# Reply to a message (/docs/api-reference/inboxes/reply-to-inbox-message)

Replies in the message's thread from the inbox's address: to its sender (its `Reply-To` first), or to an outbound message's recipients again for a follow-up; `reply_all` adds everyone else on it. The subject gets `Re:`, and `In-Reply-To`/`References` let the recipient's mail client thread it. Sent like any email, counted against the send quota.

`POST https://api.coss.com/v1/inboxes/{inbox_id}/messages/{message_id}/reply`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Path parameters

- `inbox_id` (string, required): The inbox's id.
- `message_id` (string, required): The message's id.

## Headers

- `Idempotency-Key` (string, 1-256 characters): Makes the send safe to retry: a repeat with the same key and body returns the first message instead of sending again (keys are per inbox). 1-256 characters.

## Request body

- `reply_all` (boolean): Also reply to everyone else on the message (its `to` and `cc`, but the inbox). Default `false`: only the sender (its `Reply-To`, when it has one).
- `cc` (string | string[], 0-50 items): An email address, optionally with a display name: "Acme <hello@acme.com>".
- `bcc` (string | string[], 0-50 items): An email address, optionally with a display name: "Acme <hello@acme.com>".
- `text` (string): Plain-text body. Without it, an `html` email goes out with a text part generated from the HTML.
- `html` (string): HTML body. Provide `html`, `text`, or both.
- `attachments` (object[], at most 20 items): Up to 20 files, at most 25 MB combined.
  - `filename` (string, required, 1-255 characters)
  - `content` (string, required, at least 1 character): The file's bytes, base64-encoded.
  - `content_type` (string): Defaults from the filename's extension.
  - `content_id` (string): Makes the attachment inline: reference it from `html` as `<img src="cid:logo@acme">`.
- `tags` (object[], at most 50 items)
  - `name` (string, required)
  - `value` (string, required)

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.inboxes.messages.reply("inbox_01k7c8m4q2f3e9v6t5r1n0p8yz", "imsg_01k7c8m4s1d3c9x0z4e6g7h8j9", {
  text: "Sorry about that, Jane! A new one is on its way.",
}, {
  idempotencyKey: "welcome-user-123",
});
```

HTTP:

```sh
curl -X POST "https://api.coss.com/v1/inboxes/inbox_01k7c8m4q2f3e9v6t5r1n0p8yz/messages/imsg_01k7c8m4s1d3c9x0z4e6g7h8j9/reply" \
  -H "Authorization: Bearer $COSS_API_KEY" \
  -H "Idempotency-Key: welcome-user-123" \
  -H "Content-Type: application/json" \
  -d '{
  "text": "Sorry about that, Jane! A new one is on its way."
}'
```

## Response 202

The reply, queued for delivery. A replay returns the first one.

- `object` ("inbox_message", required)
- `id` (string, required)
- `inbox_id` (string, required)
- `thread_id` (string, required)
- `direction` ("inbound" | "outbound", required): `inbound`: received by the inbox. `outbound`: sent from it.
- `status` ("received" | "queued" | "sent" | "failed" | "scheduled" | "canceled", required): `received` for inbound messages; an outbound message's email status (`queued`, `sent`, `failed`, …): its email has each recipient's delivery.
- `from` (string | null, required): The `From` header.
- `to` (string[], required)
- `cc` (string[], required)
- `subject` (string | null, required)
- `preview` (string | null, required): The start of the message's own text (without the quoted conversation).
- `attachments` (object[], required): An inbound message's attachments (download them from the message).
  - `id` (string, required)
  - `filename` (string | null, required): `null` when the part named none.
  - `content_type` (string, required)
  - `content_id` (string | null, required): Set for parts the HTML references (`cid:` URLs).
  - `disposition` ("attachment" | "inline", required)
  - `size` (integer, required): Size in bytes.
- `spam` (boolean, required): Whether the receiving server judged it spam.
- `received_email_id` (string | null, required): The received email of an inbound message.
- `email_id` (string | null, required): The email of an outbound message: its delivery events and webhooks name it.
- `created_at` (string, required, date-time): When it was received or sent.
- `reply_to` (string[], required)
- `message_id` (string | null, required): An inbound message's `Message-ID` header (outbound ones get theirs at sending).
- `in_reply_to` (string | null, required)
- `references` (string[], required)
- `text` (string | null, required)
- `extracted_text` (string | null, required): The message's own text: `text` without the quoted conversation and signature below it (a heuristic; when nothing is left, all of `text`). Made from `html` when there is no `text`.
- `html` (string | null, required): The sender's HTML: sanitize it before showing it to anyone.
- `truncated` (boolean, required): Whether `text` or `html` were shortened (2 MB each).

Example:

```json
{
  "object": "inbox_message",
  "id": "imsg_01k7c8m4s1d3c9x0z4e6g7h8j9",
  "inbox_id": "inbox_01k7c8m4q2f3e9v6t5r1n0p8yz",
  "thread_id": "thread_01k7c8m4r0c2b8w9y3d5f6g7h8",
  "direction": "inbound",
  "status": "received",
  "from": "Jane Doe <jane@example.com>",
  "to": [
    "support-agent@k3j9x2m7qp4l.inbound.coss.com"
  ],
  "cc": [],
  "subject": "My order arrived damaged",
  "preview": "Hi, the order arrived damaged. Can you send a new one?",
  "attachments": [
    {
      "id": "rcvdatt_01k7c8m4r0c2b8w9y3d5f6g7h8",
      "filename": "photo.jpg",
      "content_type": "image/jpeg",
      "content_id": null,
      "disposition": "attachment",
      "size": 48213
    }
  ],
  "spam": false,
  "received_email_id": "rcvd_01k7c8m4q2f3e9v6t5r1n0p8yz",
  "email_id": null,
  "created_at": "2026-10-10T12:00:00.000Z",
  "reply_to": [],
  "message_id": "<CAF3k2m9qp4ld8sv@mail.example.com>",
  "in_reply_to": null,
  "references": [],
  "text": "Hi, the order arrived damaged. Can you send a new one?\n\nJane",
  "extracted_text": "Hi, the order arrived damaged. Can you send a new one?\n\nJane",
  "html": null,
  "truncated": false
}
```

## Errors

- `400`: The body is not valid JSON (`invalid_json`) or the `Idempotency-Key` header is invalid (`invalid_idempotency_key`). Also when the `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `403`: The API key lacks the permission this endpoint needs (`insufficient_permissions`), its organization is suspended (`organization_suspended`), live sending is suspended (`account_suspended`), or sending is paused for the organization (`sending_paused`).
- `404`: No such inbox or message in this environment (`not_found`).
- `409`: Requests with this `Idempotency-Key` are racing for an expired key (`request_in_progress`). Retry after `Retry-After` seconds.
- `413`: The request body is larger than 40 MB (`payload_too_large`).
- `422`: The body failed validation (`validation_error`, `invalid_message`), the inbox can't send (`inbox_cannot_send`), the message has no address to reply to (`no_reply_recipient`), its domain is not verified for sending (`domain_not_verified`), or the `Idempotency-Key` was used with a different body (`idempotency_key_reused`).
- `429`: Too many requests with this API key (`rate_limited`), or the message's recipients exceed the send quota (`quota_exceeded`). Retry after `Retry-After` seconds.
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: The API key could not be verified right now; retry (`service_unavailable`).