,
`field`, `line`/`column`, `missing`, `candidates` and `next_step`, so a
client can correct the call without a second round of guessing. See
`ValidationProblem`.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ],
  "validation_code": "invalid_syntax",
  "field": "string",
  "line": 0,
  "column": 0,
  "missing": [
    {
      "kind": "segment",
      "key": "string"
    }
  ],
  "candidates": {},
  "next_step": "string"
}
```

### 429 — Per-org rate limit exceeded

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 500 — Unexpected server-side failure. The `code` is `internal_error`. The
`request_id` field can be quoted to SendOps support to investigate.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```