# Retrieve Received Email

Retrieve one stored inbound email for the authenticated tenant.

`GET /emails/receiving/{id}`

Compatibility note: `GET /api/emails/receiving/{id}` remains available for existing OpenSend integrations; new API clients can use the root compatibility path above.

## Authentication

Use an OpenSend API key in the Authorization header. The key owner must match the received email row.

```http
Authorization: Bearer os_YOUR_API_KEY
```

## Path parameters

| Name | Type | Description |
| --- | --- | --- |
| `id` | string | Received email ID. Cross-tenant and missing IDs both return `404`. |

## Response

```json
{
  "object": "received_email",
  "id": "6f6f8b7e-534f-4b62-b0c1-64b79e45f3c2",
  "from": "support@example.com",
  "to": ["agent@inbound.example.com"],
  "subject": "New support request",
  "html": "<p>Hello from a customer.</p>",
  "text": "Hello from a customer.",
  "route_decisions": [
    {
      "recipient": "agent@inbound.example.com",
      "status": "exact",
      "routeId": "22222222-2222-4222-8222-222222222222",
      "routeType": "exact",
      "targetAddress": "agent@inbound.example.com"
    }
  ],
  "reply_match_status": "matched",
  "thread_id": "11111111-2222-4333-8444-555555555555",
  "reply_to_email_id": "11111111-2222-4333-8444-555555555555",
  "contact_id": "99999999-2222-4333-8444-555555555555",
  "thread": {
    "thread_id": "11111111-2222-4333-8444-555555555555",
    "match_status": "matched",
    "original_email_id": "11111111-2222-4333-8444-555555555555",
    "contact_id": "99999999-2222-4333-8444-555555555555",
    "messages": []
  },
  "created_at": "2026-05-10T00:00:00.000Z"
}
```

`html` and `text` can be `null` when your inbound parser did not store that body part. `route_decisions` explains exact, alias, catch-all, or unrouteable routing for each recipient and is empty for legacy rows. Reply fields show whether the message matched an outbound email thread. Unmatched messages remain visible with `reply_match_status: "unmatched"` and null thread IDs. Attachment binaries are not returned from this endpoint; list and retrieve attachment metadata separately.

## Self-hosting notes

The route reads parsed rows from Postgres. If your deployment stores raw MIME in S3, keep that object private and expose only normalized content through your ingestion code or through short-lived attachment URLs.