> For the complete documentation index, see [llms.txt](https://docs.mailtrap.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mailtrap.io/developers/email-sandbox/messages/get-html-message.md).

# Get HTML message

Get the HTML body of an email, sanitized for preview. Not applicable for plain text emails.

The response is not the email as it was sent. Mailtrap changes it as follows:

* The response is always a full HTML document with `html`, `head` and `body` elements.
* The first element in `head` is a `<meta http-equiv="Content-Security-Policy" content="script-src 'none'">` tag.
* Entities such as `&copy;` come back as the character (`©`). `&`, `<`, `>`, non-breaking spaces and quotes in attribute values stay escaped, so a raw `&` in a link URL comes back as `&amp;`.
* Scripts and stylesheet links are removed. Stylesheet links to Google Fonts stay.
* Each `@import` rule in a `<style>` element is renamed to `@x-import`, so the browser does not load it. An `@import` from Google Fonts stays.
* Each `cid:` image reference with a matching attachment points to a Mailtrap attachment URL. A reference without one becomes `data:,`.
* Links with a URL get `target="_blank"` and `rel="noopener noreferrer"`. A link with no URL or only a `#fragment` loses its `target`.

The `X-Blocked-Content` response header lists the content that Mailtrap removed or disabled.

If Mailtrap cannot sanitize the HTML, the response is still `200`. The body is then a placeholder page, and `X-Blocked-Content` is `unparseable=1`.

{% hint style="info" %}
To get the email as it was sent, use `GET /api/sandboxes/{sandbox_id}/messages/{message_id}/body.htmlsource`. For example, use it to read links in your tests.
{% endhint %}

```json
{"openapi":"3.1.0","info":{"title":"Email Sandbox","version":"2.0.0"},"tags":[{"name":"Messages","description":"Interactions with messages"}],"servers":[{"description":"Mailtrap API","url":"https://mailtrap.io"}],"security":[{"HeaderAuth":[]},{"BearerAuth":[]}],"components":{"securitySchemes":{"HeaderAuth":{"type":"apiKey","description":"Pass the API token in the Api-Token","in":"header","name":"Api-Token"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"}},"responses":{"UNAUTHENTICATED":{"description":"Returns unauthorized error message. Check your credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthenticatedResponse"}}}},"NOT_FOUND":{"description":"Returns not found error message","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundResponse"}}}}},"schemas":{"UnauthenticatedResponse":{"title":"UnauthenticatedResponse","type":"object","properties":{"error":{"type":"string","description":"Error message"}}},"NotFoundResponse":{"title":"NotFoundResponse","type":"object","properties":{"error":{"type":"string","description":"Error message"}}}}},"paths":{"/api/sandboxes/{sandbox_id}/messages/{message_id}/body.html":{"get":{"summary":"Get HTML message","description":"Get the HTML body of an email, sanitized for preview. Not applicable for plain text emails.\n\nThe response is not the email as it was sent. Mailtrap changes it as follows:\n\n- The response is always a full HTML document with `html`, `head` and `body` elements.\n- The first element in `head` is a `<meta http-equiv=\"Content-Security-Policy\" content=\"script-src 'none'\">` tag.\n- Entities such as `&copy;` come back as the character (`©`). `&`, `<`, `>`, non-breaking spaces and quotes in attribute values stay escaped, so a raw `&` in a link URL comes back as `&amp;`.\n- Scripts and stylesheet links are removed. Stylesheet links to Google Fonts stay.\n- Each `@import` rule in a `<style>` element is renamed to `@x-import`, so the browser does not load it. An `@import` from Google Fonts stays.\n- Each `cid:` image reference with a matching attachment points to a Mailtrap attachment URL. A reference without one becomes `data:,`.\n- Links with a URL get `target=\"_blank\"` and `rel=\"noopener noreferrer\"`. A link with no URL or only a `#fragment` loses its `target`.\n\nThe `X-Blocked-Content` response header lists the content that Mailtrap removed or disabled.\n\nIf Mailtrap cannot sanitize the HTML, the response is still `200`. The body is then a placeholder page, and `X-Blocked-Content` is `unparseable=1`.\n\n{% hint style=\"info\" %}\nTo get the email as it was sent, use `GET /api/sandboxes/{sandbox_id}/messages/{message_id}/body.htmlsource`. For example, use it to read links in your tests.\n{% endhint %}\n","tags":["Messages"],"responses":{"200":{"description":"Returns the HTML body, sanitized for preview.","headers":{"X-Blocked-Content":{"description":"The content that Mailtrap removed from the HTML or disabled. The header is absent if nothing was blocked.\n\nThe value is a comma-separated list of `type=count` pairs. The order of the pairs is not fixed. The types are:\n\n- `script`: a script that loads an external file. Mailtrap also removes inline scripts, but does not count them.\n- `stylesheet`: a stylesheet link.\n- `css_import`: an `@import` rule. The count is an upper bound. It includes every disabled `@import`, also one that applies only under a media query, and one that the browser ignores. An `@import` from Google Fonts stays and is not counted.\n- `unparseable`: Mailtrap could not sanitize the HTML and returned a placeholder page. The value is then always `unparseable=1`.\n- `truncated`: the HTML was too complex to sanitize in full. The body holds the sanitized first part of it. The count is always `1`.\n","schema":{"type":"string"}}},"content":{"text/html":{"schema":{"type":"string"}}}},"401":{"$ref":"#/components/responses/UNAUTHENTICATED"},"403":{"description":"Returns forbidden error message. Check your permissions.","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"string"}}}}}},"404":{"$ref":"#/components/responses/NOT_FOUND"},"409":{"description":"Returns conflict error message. HTML source does not exist.","content":{"text/plain":{"schema":{"type":"string"}}}},"429":{"description":"Mailtrap is sanitizing too many large HTML bodies at the same time. Retry after the number of seconds in `Retry-After`.","headers":{"Retry-After":{"description":"The number of seconds to wait before you retry.","schema":{"type":"integer"}}}}},"operationId":"getSandboxEmailMessageBodyAsHtml"}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.mailtrap.io/developers/email-sandbox/messages/get-html-message.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.