# List the messages of an order (v1)

```http
GET https://secure.yoprint.com/v1/api/store/{team_slug}/sales_order/{hash_id}/message
```

- Status: legacy, deprecated
- API version: v1
- Operation ID: `v1_public_sales_order_v1_message_index`
- Section: Sales › [Sales order messages](https://developer.yoprint.com/reference/sales-order-messages.md)
- Web page: https://developer.yoprint.com/reference/sales-order-messages/v1-sales-order-v1-message-index/
- Authentication: `Authorization: Bearer YOUR_API_KEY`

> **Legacy (deprecated).** A newer operation does this better: use [List the messages of an order](https://developer.yoprint.com/reference/sales-order-messages/v2-order-message-index.md) (`GET /v2/api/store/{team_slug}/v2/sales_order/{hash_id}/message`) instead. Its answers say so in the `Deprecation` and `X-YoPrint-Successor` headers.

Returns the same conversation as the v2 list. Prefer List the messages of an order (v2). `{hash_id}` is the order's `id` (for example `V4keXwwxMQyXw7`); the `ord_` unique key is not accepted here.

## Permission

Needs permission to message this order's customer: the team owner, `message_all_order`, or `message_self_order` for orders the user created or is assigned to.

## Path parameters

- `team_slug` (string, required): Your team slug, shown as Team ID next to your API key in Profile. Example `your-team`.
- `hash_id` (string, required): The sales order's or quote's `id` (a hash id). The `ord_` unique key and the order number do not work here. Example `V4keXwwxMQyXw7`.

## Request body

This operation takes no request body.

### Example request

```bash
curl 'https://secure.yoprint.com/v1/api/store/your-team/sales_order/V4keXwwxMQyXw7/message' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'X-Yoprint-Decimal-Format: exact-v1'
```

## Response

`200` Successful response.

Fields:

- `data` (array of objects, required)
  - Each item:
    - `id` (string, required)
    - `actor_name` (string | null, optional): The writer's name, by `actor_type`: the team member, contact, customer, guest, participant or vendor; the team's name for `system`. Null when it can't be found.
    - `actor_type` (string | null, optional): Who wrote it: `user` (a team member), `contact`, `customer`, `guest`, `participant`, `vendor` or `system`.
    - `contact_id` (string | null, optional): The contact who sent it, for replies.
    - `created_at` (string (date-time) | null, optional): Sent. ISO 8601 with offset, or null.
    - `delivery_summary` (object | null, optional): Delivery state per recipient.
    - `email` (string | null, optional)
    - `name` (string | null, optional): Sender name, for replies from the customer; null on messages your team sends (read `actor_name`).
    - `order_id` (string | null, optional)
    - `order_scoped_id` (string | null, optional)
    - `preview_message` (string | null, optional): The first 200 characters. An email's preview keeps its HTML.
    - `status` (string | null, optional)
    - `type` (string | null, optional)
    - `user_id` (string | null, optional): The team member who sent it.
- `status` (integer, required)
- `success` (boolean, required)

Example response:

```json
{
  "data": [
    {
      "actor_name": "Alex Rivera",
      "actor_type": "user",
      "contact_id": null,
      "created_at": "2026-11-03T09:00:00+00:00",
      "email": null,
      "id": "mD1A7NR38PtyNs",
      "name": null,
      "order_id": "V4keXwwxMQyXw7",
      "order_scoped_id": "SO1001",
      "preview_message": "<p>Hi Alex, your order is ready for pickup.</p>",
      "status": "pending",
      "type": "outbound",
      "user_id": "PydH0WtBhSeiNU"
    }
  ],
  "status": 200,
  "success": true
}
```

## Errors

- `401` The API key is missing or wrong (`unauthenticated`).
- `403` You are not allowed to do this. `api_access_not_in_plan`: your team's plan doesn't include API access (Pro and above, with an active subscription or trial), so every request answers this until the team upgrades. When your role lacks the permission the operation needs, the body is only `{"message": "Insufficient Permission"}`. Other refusals use the error envelope, with `unauthorized` or `user_is_not_authorized`.
- `404` Not found. `page_not_found`: the team slug is unknown, you are not a member of the team, or an id in the path is not one of this team's. `code: null`, with a message that starts "No query results for": there is no record with that id.

## Related

- [List the messages of an order](https://developer.yoprint.com/reference/sales-order-messages/v2-order-message-index.md): `GET /v2/api/store/{team_slug}/v2/sales_order/{hash_id}/message`