[ Web Proxy ]
URL:
Viewing: https://developers.cloudflare.com/api/resources/email_security [Back]  [Original]
Email Security | Cloudflare API Skip to content
logo.DMYpXs3t.svg [logo.DMYpXs3t.svg] Cloudflare API
CtrlK
Start here
Start here
HTTP
API Reference
Copy Markdown

Email Security

Email SecurityInvestigate

Search email messages
GET/accounts/{account_id}/email-security/investigate
Get message details
GET/accounts/{account_id}/email-security/investigate/{investigate_id}
ModelsExpand Collapse
InvestigateListResponse object { id, action_log, client_recipients, 32 more }
id: string

Unique identifier for a message retrieved from investigation.

Deprecatedaction_log: array of object { completed_at, operation, completed_timestamp, 2 more }

Use GET /investigate/{investigate_id}/action_log instead.

Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.

completed_at: string

Timestamp when action completed.

formatdate-time
operation: "MOVE" or "RELEASE" or "RECLASSIFY" or 3 more

Type of action performed.

One of the following:
"MOVE"
"RELEASE"
"RECLASSIFY"
"SUBMISSION"
"QUARANTINE_RELEASE"
"PREVIEW"
Deprecatedcompleted_timestamp: optional string

Use completed_at instead.

Deprecated, use completed_at instead. End of life: November 1, 2026.

properties: optional object { folder, requested_by }

Additional properties for the action.

folder: optional string

Target folder for move operations.

requested_by: optional string

User who requested the action.

status: optional string

Status of the action.

client_recipients: array of string
detection_reasons: array of string
is_phish_submission: boolean
is_quarantined: boolean
postfix_id: string

The identifier of the message.

properties: object { allowlisted_pattern, allowlisted_pattern_type, blocklisted_message, 2 more }

Message processing properties.

allowlisted_pattern: optional string

Pattern that allowlisted this message.

allowlisted_pattern_type: optional "quarantine_release" or "acceptable_sender" or "allowed_sender" or 5 more

Type of allowlist pattern.

One of the following:
"quarantine_release"
"acceptable_sender"
"allowed_sender"
"allowed_recipient"
"domain_similarity"
"domain_recency"
"managed_acceptable_sender"
"outbound_ndr"
blocklisted_message: optional boolean

Whether message was blocklisted.

blocklisted_pattern: optional string

Pattern that blocklisted this message.

whitelisted_pattern_type: optional "quarantine_release" or "acceptable_sender" or "allowed_sender" or 5 more

Legacy field for allowlist pattern type.

One of the following:
"quarantine_release"
"acceptable_sender"
"allowed_sender"
"allowed_recipient"
"domain_similarity"
"domain_recency"
"managed_acceptable_sender"
"outbound_ndr"
Deprecatedts: string

Use scanned_at instead.

Deprecated, use scanned_at instead. End of life: November 1, 2026.

alert_id: optional string
delivery_mode: optional "DIRECT" or "BCC" or "JOURNAL" or 8 more
One of the following:
"DIRECT"
"BCC"
"JOURNAL"
"REVIEW_SUBMISSION"
"DMARC_UNVERIFIED"
"DMARC_FAILURE_REPORT"
"DMARC_AGGREGATE_REPORT"
"THREAT_INTEL_SUBMISSION"
"SIMULATION_SUBMISSION"
"API"
"RETRO_SCAN"
delivery_status: optional array of "delivered" or "moved" or "quarantined" or 4 more
One of the following:
"delivered"
"moved"
"quarantined"
"rejected"
"deferred"
"bounced"
"queued"
edf_hash: optional string
envelope_from: optional string
envelope_to: optional array of string
final_disposition: optional "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
Deprecatedfindings: optional array of object { attachment, detail, detection, 6 more }

Use the findings field from GET /investigate/{investigate_id}/detections instead.

Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message.

attachment: optional string
detail: optional string
detection: optional "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
field: optional string
name: optional string
portion: optional string
reason: optional string
score: optional number
formatdouble
value: optional string
from: optional string
from_name: optional string
htmltext_structure_hash: optional string
message_id: optional string
post_delivery_operations: optional array of "PREVIEW" or "QUARANTINE_RELEASE" or "SUBMISSION" or "MOVE"

Post-delivery operations performed on this message.

One of the following:
"PREVIEW"
"QUARANTINE_RELEASE"
"SUBMISSION"
"MOVE"
postfix_id_outbound: optional string
replyto: optional string
scanned_at: optional string

When the message was scanned (UTC).

formatdate-time
sent_at: optional string

When the message was sent (UTC).

formatdate-time
sent_date: optional string
smtp_helo_server_ip: optional string
smtp_previous_hop_ip: optional string
subject: optional string
threat_categories: optional array of string
to: optional array of string
to_name: optional array of string
validation: optional object { comment, dkim, dmarc, spf }
comment: optional string
dkim: optional "pass" or "neutral" or "fail" or 2 more
One of the following:
"pass"
"neutral"
"fail"
"error"
"none"
dmarc: optional "pass" or "neutral" or "fail" or 2 more
One of the following:
"pass"
"neutral"
"fail"
"error"
"none"
spf: optional "pass" or "neutral" or "fail" or 2 more
One of the following:
"pass"
"neutral"
"fail"
"error"
"none"
x_originating_ip: optional string
InvestigateGetResponse object { id, action_log, client_recipients, 32 more }
id: string

Unique identifier for a message retrieved from investigation.

Deprecatedaction_log: array of object { completed_at, operation, completed_timestamp, 2 more }

Use GET /investigate/{investigate_id}/action_log instead.

Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.

completed_at: string

Timestamp when action completed.

formatdate-time
operation: "MOVE" or "RELEASE" or "RECLASSIFY" or 3 more

Type of action performed.

One of the following:
"MOVE"
"RELEASE"
"RECLASSIFY"
"SUBMISSION"
"QUARANTINE_RELEASE"
"PREVIEW"
Deprecatedcompleted_timestamp: optional string

Use completed_at instead.

Deprecated, use completed_at instead. End of life: November 1, 2026.

properties: optional object { folder, requested_by }

Additional properties for the action.

folder: optional string

Target folder for move operations.

requested_by: optional string

User who requested the action.

status: optional string

Status of the action.

client_recipients: array of string
detection_reasons: array of string
is_phish_submission: boolean
is_quarantined: boolean
postfix_id: string

The identifier of the message.

properties: object { allowlisted_pattern, allowlisted_pattern_type, blocklisted_message, 2 more }

Message processing properties.

allowlisted_pattern: optional string

Pattern that allowlisted this message.

allowlisted_pattern_type: optional "quarantine_release" or "acceptable_sender" or "allowed_sender" or 5 more

Type of allowlist pattern.

One of the following:
"quarantine_release"
"acceptable_sender"
"allowed_sender"
"allowed_recipient"
"domain_similarity"
"domain_recency"
"managed_acceptable_sender"
"outbound_ndr"
blocklisted_message: optional boolean

Whether message was blocklisted.

blocklisted_pattern: optional string

Pattern that blocklisted this message.

whitelisted_pattern_type: optional "quarantine_release" or "acceptable_sender" or "allowed_sender" or 5 more

Legacy field for allowlist pattern type.

One of the following:
"quarantine_release"
"acceptable_sender"
"allowed_sender"
"allowed_recipient"
"domain_similarity"
"domain_recency"
"managed_acceptable_sender"
"outbound_ndr"
Deprecatedts: string

Use scanned_at instead.

Deprecated, use scanned_at instead. End of life: November 1, 2026.

alert_id: optional string
delivery_mode: optional "DIRECT" or "BCC" or "JOURNAL" or 8 more
One of the following:
"DIRECT"
"BCC"
"JOURNAL"
"REVIEW_SUBMISSION"
"DMARC_UNVERIFIED"
"DMARC_FAILURE_REPORT"
"DMARC_AGGREGATE_REPORT"
"THREAT_INTEL_SUBMISSION"
"SIMULATION_SUBMISSION"
"API"
"RETRO_SCAN"
delivery_status: optional array of "delivered" or "moved" or "quarantined" or 4 more
One of the following:
"delivered"
"moved"
"quarantined"
"rejected"
"deferred"
"bounced"
"queued"
edf_hash: optional string
envelope_from: optional string
envelope_to: optional array of string
final_disposition: optional "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
Deprecatedfindings: optional array of object { attachment, detail, detection, 6 more }

Use the findings field from GET /investigate/{investigate_id}/detections instead.

Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message.

attachment: optional string
detail: optional string
detection: optional "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
field: optional string
name: optional string
portion: optional string
reason: optional string
score: optional number
formatdouble
value: optional string
from: optional string
from_name: optional string
htmltext_structure_hash: optional string
message_id: optional string
post_delivery_operations: optional array of "PREVIEW" or "QUARANTINE_RELEASE" or "SUBMISSION" or "MOVE"

Post-delivery operations performed on this message.

One of the following:
"PREVIEW"
"QUARANTINE_RELEASE"
"SUBMISSION"
"MOVE"
postfix_id_outbound: optional string
replyto: optional string
scanned_at: optional string

When the message was scanned (UTC).

formatdate-time
sent_at: optional string

When the message was sent (UTC).

formatdate-time
sent_date: optional string
smtp_helo_server_ip: optional string
smtp_previous_hop_ip: optional string
subject: optional string
threat_categories: optional array of string
to: optional array of string
to_name: optional array of string
validation: optional object { comment, dkim, dmarc, spf }
comment: optional string
dkim: optional "pass" or "neutral" or "fail" or 2 more
One of the following:
"pass"
"neutral"
"fail"
"error"
"none"
dmarc: optional "pass" or "neutral" or "fail" or 2 more
One of the following:
"pass"
"neutral"
"fail"
"error"
"none"
spf: optional "pass" or "neutral" or "fail" or 2 more
One of the following:
"pass"
"neutral"
"fail"
"error"
"none"
x_originating_ip: optional string

Email SecurityInvestigateDetections

Get message detection details
GET/accounts/{account_id}/email-security/investigate/{investigate_id}/detections
ModelsExpand Collapse
DetectionGetResponse object { action, attachments, findings, 6 more }
action: string
attachments: array of object { size, content_type, detection, 6 more }
size: number

Size of the attachment in bytes.

minimum0
content_type: optional string

MIME type of the attachment.

detection: optional "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more

Detection result for this attachment.

One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
encrypted: optional boolean

Whether the attachment is encrypted.

filename: optional string

Name of the attached file.

md5: optional string

MD5 hash of the attachment.

name: optional string

Attachment name (alternative to filename).

sha1: optional string

SHA1 hash of the attachment.

sha256: optional string

SHA256 hash of the attachment.

findings: array of object { attachment, detail, detection, 6 more }
attachment: optional string
detail: optional string
detection: optional "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
field: optional string
name: optional string
portion: optional string
reason: optional string
score: optional number
formatdouble
value: optional string
headers: array of object { name, value }
name: string
value: string
text: optional string
sender_info: object { as_name, as_number, geo, 2 more }
as_name: optional string

The name of the autonomous system.

as_number: optional number

The number of the autonomous system.

geo: optional string
ip: optional string
pld: optional string
threat_categories: array of object { id, description, name }
id: optional number
description: optional string
name: optional string
validation: object { comment, dkim, dmarc, spf }
comment: optional string
dkim: optional "pass" or "neutral" or "fail" or 2 more
One of the following:
"pass"
"neutral"
"fail"
"error"
"none"
dmarc: optional "pass" or "neutral" or "fail" or 2 more
One of the following:
"pass"
"neutral"
"fail"
"error"
"none"
spf: optional "pass" or "neutral" or "fail" or 2 more
One of the following:
"pass"
"neutral"
"fail"
"error"
"none"
final_disposition: optional "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"

Email SecurityInvestigatePreview

Get email preview
GET/accounts/{account_id}/email-security/investigate/{investigate_id}/preview
Preview for non-detection messages
POST/accounts/{account_id}/email-security/investigate/preview
ModelsExpand Collapse
PreviewGetResponse object { screenshot }
screenshot: string

A base64 encoded PNG image of the email.

PreviewCreateResponse object { screenshot }
screenshot: string

A base64 encoded PNG image of the email.

Email SecurityInvestigateRaw

Get raw email content
GET/accounts/{account_id}/email-security/investigate/{investigate_id}/raw
ModelsExpand Collapse
RawGetResponse object { raw }
raw: string

A UTF-8 encoded eml file of the email.

Email SecurityInvestigateTrace

Get email trace
GET/accounts/{account_id}/email-security/investigate/{investigate_id}/trace
ModelsExpand Collapse
TraceGetResponse object { inbound, outbound }
inbound: object { lines, pending }
lines: optional array of object { lineno, logged_at, message, ts }
lineno: optional number

Line number in the trace log.

logged_at: optional string
formatdate-time
message: optional string
Deprecatedts: optional string

Use logged_at instead.

Deprecated, use logged_at instead. End of life: November 1, 2026.

pending: optional boolean
outbound: object { lines, pending }
lines: optional array of object { lineno, logged_at, message, ts }
lineno: optional number

Line number in the trace log.

logged_at: optional string
formatdate-time
message: optional string
Deprecatedts: optional string

Use logged_at instead.

Deprecated, use logged_at instead. End of life: November 1, 2026.

pending: optional boolean

Email SecurityInvestigateMove

Move a message
POST/accounts/{account_id}/email-security/investigate/{investigate_id}/move
Move multiple messages
POST/accounts/{account_id}/email-security/investigate/move
ModelsExpand Collapse
MoveCreateResponse object { success, completed_at, completed_timestamp, 6 more }
success: boolean

Whether the operation succeeded.

completed_at: optional string

When the move operation completed (UTC).

formatdate-time
Deprecatedcompleted_timestamp: optional string

Use completed_at instead.

Deprecated, use completed_at instead. End of life: November 1, 2026.

formatdate-time
destination: optional string

Destination folder for the message.

Deprecateditem_count: optional number

This field is deprecated.

Number of items moved. End of life: November 1, 2026.

message_id: optional string

Message identifier.

operation: optional string

Type of operation performed.

recipient: optional string

Recipient email address.

status: optional string

Operation status.

MoveBulkResponse object { success, completed_at, completed_timestamp, 6 more }
success: boolean

Whether the operation succeeded.

completed_at: optional string

When the move operation completed (UTC).

formatdate-time
Deprecatedcompleted_timestamp: optional string

Use completed_at instead.

Deprecated, use completed_at instead. End of life: November 1, 2026.

formatdate-time
destination: optional string

Destination folder for the message.

Deprecateditem_count: optional number

This field is deprecated.

Number of items moved. End of life: November 1, 2026.

message_id: optional string

Message identifier.

operation: optional string

Type of operation performed.

recipient: optional string

Recipient email address.

status: optional string

Operation status.

Email SecurityInvestigateReclassify

Change email classification
POST/accounts/{account_id}/email-security/investigate/{investigate_id}/reclassify
ModelsExpand Collapse
ReclassifyCreateResponse = unknown

Email SecurityInvestigateRelease

Release messages from quarantine
POST/accounts/{account_id}/email-security/investigate/release
ModelsExpand Collapse
ReleaseBulkResponse object { id, delivered, failed, 2 more }
id: string

Unique identifier for a message retrieved from investigation.

delivered: optional array of string
failed: optional array of string
Deprecatedpostfix_id: optional string

Use id instead.

Deprecated, use id instead. End of life: November 1, 2026.

undelivered: optional array of string

Email SecurityInvestigateBulk

List bulk action jobs
GET/accounts/{account_id}/email-security/investigate/bulk
Create a bulk action job
POST/accounts/{account_id}/email-security/investigate/bulk
Get bulk action job details
GET/accounts/{account_id}/email-security/investigate/bulk/{job_id}
Delete a bulk action job
DELETE/accounts/{account_id}/email-security/investigate/bulk/{job_id}
ModelsExpand Collapse
BulkListResponse object { action_params, action_type, created_at, 11 more }
action_params: object { destination, type, expected_disposition } or object { type }
One of the following:
Move object { destination, type, expected_disposition }
destination: "Inbox" or "JunkEmail" or "DeletedItems" or 2 more
One of the following:
"Inbox"
"JunkEmail"
"DeletedItems"
"RecoverableItemsDeletions"
"RecoverableItemsPurges"
type: "MOVE"
expected_disposition: optional "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
Release object { type }
type: "RELEASE"
action_type: "MOVE" or "RELEASE"
One of the following:
"MOVE"
"RELEASE"
created_at: string
formatdate-time
job_id: string
formatuuid
messages_failed: number
messages_pending: number
messages_successful: number
search_params: object { action_log, alert_id, delivery_status, 14 more }
Deprecatedaction_log: optional boolean

Use GET /investigate/{investigate_id}/action_log instead.

Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.

alert_id: optional string
delivery_status: optional "delivered" or "moved" or "quarantined" or 4 more

Delivery status of the message.

One of the following:
"delivered"
"moved"
"quarantined"
"rejected"
"deferred"
"bounced"
"queued"
detections_only: optional boolean
domain: optional string
end: optional string

End of search date range.

formatdate-time
exact_subject: optional string
final_disposition: optional "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
message_action: optional "PREVIEW" or "QUARANTINE_RELEASED" or "MOVED"
One of the following:
"PREVIEW"
"QUARANTINE_RELEASED"
"MOVED"
message_id: optional string
metric: optional string
query: optional string
recipient: optional string
sender: optional string
start: optional string

Beginning of search date range.

formatdate-time
subject: optional string
submissions: optional boolean
status: "PENDING" or "DISCOVERING" or "PROCESSING" or 4 more
One of the following:
"PENDING"
"DISCOVERING"
"PROCESSING"
"COMPLETED"
"FAILED"
"CANCELLED"
"SKIPPED"
total_messages_discovered: number
comment: optional string
completed_at: optional string
formatdate-time
started_at: optional string
formatdate-time
status_message: optional string
BulkCreateResponse object { action_params, action_type, created_at, 11 more }
action_params: object { destination, type, expected_disposition } or object { type }
One of the following:
Move object { destination, type, expected_disposition }
destination: "Inbox" or "JunkEmail" or "DeletedItems" or 2 more
One of the following:
"Inbox"
"JunkEmail"
"DeletedItems"
"RecoverableItemsDeletions"
"RecoverableItemsPurges"
type: "MOVE"
expected_disposition: optional "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
Release object { type }
type: "RELEASE"
action_type: "MOVE" or "RELEASE"
One of the following:
"MOVE"
"RELEASE"
created_at: string
formatdate-time
job_id: string
formatuuid
messages_failed: number
messages_pending: number
messages_successful: number
search_params: object { action_log, alert_id, delivery_status, 14 more }
Deprecatedaction_log: optional boolean

Use GET /investigate/{investigate_id}/action_log instead.

Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.

alert_id: optional string
delivery_status: optional "delivered" or "moved" or "quarantined" or 4 more

Delivery status of the message.

One of the following:
"delivered"
"moved"
"quarantined"
"rejected"
"deferred"
"bounced"
"queued"
detections_only: optional boolean
domain: optional string
end: optional string

End of search date range.

formatdate-time
exact_subject: optional string
final_disposition: optional "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
message_action: optional "PREVIEW" or "QUARANTINE_RELEASED" or "MOVED"
One of the following:
"PREVIEW"
"QUARANTINE_RELEASED"
"MOVED"
message_id: optional string
metric: optional string
query: optional string
recipient: optional string
sender: optional string
start: optional string

Beginning of search date range.

formatdate-time
subject: optional string
submissions: optional boolean
status: "PENDING" or "DISCOVERING" or "PROCESSING" or 4 more
One of the following:
"PENDING"
"DISCOVERING"
"PROCESSING"
"COMPLETED"
"FAILED"
"CANCELLED"
"SKIPPED"
total_messages_discovered: number
comment: optional string
completed_at: optional string
formatdate-time
started_at: optional string
formatdate-time
status_message: optional string
BulkGetResponse object { action_params, action_type, created_at, 11 more }
action_params: object { destination, type, expected_disposition } or object { type }
One of the following:
Move object { destination, type, expected_disposition }
destination: "Inbox" or "JunkEmail" or "DeletedItems" or 2 more
One of the following:
"Inbox"
"JunkEmail"
"DeletedItems"
"RecoverableItemsDeletions"
"RecoverableItemsPurges"
type: "MOVE"
expected_disposition: optional "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
Release object { type }
type: "RELEASE"
action_type: "MOVE" or "RELEASE"
One of the following:
"MOVE"
"RELEASE"
created_at: string
formatdate-time
job_id: string
formatuuid
messages_failed: number
messages_pending: number
messages_successful: number
search_params: object { action_log, alert_id, delivery_status, 14 more }
Deprecatedaction_log: optional boolean

Use GET /investigate/{investigate_id}/action_log instead.

Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.

alert_id: optional string
delivery_status: optional "delivered" or "moved" or "quarantined" or 4 more

Delivery status of the message.

One of the following:
"delivered"
"moved"
"quarantined"
"rejected"
"deferred"
"bounced"
"queued"
detections_only: optional boolean
domain: optional string
end: optional string

End of search date range.

formatdate-time
exact_subject: optional string
final_disposition: optional "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
message_action: optional "PREVIEW" or "QUARANTINE_RELEASED" or "MOVED"
One of the following:
"PREVIEW"
"QUARANTINE_RELEASED"
"MOVED"
message_id: optional string
metric: optional string
query: optional string
recipient: optional string
sender: optional string
start: optional string

Beginning of search date range.

formatdate-time
subject: optional string
submissions: optional boolean
status: "PENDING" or "DISCOVERING" or "PROCESSING" or 4 more
One of the following:
"PENDING"
"DISCOVERING"
"PROCESSING"
"COMPLETED"
"FAILED"
"CANCELLED"
"SKIPPED"
total_messages_discovered: number
comment: optional string
completed_at: optional string
formatdate-time
started_at: optional string
formatdate-time
status_message: optional string
BulkDeleteResponse object { id }
id: string
formatuuid

Email SecurityInvestigateBulkCancel

Cancel a bulk action job
POST/accounts/{account_id}/email-security/investigate/bulk/{job_id}/cancel
ModelsExpand Collapse
CancelCreateResponse object { action_params, action_type, created_at, 11 more }
action_params: object { destination, type, expected_disposition } or object { type }
One of the following:
Move object { destination, type, expected_disposition }
destination: "Inbox" or "JunkEmail" or "DeletedItems" or 2 more
One of the following:
"Inbox"
"JunkEmail"
"DeletedItems"
"RecoverableItemsDeletions"
"RecoverableItemsPurges"
type: "MOVE"
expected_disposition: optional "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
Release object { type }
type: "RELEASE"
action_type: "MOVE" or "RELEASE"
One of the following:
"MOVE"
"RELEASE"
created_at: string
formatdate-time
job_id: string
formatuuid
messages_failed: number
messages_pending: number
messages_successful: number
search_params: object { action_log, alert_id, delivery_status, 14 more }
Deprecatedaction_log: optional boolean

Use GET /investigate/{investigate_id}/action_log instead.

Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.

alert_id: optional string
delivery_status: optional "delivered" or "moved" or "quarantined" or 4 more

Delivery status of the message.

One of the following:
"delivered"
"moved"
"quarantined"
"rejected"
"deferred"
"bounced"
"queued"
detections_only: optional boolean
domain: optional string
end: optional string

End of search date range.

formatdate-time
exact_subject: optional string
final_disposition: optional "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
message_action: optional "PREVIEW" or "QUARANTINE_RELEASED" or "MOVED"
One of the following:
"PREVIEW"
"QUARANTINE_RELEASED"
"MOVED"
message_id: optional string
metric: optional string
query: optional string
recipient: optional string
sender: optional string
start: optional string

Beginning of search date range.

formatdate-time
subject: optional string
submissions: optional boolean
status: "PENDING" or "DISCOVERING" or "PROCESSING" or 4 more
One of the following:
"PENDING"
"DISCOVERING"
"PROCESSING"
"COMPLETED"
"FAILED"
"CANCELLED"
"SKIPPED"
total_messages_discovered: number
comment: optional string
completed_at: optional string
formatdate-time
started_at: optional string
formatdate-time
status_message: optional string

Email SecurityInvestigateBulkMessages

List messages for a bulk action job
GET/accounts/{account_id}/email-security/investigate/bulk/{job_id}/messages
ModelsExpand Collapse
MessageListResponse object { action_params, action_type, created_at, 9 more }
action_params: object { client_recipient, destination, type, expected_disposition } or object { client_recipient, type }
One of the following:
Move object { client_recipient, destination, type, expected_disposition }
client_recipient: string
destination: "Inbox" or "JunkEmail" or "DeletedItems" or 2 more
One of the following:
"Inbox"
"JunkEmail"
"DeletedItems"
"RecoverableItemsDeletions"
"RecoverableItemsPurges"
type: "MOVE"
expected_disposition: optional "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
Release object { client_recipient, type }
client_recipient: string
type: "RELEASE"
action_type: "MOVE" or "RELEASE"
One of the following:
"MOVE"
"RELEASE"
created_at: string
formatdate-time
message_id: string
formatuuid
postfix_id: string
retry_count: number
status: "PENDING" or "DISCOVERING" or "PROCESSING" or 4 more
One of the following:
"PENDING"
"DISCOVERING"
"PROCESSING"
"COMPLETED"
"FAILED"
"CANCELLED"
"SKIPPED"
alert_id: optional string
email_message_id: optional string
processed_at: optional string
formatdate-time
retry_after: optional string

When to retry the action if it failed.

formatdate-time
status_message: optional string

Email SecurityPhishguard

Email SecurityPhishguardReports

Get PhishGuard reports
GET/accounts/{account_id}/email-security/phishguard/reports
ModelsExpand Collapse
ReportListResponse object { id, content, disposition, 7 more }
id: number
content: string
disposition: "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
fields: object { to, from, occurred_at, 2 more }
to: array of string
from: optional string
occurred_at: optional string
formatdate-time
postfix_id: optional string
Deprecatedts: optional string

Use occurred_at instead.

Deprecated, use occurred_at instead.

formatdate-time
priority: string
title: string
created_at: optional string
formatdate-time
tags: optional array of object { category, value }
category: string
value: string
Deprecatedts: optional string

Use created_at instead.

Deprecated, use created_at instead.

formatdate-time
updated_at: optional string
formatdate-time

Email SecuritySettings

Email SecuritySettingsAllow Policies

List email allow policies
GET/accounts/{account_id}/email-security/settings/allow_policies
Get an email allow policy
GET/accounts/{account_id}/email-security/settings/allow_policies/{policy_id}
Create email allow policy
POST/accounts/{account_id}/email-security/settings/allow_policies
Update an email allow policy
PATCH/accounts/{account_id}/email-security/settings/allow_policies/{policy_id}
Delete an email allow policy
DELETE/accounts/{account_id}/email-security/settings/allow_policies/{policy_id}
ModelsExpand Collapse
AllowPolicyListResponse object { id, created_at, last_modified, 12 more }

An email allow policy.

id: string

Allow policy identifier.

formatuuid
created_at: string
formatdate-time
Deprecatedlast_modified: string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
comments: optional string
maxLength1024
is_acceptable_sender: optional boolean

Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply.

is_exempt_recipient: optional boolean

Bypasses all detections for messages to this recipient.

Deprecatedis_recipient: optional boolean

Use is_exempt_recipient instead.

Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026.

is_regex: optional boolean
Deprecatedis_sender: optional boolean

Use is_trusted_sender instead.

Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026.

Deprecatedis_spoof: optional boolean

Use is_acceptable_sender instead.

Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026.

is_trusted_sender: optional boolean

Bypasses all detections and link following for messages from this sender.

modified_at: optional string
formatdate-time
pattern: optional string

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 address or IPv4 CIDR block for IP (e.g. 1.2.3.4 or 1.2.3.0/24); the API accepts only globally reachable IP addresses and rejects private, loopback, link-local, and unspecified addresses.

maxLength1024
minLength1
pattern_type: optional "EMAIL" or "DOMAIN" or "IP" or "UNKNOWN"

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 address (e.g. 1.2.3.4) or an IPv4 CIDR block (e.g. 1.2.3.0/24). The API accepts only globally reachable addresses.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
One of the following:
"EMAIL"
"DOMAIN"
"IP"
"UNKNOWN"
verify_sender: optional boolean

Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication.

AllowPolicyGetResponse object { id, created_at, last_modified, 12 more }

An email allow policy.

id: string

Allow policy identifier.

formatuuid
created_at: string
formatdate-time
Deprecatedlast_modified: string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
comments: optional string
maxLength1024
is_acceptable_sender: optional boolean

Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply.

is_exempt_recipient: optional boolean

Bypasses all detections for messages to this recipient.

Deprecatedis_recipient: optional boolean

Use is_exempt_recipient instead.

Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026.

is_regex: optional boolean
Deprecatedis_sender: optional boolean

Use is_trusted_sender instead.

Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026.

Deprecatedis_spoof: optional boolean

Use is_acceptable_sender instead.

Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026.

is_trusted_sender: optional boolean

Bypasses all detections and link following for messages from this sender.

modified_at: optional string
formatdate-time
pattern: optional string

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 address or IPv4 CIDR block for IP (e.g. 1.2.3.4 or 1.2.3.0/24); the API accepts only globally reachable IP addresses and rejects private, loopback, link-local, and unspecified addresses.

maxLength1024
minLength1
pattern_type: optional "EMAIL" or "DOMAIN" or "IP" or "UNKNOWN"

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 address (e.g. 1.2.3.4) or an IPv4 CIDR block (e.g. 1.2.3.0/24). The API accepts only globally reachable addresses.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
One of the following:
"EMAIL"
"DOMAIN"
"IP"
"UNKNOWN"
verify_sender: optional boolean

Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication.

AllowPolicyCreateResponse object { id, created_at, last_modified, 12 more }

An email allow policy.

id: string

Allow policy identifier.

formatuuid
created_at: string
formatdate-time
Deprecatedlast_modified: string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
comments: optional string
maxLength1024
is_acceptable_sender: optional boolean

Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply.

is_exempt_recipient: optional boolean

Bypasses all detections for messages to this recipient.

Deprecatedis_recipient: optional boolean

Use is_exempt_recipient instead.

Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026.

is_regex: optional boolean
Deprecatedis_sender: optional boolean

Use is_trusted_sender instead.

Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026.

Deprecatedis_spoof: optional boolean

Use is_acceptable_sender instead.

Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026.

is_trusted_sender: optional boolean

Bypasses all detections and link following for messages from this sender.

modified_at: optional string
formatdate-time
pattern: optional string

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 address or IPv4 CIDR block for IP (e.g. 1.2.3.4 or 1.2.3.0/24); the API accepts only globally reachable IP addresses and rejects private, loopback, link-local, and unspecified addresses.

maxLength1024
minLength1
pattern_type: optional "EMAIL" or "DOMAIN" or "IP" or "UNKNOWN"

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 address (e.g. 1.2.3.4) or an IPv4 CIDR block (e.g. 1.2.3.0/24). The API accepts only globally reachable addresses.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
One of the following:
"EMAIL"
"DOMAIN"
"IP"
"UNKNOWN"
verify_sender: optional boolean

Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication.

AllowPolicyEditResponse object { id, created_at, last_modified, 12 more }

An email allow policy.

id: string

Allow policy identifier.

formatuuid
created_at: string
formatdate-time
Deprecatedlast_modified: string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
comments: optional string
maxLength1024
is_acceptable_sender: optional boolean

Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply.

is_exempt_recipient: optional boolean

Bypasses all detections for messages to this recipient.

Deprecatedis_recipient: optional boolean

Use is_exempt_recipient instead.

Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026.

is_regex: optional boolean
Deprecatedis_sender: optional boolean

Use is_trusted_sender instead.

Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026.

Deprecatedis_spoof: optional boolean

Use is_acceptable_sender instead.

Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026.

is_trusted_sender: optional boolean

Bypasses all detections and link following for messages from this sender.

modified_at: optional string
formatdate-time
pattern: optional string

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 address or IPv4 CIDR block for IP (e.g. 1.2.3.4 or 1.2.3.0/24); the API accepts only globally reachable IP addresses and rejects private, loopback, link-local, and unspecified addresses.

maxLength1024
minLength1
pattern_type: optional "EMAIL" or "DOMAIN" or "IP" or "UNKNOWN"

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 address (e.g. 1.2.3.4) or an IPv4 CIDR block (e.g. 1.2.3.0/24). The API accepts only globally reachable addresses.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
One of the following:
"EMAIL"
"DOMAIN"
"IP"
"UNKNOWN"
verify_sender: optional boolean

Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication.

AllowPolicyDeleteResponse object { id }
id: string

Allow policy identifier.

formatuuid

Email SecuritySettingsBlock Senders

List blocked email senders
GET/accounts/{account_id}/email-security/settings/block_senders
Get a blocked email sender
GET/accounts/{account_id}/email-security/settings/block_senders/{pattern_id}
Create blocked email sender
POST/accounts/{account_id}/email-security/settings/block_senders
Update a blocked email sender
PATCH/accounts/{account_id}/email-security/settings/block_senders/{pattern_id}
Delete a blocked email sender
DELETE/accounts/{account_id}/email-security/settings/block_senders/{pattern_id}
ModelsExpand Collapse
BlockSenderListResponse object { id, comments, created_at, 5 more }

A blocked sender pattern.

id: optional string

Blocked sender pattern identifier.

formatuuid
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
is_regex: optional boolean
Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
pattern: optional string

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 address or IPv4 CIDR block for IP (e.g. 1.2.3.4 or 1.2.3.0/24); the API accepts only globally reachable IP addresses and rejects private, loopback, link-local, and unspecified addresses.

maxLength1024
minLength1
pattern_type: optional "EMAIL" or "DOMAIN" or "IP" or "UNKNOWN"

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 address (e.g. 1.2.3.4) or an IPv4 CIDR block (e.g. 1.2.3.0/24). The API accepts only globally reachable addresses.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
One of the following:
"EMAIL"
"DOMAIN"
"IP"
"UNKNOWN"
BlockSenderGetResponse object { id, comments, created_at, 5 more }

A blocked sender pattern.

id: optional string

Blocked sender pattern identifier.

formatuuid
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
is_regex: optional boolean
Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
pattern: optional string

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 address or IPv4 CIDR block for IP (e.g. 1.2.3.4 or 1.2.3.0/24); the API accepts only globally reachable IP addresses and rejects private, loopback, link-local, and unspecified addresses.

maxLength1024
minLength1
pattern_type: optional "EMAIL" or "DOMAIN" or "IP" or "UNKNOWN"

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 address (e.g. 1.2.3.4) or an IPv4 CIDR block (e.g. 1.2.3.0/24). The API accepts only globally reachable addresses.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
One of the following:
"EMAIL"
"DOMAIN"
"IP"
"UNKNOWN"
BlockSenderCreateResponse object { id, comments, created_at, 5 more }

A blocked sender pattern.

id: optional string

Blocked sender pattern identifier.

formatuuid
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
is_regex: optional boolean
Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
pattern: optional string

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 address or IPv4 CIDR block for IP (e.g. 1.2.3.4 or 1.2.3.0/24); the API accepts only globally reachable IP addresses and rejects private, loopback, link-local, and unspecified addresses.

maxLength1024
minLength1
pattern_type: optional "EMAIL" or "DOMAIN" or "IP" or "UNKNOWN"

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 address (e.g. 1.2.3.4) or an IPv4 CIDR block (e.g. 1.2.3.0/24). The API accepts only globally reachable addresses.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
One of the following:
"EMAIL"
"DOMAIN"
"IP"
"UNKNOWN"
BlockSenderEditResponse object { id, comments, created_at, 5 more }

A blocked sender pattern.

id: optional string

Blocked sender pattern identifier.

formatuuid
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
is_regex: optional boolean
Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
pattern: optional string

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 address or IPv4 CIDR block for IP (e.g. 1.2.3.4 or 1.2.3.0/24); the API accepts only globally reachable IP addresses and rejects private, loopback, link-local, and unspecified addresses.

maxLength1024
minLength1
pattern_type: optional "EMAIL" or "DOMAIN" or "IP" or "UNKNOWN"

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 address (e.g. 1.2.3.4) or an IPv4 CIDR block (e.g. 1.2.3.0/24). The API accepts only globally reachable addresses.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
One of the following:
"EMAIL"
"DOMAIN"
"IP"
"UNKNOWN"
BlockSenderDeleteResponse object { id }
id: string

Blocked sender pattern identifier.

formatuuid

Email SecuritySettingsDomains

List protected email domains
GET/accounts/{account_id}/email-security/settings/domains
Get an email domain
GET/accounts/{account_id}/email-security/settings/domains/{domain_id}
Update an email domain
PATCH/accounts/{account_id}/email-security/settings/domains/{domain_id}
Unprotect an email domain
DELETE/accounts/{account_id}/email-security/settings/domains/{domain_id}
Unprotect multiple email domains
Deprecated
DELETE/accounts/{account_id}/email-security/settings/domains
ModelsExpand Collapse
DomainListResponse object { id, allowed_delivery_modes, authorization, 19 more }
id: optional string

Domain identifier.

formatuuid
allowed_delivery_modes: optional array of "DIRECT" or "BCC" or "JOURNAL" or 2 more
One of the following:
"DIRECT"
"BCC"
"JOURNAL"
"API"
"RETRO_SCAN"
authorization: optional object { authorized, timestamp, status_message }
authorized: boolean
timestamp: string
formatdate-time
status_message: optional string
created_at: optional string
formatdate-time
dmarc_status: optional "none" or "good" or "invalid"
One of the following:
"none"
"good"
"invalid"
domain: optional string
drop_dispositions: optional array of "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
emails_processed: optional object { timestamp, total_emails_processed, total_emails_processed_previous }
timestamp: string
formatdate-time
total_emails_processed: number
minimum0
total_emails_processed_previous: number
minimum0
folder: optional "AllItems" or "Inbox"
One of the following:
"AllItems"
"Inbox"
inbox_provider: optional "Microsoft" or "Google"
One of the following:
"Microsoft"
"Google"
integration_id: optional string
formatuuid
ip_restrictions: optional array of string
Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
lookback_hops: optional number
modified_at: optional string
formatdate-time
o365_tenant_id: optional string
regions: optional array of "GLOBAL" or "AU" or "DE" or 2 more
One of the following:
"GLOBAL"
"AU"
"DE"
"IN"
"US"
require_tls_inbound: optional boolean
require_tls_outbound: optional boolean
spf_status: optional "none" or "good" or "neutral" or 2 more
One of the following:
"none"
"good"
"neutral"
"open"
"invalid"
status: optional "pending" or "active" or "failed" or "timeout"
One of the following:
"pending"
"active"
"failed"
"timeout"
transport: optional string
DomainGetResponse object { id, allowed_delivery_modes, authorization, 19 more }
id: optional string

Domain identifier.

formatuuid
allowed_delivery_modes: optional array of "DIRECT" or "BCC" or "JOURNAL" or 2 more
One of the following:
"DIRECT"
"BCC"
"JOURNAL"
"API"
"RETRO_SCAN"
authorization: optional object { authorized, timestamp, status_message }
authorized: boolean
timestamp: string
formatdate-time
status_message: optional string
created_at: optional string
formatdate-time
dmarc_status: optional "none" or "good" or "invalid"
One of the following:
"none"
"good"
"invalid"
domain: optional string
drop_dispositions: optional array of "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
emails_processed: optional object { timestamp, total_emails_processed, total_emails_processed_previous }
timestamp: string
formatdate-time
total_emails_processed: number
minimum0
total_emails_processed_previous: number
minimum0
folder: optional "AllItems" or "Inbox"
One of the following:
"AllItems"
"Inbox"
inbox_provider: optional "Microsoft" or "Google"
One of the following:
"Microsoft"
"Google"
integration_id: optional string
formatuuid
ip_restrictions: optional array of string
Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
lookback_hops: optional number
modified_at: optional string
formatdate-time
o365_tenant_id: optional string
regions: optional array of "GLOBAL" or "AU" or "DE" or 2 more
One of the following:
"GLOBAL"
"AU"
"DE"
"IN"
"US"
require_tls_inbound: optional boolean
require_tls_outbound: optional boolean
spf_status: optional "none" or "good" or "neutral" or 2 more
One of the following:
"none"
"good"
"neutral"
"open"
"invalid"
status: optional "pending" or "active" or "failed" or "timeout"
One of the following:
"pending"
"active"
"failed"
"timeout"
transport: optional string
DomainEditResponse object { id, allowed_delivery_modes, authorization, 19 more }
id: optional string

Domain identifier.

formatuuid
allowed_delivery_modes: optional array of "DIRECT" or "BCC" or "JOURNAL" or 2 more
One of the following:
"DIRECT"
"BCC"
"JOURNAL"
"API"
"RETRO_SCAN"
authorization: optional object { authorized, timestamp, status_message }
authorized: boolean
timestamp: string
formatdate-time
status_message: optional string
created_at: optional string
formatdate-time
dmarc_status: optional "none" or "good" or "invalid"
One of the following:
"none"
"good"
"invalid"
domain: optional string
drop_dispositions: optional array of "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
emails_processed: optional object { timestamp, total_emails_processed, total_emails_processed_previous }
timestamp: string
formatdate-time
total_emails_processed: number
minimum0
total_emails_processed_previous: number
minimum0
folder: optional "AllItems" or "Inbox"
One of the following:
"AllItems"
"Inbox"
inbox_provider: optional "Microsoft" or "Google"
One of the following:
"Microsoft"
"Google"
integration_id: optional string
formatuuid
ip_restrictions: optional array of string
Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
lookback_hops: optional number
modified_at: optional string
formatdate-time
o365_tenant_id: optional string
regions: optional array of "GLOBAL" or "AU" or "DE" or 2 more
One of the following:
"GLOBAL"
"AU"
"DE"
"IN"
"US"
require_tls_inbound: optional boolean
require_tls_outbound: optional boolean
spf_status: optional "none" or "good" or "neutral" or 2 more
One of the following:
"none"
"good"
"neutral"
"open"
"invalid"
status: optional "pending" or "active" or "failed" or "timeout"
One of the following:
"pending"
"active"
"failed"
"timeout"
transport: optional string
DomainDeleteResponse object { id }
id: string

Domain identifier.

formatuuid
DomainBulkDeleteResponse object { id }
id: string

Domain identifier.

formatuuid

Email SecuritySettingsImpersonation Registry

List entries in impersonation registry
GET/accounts/{account_id}/email-security/settings/impersonation_registry
Get an impersonation registry entry
GET/accounts/{account_id}/email-security/settings/impersonation_registry/{impersonation_registry_id}
Create impersonation registry entry
POST/accounts/{account_id}/email-security/settings/impersonation_registry
Update an impersonation registry entry
PATCH/accounts/{account_id}/email-security/settings/impersonation_registry/{impersonation_registry_id}
Delete an impersonation registry entry
DELETE/accounts/{account_id}/email-security/settings/impersonation_registry/{impersonation_registry_id}
ModelsExpand Collapse
ImpersonationRegistryListResponse object { id, comments, created_at, 9 more }

An impersonation registry entry.

id: optional string

Impersonation registry entry identifier.

formatuuid
comments: optional string
created_at: optional string
formatdate-time
directory_id: optional number
directory_node_id: optional number
email: optional string
Deprecatedexternal_directory_node_id: optional string

This field is deprecated.

is_email_regex: optional boolean
Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
name: optional string
maxLength1024
provenance: optional "A1S_INTERNAL" or "SNOOPY-CASB_OFFICE_365" or "SNOOPY-OFFICE_365" or "SNOOPY-GOOGLE_DIRECTORY"
One of the following:
"A1S_INTERNAL"
"SNOOPY-CASB_OFFICE_365"
"SNOOPY-OFFICE_365"
"SNOOPY-GOOGLE_DIRECTORY"
ImpersonationRegistryGetResponse object { id, comments, created_at, 9 more }

An impersonation registry entry.

id: optional string

Impersonation registry entry identifier.

formatuuid
comments: optional string
created_at: optional string
formatdate-time
directory_id: optional number
directory_node_id: optional number
email: optional string
Deprecatedexternal_directory_node_id: optional string

This field is deprecated.

is_email_regex: optional boolean
Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
name: optional string
maxLength1024
provenance: optional "A1S_INTERNAL" or "SNOOPY-CASB_OFFICE_365" or "SNOOPY-OFFICE_365" or "SNOOPY-GOOGLE_DIRECTORY"
One of the following:
"A1S_INTERNAL"
"SNOOPY-CASB_OFFICE_365"
"SNOOPY-OFFICE_365"
"SNOOPY-GOOGLE_DIRECTORY"
ImpersonationRegistryCreateResponse object { id, comments, created_at, 9 more }

An impersonation registry entry.

id: optional string

Impersonation registry entry identifier.

formatuuid
comments: optional string
created_at: optional string
formatdate-time
directory_id: optional number
directory_node_id: optional number
email: optional string
Deprecatedexternal_directory_node_id: optional string

This field is deprecated.

is_email_regex: optional boolean
Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
name: optional string
maxLength1024
provenance: optional "A1S_INTERNAL" or "SNOOPY-CASB_OFFICE_365" or "SNOOPY-OFFICE_365" or "SNOOPY-GOOGLE_DIRECTORY"
One of the following:
"A1S_INTERNAL"
"SNOOPY-CASB_OFFICE_365"
"SNOOPY-OFFICE_365"
"SNOOPY-GOOGLE_DIRECTORY"
ImpersonationRegistryEditResponse object { id, comments, created_at, 9 more }

An impersonation registry entry.

id: optional string

Impersonation registry entry identifier.

formatuuid
comments: optional string
created_at: optional string
formatdate-time
directory_id: optional number
directory_node_id: optional number
email: optional string
Deprecatedexternal_directory_node_id: optional string

This field is deprecated.

is_email_regex: optional boolean
Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
name: optional string
maxLength1024
provenance: optional "A1S_INTERNAL" or "SNOOPY-CASB_OFFICE_365" or "SNOOPY-OFFICE_365" or "SNOOPY-GOOGLE_DIRECTORY"
One of the following:
"A1S_INTERNAL"
"SNOOPY-CASB_OFFICE_365"
"SNOOPY-OFFICE_365"
"SNOOPY-GOOGLE_DIRECTORY"
ImpersonationRegistryDeleteResponse object { id }
id: string

Impersonation registry entry identifier.

formatuuid

Email SecuritySettingsSending Domain Restrictions

List sending domain restrictions
GET/accounts/{account_id}/email-security/settings/sending_domain_restrictions
Get a sending domain restriction
GET/accounts/{account_id}/email-security/settings/sending_domain_restrictions/{sending_domain_restriction_id}
Create a sending domain restriction
POST/accounts/{account_id}/email-security/settings/sending_domain_restrictions
Update a sending domain restriction
PATCH/accounts/{account_id}/email-security/settings/sending_domain_restrictions/{sending_domain_restriction_id}
Delete a sending domain restriction
DELETE/accounts/{account_id}/email-security/settings/sending_domain_restrictions/{sending_domain_restriction_id}
ModelsExpand Collapse
SendingDomainRestrictionListResponse object { id, comments, created_at, 4 more }

A sending domain restriction that enforces TLS (Transport Layer Security) requirements for emails from specific domains. If TLS is required, the system drops mail without TLS from the specified domain.

id: optional string

Sending domain restriction identifier.

formatuuid
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
domain: optional string

Domain that requires TLS enforcement.

exclude: optional array of string

Subdomains to exempt from TLS requirements.

Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
SendingDomainRestrictionGetResponse object { id, comments, created_at, 4 more }

A sending domain restriction that enforces TLS (Transport Layer Security) requirements for emails from specific domains. If TLS is required, the system drops mail without TLS from the specified domain.

id: optional string

Sending domain restriction identifier.

formatuuid
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
domain: optional string

Domain that requires TLS enforcement.

exclude: optional array of string

Subdomains to exempt from TLS requirements.

Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
SendingDomainRestrictionCreateResponse object { id, comments, created_at, 4 more }

A sending domain restriction that enforces TLS (Transport Layer Security) requirements for emails from specific domains. If TLS is required, the system drops mail without TLS from the specified domain.

id: optional string

Sending domain restriction identifier.

formatuuid
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
domain: optional string

Domain that requires TLS enforcement.

exclude: optional array of string

Subdomains to exempt from TLS requirements.

Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
SendingDomainRestrictionEditResponse object { id, comments, created_at, 4 more }

A sending domain restriction that enforces TLS (Transport Layer Security) requirements for emails from specific domains. If TLS is required, the system drops mail without TLS from the specified domain.

id: optional string

Sending domain restriction identifier.

formatuuid
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
domain: optional string

Domain that requires TLS enforcement.

exclude: optional array of string

Subdomains to exempt from TLS requirements.

Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
SendingDomainRestrictionDeleteResponse object { id }
id: string

Sending domain restriction identifier.

formatuuid

Email SecuritySettingsTrusted Domains

List trusted email domains
GET/accounts/{account_id}/email-security/settings/trusted_domains
Get a trusted email domain
GET/accounts/{account_id}/email-security/settings/trusted_domains/{trusted_domain_id}
Create trusted email domain
POST/accounts/{account_id}/email-security/settings/trusted_domains
Update a trusted email domain
PATCH/accounts/{account_id}/email-security/settings/trusted_domains/{trusted_domain_id}
Delete a trusted email domain
DELETE/accounts/{account_id}/email-security/settings/trusted_domains/{trusted_domain_id}
ModelsExpand Collapse
TrustedDomainListResponse object { id, comments, created_at, 6 more }

A trusted email domain.

id: optional string

Trusted domain identifier.

formatuuid
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
is_recent: optional boolean

Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition.

is_regex: optional boolean
is_similarity: optional boolean

Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition.

Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
pattern: optional string
maxLength1024
minLength1
TrustedDomainGetResponse object { id, comments, created_at, 6 more }

A trusted email domain.

id: optional string

Trusted domain identifier.

formatuuid
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
is_recent: optional boolean

Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition.

is_regex: optional boolean
is_similarity: optional boolean

Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition.

Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
pattern: optional string
maxLength1024
minLength1
TrustedDomainCreateResponse object { id, comments, created_at, 6 more }

A trusted email domain.

id: optional string

Trusted domain identifier.

formatuuid
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
is_recent: optional boolean

Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition.

is_regex: optional boolean
is_similarity: optional boolean

Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition.

Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
pattern: optional string
maxLength1024
minLength1
TrustedDomainEditResponse object { id, comments, created_at, 6 more }

A trusted email domain.

id: optional string

Trusted domain identifier.

formatuuid
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
is_recent: optional boolean

Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition.

is_regex: optional boolean
is_similarity: optional boolean

Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition.

Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
pattern: optional string
maxLength1024
minLength1
TrustedDomainDeleteResponse object { id }
id: string

Trusted domain identifier.

formatuuid

Email SecuritySettingsURL Ignore Patterns

List URL ignore patterns
GET/accounts/{account_id}/email-security/settings/url_ignore_patterns
Get a URL ignore pattern
GET/accounts/{account_id}/email-security/settings/url_ignore_patterns/{pattern_id}
Create a URL ignore pattern
POST/accounts/{account_id}/email-security/settings/url_ignore_patterns
Update a URL ignore pattern
PATCH/accounts/{account_id}/email-security/settings/url_ignore_patterns/{pattern_id}
Delete a URL ignore pattern
DELETE/accounts/{account_id}/email-security/settings/url_ignore_patterns/{pattern_id}
ModelsExpand Collapse
URLIgnorePatternListResponse object { id, created_at, pattern, 3 more }

A URL ignore pattern that exempts matching URLs from Email Securitys URL rewriting.

id: string

URL ignore pattern identifier.

formatuuid
created_at: string
formatdate-time
pattern: string

Regular expression identifying URLs to exempt from rewriting.

maxLength1024
minLength1
comments: optional string

Optional note describing the reason for the ignore pattern.

maxLength1024
Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
URLIgnorePatternGetResponse object { id, created_at, pattern, 3 more }

A URL ignore pattern that exempts matching URLs from Email Securitys URL rewriting.

id: string

URL ignore pattern identifier.

formatuuid
created_at: string
formatdate-time
pattern: string

Regular expression identifying URLs to exempt from rewriting.

maxLength1024
minLength1
comments: optional string

Optional note describing the reason for the ignore pattern.

maxLength1024
Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
URLIgnorePatternCreateResponse object { id, created_at, pattern, 3 more }

A URL ignore pattern that exempts matching URLs from Email Securitys URL rewriting.

id: string

URL ignore pattern identifier.

formatuuid
created_at: string
formatdate-time
pattern: string

Regular expression identifying URLs to exempt from rewriting.

maxLength1024
minLength1
comments: optional string

Optional note describing the reason for the ignore pattern.

maxLength1024
Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
URLIgnorePatternEditResponse object { id, created_at, pattern, 3 more }

A URL ignore pattern that exempts matching URLs from Email Securitys URL rewriting.

id: string

URL ignore pattern identifier.

formatuuid
created_at: string
formatdate-time
pattern: string

Regular expression identifying URLs to exempt from rewriting.

maxLength1024
minLength1
comments: optional string

Optional note describing the reason for the ignore pattern.

maxLength1024
Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
URLIgnorePatternDeleteResponse object { id }
id: string

URL ignore pattern identifier.

formatuuid

Email SecuritySubmissions

Get reclassify submissions
GET/accounts/{account_id}/email-security/submissions
ModelsExpand Collapse
SubmissionListResponse object { requested_at, submission_id, customer_status, 15 more }
requested_at: string

When the submission was requested (UTC).

formatdate-time
submission_id: string
customer_status: optional "escalated" or "reviewed" or "unreviewed"
One of the following:
"escalated"
"reviewed"
"unreviewed"
escalated_as: optional "MALICIOUS" or "SUSPICIOUS" or "SPOOF" or 3 more
One of the following:
"MALICIOUS"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"NONE"
escalated_at: optional string
formatdate-time
escalated_by: optional string
escalated_submission_id: optional string
original_disposition: optional "MALICIOUS" or "SUSPICIOUS" or "SPOOF" or 3 more
One of the following:
"MALICIOUS"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"NONE"
original_edf_hash: optional string
original_postfix_id: optional string

The postfix ID of the original message that was submitted.

outcome: optional string
outcome_disposition: optional "MALICIOUS" or "SUSPICIOUS" or "SPOOF" or 3 more
One of the following:
"MALICIOUS"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"NONE"
requested_by: optional string
requested_disposition: optional "MALICIOUS" or "SUSPICIOUS" or "SPOOF" or 3 more
One of the following:
"MALICIOUS"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"NONE"
Deprecatedrequested_ts: optional string

Use requested_at instead.

Deprecated, use requested_at instead.

status: optional string
subject: optional string
type: optional "Team" or "User"

Indicates whether a team member or an end user created the submission.

One of the following:
"Team"
"User"
Previous

Verification
Next

Investigate

On this page

Web Proxy Viewer  |  New URL  |  Original Page