# List the keywords in use, with counts

Every distinct keyword on this mailbox's LIVE messages, most-used first then alphabetical, with how many messages carry each.

Expunged messages are excluded: they keep their keywords so a restore can put them back, but they are not mail the user has. Protocol keywords are NOT filtered out — `$forwarded`, `$junk` and the rest are returned like any other, because which of them are worth showing is a client's decision, not core's.

Scoped like every other read: a folder-scoped grant reports the keywords inside the grant and no others.

## `GET /api/v1/mailboxes/{mailboxId}/keywords`

### Path parameters

- `mailboxId` (string, required) — Mailbox ULID identifier

### Query parameters

- `limit` (integer, ≥ 1, ≤ 500) — Maximum distinct keywords to return (default 100, max 500). The cut falls on the least-used, since the order is by count.

### Responses

**200** — Keywords in use

`application/json` → KeywordListPage

- `keywords` (KeywordCount[], required) — Distinct keywords, most-used first, then alphabetical
  - `count` (integer <int64>, required) — How many of this mailbox's live messages carry it
  - `keyword` (string, required) — The keyword, canonical lowercase (JMAP keywords are case-insensitive)

**401** — unauthorized: the bearer credential is missing, malformed, expired, or revoked. Carries a `WWW-Authenticate: Bearer` challenge

`application/json` → ErrorBody

**404** — Mailbox not found or not accessible to this principal

`application/json` → ErrorBody

**503** — temporary_failure: the platform's storage could not answer just now; retry after the Retry-After window. Any operation can answer this. A write that got it may have been applied, so retry it with the same idempotency key where it takes one, or read the state back first (see Transient failures in the API description)

`application/json` → ErrorBody

### Example request

```bash
curl -X GET 'https://api.open.email/api/v1/mailboxes/{mailboxId}/keywords' \
  -H 'Authorization: Bearer oek_…'
```