From 82eeb0e25d8709fd9e0670d0f42bb1699c299f97 Mon Sep 17 00:00:00 2001 From: IzikAJ Date: Thu, 15 Oct 2026 15:43:06 +0300 Subject: [PATCH 1/4] Document the sanitized Sandbox body.html and X-Blocked-Content body.html returns the HTML that the Sandbox preview shows, not the email as it was sent. Describe the changes, point to body.htmlsource for the original, and document the X-Blocked-Content response header. Generate the body.html example from the sanitizer output for the body.htmlsource example, so the two examples show the same email. Co-Authored-By: Claude Opus 5.5 --- specs/sandbox.openapi.yml | 67 ++++++++++++++++++++++++++++++--------- 1 file changed, 52 insertions(+), 15 deletions(-) diff --git a/specs/sandbox.openapi.yml b/specs/sandbox.openapi.yml index 7bd80a3..2dfc76c 100644 --- a/specs/sandbox.openapi.yml +++ b/specs/sandbox.openapi.yml @@ -4410,12 +4410,12 @@ paths: '/api/sandboxes/{sandbox_id}/messages/{message_id}/body.htmlsource': get: summary: Get message source - description: Get HTML source of email. + description: Get the HTML body of an email as it was sent. Not applicable for plain text emails. tags: - Messages responses: '200': - description: Returns HTML source of a message. + description: Returns the HTML body as it was sent. content: text/html: schema: @@ -4426,6 +4426,8 @@ paths: + + @@ -4441,11 +4443,13 @@ paths:

Now send your email using our fake SMTP server and integration of your choice!

+

Confirm your email

Good luck! Hope it works.

- @@ -4589,22 +4593,53 @@ paths: '/api/sandboxes/{sandbox_id}/messages/{message_id}/body.html': get: summary: Get HTML message - description: Get formatted HTML email body. Not applicable for plain text emails. + description: | + Get the HTML body of an email, sanitized for preview. Not applicable for plain text emails. + + The response is not the email as it was sent. Mailtrap changes it as follows: + + - The response is always a full HTML document with `html`, `head` and `body` elements. + - The first element in `head` is a `` tag. + - HTML entities are escaped. For example, a raw `&` in a link URL comes back as `&`. + - Scripts and stylesheet links are removed. Stylesheet links to Google Fonts stay. + - Each `@import` rule in a ` - - + + + '401': $ref: '#/components/responses/UNAUTHENTICATED' '403': From 2d83fe3972c7a051a6dc98e7928a80c216804f5b Mon Sep 17 00:00:00 2001 From: IzikAJ Date: Tue, 20 Oct 2026 12:32:46 +0300 Subject: [PATCH 2/4] Document the truncated type of X-Blocked-Content --- specs/sandbox.openapi.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/specs/sandbox.openapi.yml b/specs/sandbox.openapi.yml index 2dfc76c..5f7c0a0 100644 --- a/specs/sandbox.openapi.yml +++ b/specs/sandbox.openapi.yml @@ -4628,6 +4628,7 @@ paths: - `stylesheet`: a stylesheet link. - `css_import`: an `@import` rule. The count is an upper bound. It includes every disabled `@import`, also one that applies only under a media query, and one that the browser ignores. - `unparseable`: Mailtrap could not sanitize the HTML and returned a placeholder page. The value is then always `unparseable=1`. + - `truncated`: the HTML was too complex to sanitize in full. The body holds the sanitized first part of it. The count is always `1`. schema: type: string example: stylesheet=1,script=1,css_import=1 From ba5194c54a6dbc75aec5823b7faf6a97c7fc2e94 Mon Sep 17 00:00:00 2001 From: IzikAJ Date: Tue, 20 Oct 2026 14:55:09 +0300 Subject: [PATCH 3/4] Document the 429 of the sanitized Sandbox body.html --- specs/sandbox.openapi.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/specs/sandbox.openapi.yml b/specs/sandbox.openapi.yml index 5f7c0a0..41fb4c4 100644 --- a/specs/sandbox.openapi.yml +++ b/specs/sandbox.openapi.yml @@ -4688,6 +4688,14 @@ paths: schema: type: string example: Conflict + '429': + description: Mailtrap is sanitizing too many large HTML bodies at the same time. Retry after the number of seconds in `Retry-After`. + headers: + Retry-After: + description: The number of seconds to wait before you retry. + schema: + type: integer + example: 2 x-codeSamples: - lang: shell label: 'cURL' From 4f487a42ff53f70971e81710bb213066b4df9ae4 Mon Sep 17 00:00:00 2001 From: IzikAJ Date: Tue, 20 Oct 2026 18:12:37 +0300 Subject: [PATCH 4/4] Clarify entities, Google Fonts imports, cid references and link targets --- specs/sandbox.openapi.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/specs/sandbox.openapi.yml b/specs/sandbox.openapi.yml index 41fb4c4..373703f 100644 --- a/specs/sandbox.openapi.yml +++ b/specs/sandbox.openapi.yml @@ -4600,10 +4600,11 @@ paths: - The response is always a full HTML document with `html`, `head` and `body` elements. - The first element in `head` is a `` tag. - - HTML entities are escaped. For example, a raw `&` in a link URL comes back as `&`. + - Entities such as `©` come back as the character (`©`). `&`, `<`, `>`, non-breaking spaces and quotes in attribute values stay escaped, so a raw `&` in a link URL comes back as `&`. - Scripts and stylesheet links are removed. Stylesheet links to Google Fonts stay. - - Each `@import` rule in a `