Start for free
Labels

Update flags, labels and keywords for every message in a folder

PATCH
/api/v1/mailboxes/{mailboxId}/labels/{label}/messages

Applies one patch to a UID RANGE of this label — the write twin of GET /labels/{label}/messages, and the way to act on a whole folder without naming its messages. PATCH /messages takes at most 200 ids, so "archive everything in this folder" means downloading every id and sending hundreds of calls, racing every arrival in between. Here the selection is a RULE the store resolves inside the same turn that writes it.

THE CEILING IS THE POINT. uidMax is resolved once and fixes the working set: a label's UIDs only increase and are never reused within a uidValidity, so mail that arrives — or that a rule files here — while the call runs takes a UID above the ceiling and is never touched. A client that showed a user "all 5,420 messages" can therefore act on the 5,420 they were looking at. Read uidNext from GET /labels and send uidMax = uidNext - 1 with that response's uidValidity beside it.

IT MAY ANSWER A CURSOR. The call spends a bounded budget and then stops, because the store is single-threaded and a mailbox has no size limit. nextAfter non-null means call again with after set to it, the same uidMax and the same patch, until it is null; remaining says how many memberships are left. Ordinary folders finish in one call. Every chunk has committed, so stopping early leaves the store consistent and the gesture partial — which is what remaining is there to make visible. Repeating a call is harmless.

Conversations do not enter into it: the patch reaches the messages FILED UNDER this label, which is what threadLabelOnly means on PATCH /messages. Removing a message's last label expunges it to the Recently-deleted tier, restorable until purge, exactly as it does by id.

Authorization

bearerAuth
headerAuthorizationBearer <token>

Two credential kinds share this scheme; GET /api/v1/auth/whoami answers which one you hold and what it reaches.

oek_… API key (minted by POST /api/v1/api-keys; shown once at mint). role: account reaches the full account surface: the directory (domains, routes, patterns, api-keys, accounts, address lists) plus every mailbox the account owns. role: system additionally reaches the operator surface, which is documented separately.

oemp_… mailbox app password (minted by POST /api/v1/identities/{identityId}/credentials). Reaches ONE mailbox: its messages, labels, threads, search, sync, send, filters and PIM collections. Directory routes refuse it with 403 insufficient_scope.

Refusal vocabulary: a missing, malformed, expired, or revoked credential answers 401 unauthorized with a WWW-Authenticate: Bearer challenge; a VALID credential outside its scope answers 403 (insufficient_scope for an app password on a directory route, system_credentials_required where only the operator may call). The public routes (health, branding, token-in-path capabilities) declare security: [].

Path Parameters

mailboxId*string

Mailbox ULID identifier

label*string

Label or folder name (e.g. INBOX, Archive, custom)

Request Body

application/json
  1. body
after?integer

Continuation cursor: resume above this UID. Pass the previous call's nextAfter.

Formatint64
Range0 <= value
flagsClear?array<>

Flags to remove

flagsSet?array<>

Flags to set

hasFlags?array<>

Narrow the selection to messages with ALL of these flags set

keywordsClear?array<string>

Custom keywords to remove

keywordsExact?array<string>

Exact replacement list of custom keywords

keywordsSet?array<string>

Custom keywords to add

labelsAdd?array<string>

Labels to add

labelsExact?array<string>

Exact replacement list of labels

labelsRemove?array<string>

Labels to remove

limit?integer

Lower the per-call update budget, for a client that wants finer progress than the server's own bound gives. Never raises it.

Range1 <= value
notFlags?array<>

Narrow the selection to messages with NONE of these set — ["seen"] for the unread-only gesture a folder's unread badge implies

orphans?string

What to do if this write would leave the message with no label. 'expunge' (the default) sends the message to Recently deleted. 'archive' keeps the message live by attaching the Archive system label (attaching Archive needs no right beyond the grant's 't' for a scoped viewer). If the write removes Archive itself and would leave no labels, Archive is kept without error. A SCOPED viewer whose write lands the message in Archive has moved it out of their own scope: the answer is still updated, and the hydrated message carries an EMPTY labels list rather than naming a label the grant never included. labelsAdded omits Archive for the same reason.

Value in"expunge""archive"
uidMax?integer

Inclusive UID ceiling — the selection is every member with uid <= this. Omitted on a FIRST call, the label's current highest UID is used and echoed back. REQUIRED once after is given, so a continuation cannot move its own ceiling and sweep in mail that arrived mid-gesture.

Formatint64
Range1 <= value
uidValidity?integer

Precondition: refuse with 409 uid_validity_mismatch unless the label still carries this epoch. A bump means the UIDs this selection was taken over no longer name the same messages.

Formatint64

Response Body

Counts for this call, and a cursor if the range is not drained

application/json
  1. response
archived*integer

Messages whose last label this patch removed that fell back to the Archive label instead of being expunged. Unlike expunged, this is a SUBSET of updated, not an alternative to it: an archived message was still updated, so examined equals updated + unchanged + expunged + failed and adding archived to updated double counts. Only present when the patch carried orphans: "archive".

examined*integer

Memberships this call looked at, filtered-out ones included

expunged*integer

Messages whose last label this patch removed: they moved to the Recently-deleted tier, restorable until purge. Counted here rather than in updated.

failed*integer

Per-message refusals — a keyword cap, or a row that left the label between this call's scan and its write. Not an error: the rest of the call applied.

nextAfter*|

Continuation cursor: call again with after set to this, the same uidMax, and the same patch. null means the range is drained. Repeating a call is harmless — a patch that changes nothing writes nothing, and a filing patch's earlier pages have already left the range.

Formatint64
remaining*integer

Memberships left in the range this call did not reach, 0 when it finished. This counts what is UNEXAMINED, not what would match a flag filter — it is the figure a progress bar needs, and it is exact.

uidMax*integer

The resolved ceiling this call worked under. Send it back UNCHANGED on a continuation: it is what keeps the selection the one the user saw, and re-resolving it would let mail that arrived since drift into the gesture.

Formatint64
uidValidity*integer

UIDVALIDITY epoch of the label the patch ran against

Formatint64
unchanged*integer

Messages in the selection the patch provably would not have changed, so they were skipped

updated*integer

Messages the patch changed

Example Request
curl -X PATCH 'https://api.open.email/api/v1/mailboxes/string/labels/string/messages' \
  -H 'Content-Type: application/json' \
  -d '{}'
Example Response
{
  "archived": 0,
  "examined": 0,
  "expunged": 0,
  "failed": 0,
  "nextAfter": 0,
  "remaining": 0,
  "uidMax": 0,
  "uidValidity": 0,
  "unchanged": 0,
  "updated": 0
}

List messages in a label by UID GET

Returns messages in a label ordered by UID, optionally filtered by a minimum and maximum UID range.

Update flags, labels and keywords for every… PATCH

Keyed on the label's numeric `id` — as `GET /labels` and `POST /labels` report it — rather than on its name. The id survives a rename (it is what JMAP…