# POST /api/v1/inboxes/:id/messages/:msgId/reply-all

Auth: Bearer

HTML: https://cooperemail.com/docs/reference/reply-all

## Summary

Same as reply with reply_all set. The body has no reply_all field. Other To and Cc addresses are included, this inbox is dropped, and addresses are deduped. Allow and block lists are checked; 403 recipient_blocked sends nothing. Idempotency-Key works the same way as on send (example: Idempotency-Key: reply-all-001).

## Request

```json
{
  "text": "Looping in the other recipients.",
  "client_id": "reply-all-001"
}
```

## Response

HTTP 201. Sample values illustrate the schema.

```json
{
  "id": "inb_example",
  "inbox_id": "inb_example",
  "thread_id": "thr_example",
  "direction": "inbound",
  "from": "ada@example.com",
  "to": [
    "string"
  ],
  "subject": "Hello",
  "text": "Tuesday works.",
  "html": "string",
  "extracted_text": "string",
  "extracted_html": "string",
  "preview": "string",
  "delivery_events": [
    {
      "type": "string",
      "recipient": "string",
      "created_at": "2026-10-18T12:00:00.000Z",
      "detail": "string"
    }
  ],
  "cc": [
    "string"
  ],
  "bcc": [
    "string"
  ],
  "reply_to": "string",
  "in_reply_to": "string",
  "references": [
    "string"
  ],
  "labels": [
    "string"
  ],
  "auth": {
    "spf": "string",
    "dkim": "string",
    "dmarc": "string"
  },
  "safety": {
    "score": 0,
    "verdict": "clean",
    "signals": [
      {
        "type": "string",
        "detail": "string"
      }
    ],
    "mode": "off",
    "reason": "string"
  },
  "provider": "string",
  "client_id": "inb_example",
  "idempotent": true
}
```

## Errors

- HTTP 403 recipient_blocked

The live `message` is the sentence for that code. Branch on `code`.

```json
{
  "error": {
    "type": "authentication_error",
    "code": "recipient_blocked",
    "docs_url": "https://cooperemail.com/docs#recipient_blocked"
  }
}
```

## Idempotency

Idempotency-Key is 1 to 256 characters of letters, digits, and - . _ ~. The same key and the same request within 24 hours returns the original response with HTTP 200 and Idempotent-Replayed: true. A different request is HTTP 409 idempotency_key_conflict. A second call while the first is running is HTTP 409 idempotency_request_in_progress. An empty or invalid key is HTTP 400 invalid_idempotency_key. client_id is checked first when both are set.