--- title: Get message details --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/go) [Email Security](https://developers.cloudflare.com/api/go/resources/email_security) [Investigate](https://developers.cloudflare.com/api/go/resources/email_security/subresources/investigate) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Get message details client.EmailSecurity.Investigate.Get(ctx, investigateID, params) (\*[InvestigateGetResponse](), error) GET/accounts/{account\_id}/email-security/investigate/{investigate\_id} Retrieves comprehensive details for a specific email message including headers, recipients, sender information, and current quarantine status. Use the investigate\_id from search results to fetch detailed information. ##### Security
API Token The preferred authorization scheme for interacting with the Cloudflare API. Create a token. **Example:**Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
API Email + API Key The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key. **Example:**X-Auth-Email: user@example.com The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys. **Example:**X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
##### Accepted Permissions (at least one required) `Cloud Email Security: Write``Cloud Email Security: Read` ##### ParametersExpand Collapse investigateID string Unique identifier for a message retrieved from investigation. [Link to this property](<#(resource)%20email_security.investigate%20%3E%20(method)%20get%20%3E%20(params)%20default%20%3E%20(param)%20investigate_id%20%3E%20(schema)>)
params InvestigateGetParams AccountID param.Field\[string] Path param: Identifier. maxLength32 Link to this property Submission param.Field\[bool]Optional Query param: When true, search the submissions datastore only. When false or omitted, search the regular datastore only. Link to this property
[Link to this property](<#(resource)%20email_security.investigate%20%3E%20(method)%20get%20%3E%20(params)%20default>) ##### ReturnsExpand Collapse
type InvestigateGetResponse struct{…} ID string Unique identifier for a message retrieved from investigation. Link to this property
DeprecatedActionLog \[]InvestigateGetResponseActionLog Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. CompletedAt Time Timestamp when action completed. formatdate-time Link to this property
Operation InvestigateGetResponseActionLogOperation Type of action performed. One of the following: const InvestigateGetResponseActionLogOperationMove InvestigateGetResponseActionLogOperation = "MOVE" Link to this property const InvestigateGetResponseActionLogOperationRelease InvestigateGetResponseActionLogOperation = "RELEASE" Link to this property const InvestigateGetResponseActionLogOperationReclassify InvestigateGetResponseActionLogOperation = "RECLASSIFY" Link to this property const InvestigateGetResponseActionLogOperationSubmission InvestigateGetResponseActionLogOperation = "SUBMISSION" Link to this property const InvestigateGetResponseActionLogOperationQuarantineRelease InvestigateGetResponseActionLogOperation = "QUARANTINE\_RELEASE" Link to this property const InvestigateGetResponseActionLogOperationPreview InvestigateGetResponseActionLogOperation = "PREVIEW" Link to this property
Link to this property DeprecatedCompletedTimestamp stringOptional Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. Link to this property
Properties InvestigateGetResponseActionLogPropertiesOptional Additional properties for the action. Folder stringOptional Target folder for move operations. Link to this property RequestedBy stringOptional User who requested the action. Link to this property
Link to this property Status stringOptional Status of the action. Link to this property
Link to this property ClientRecipients \[]string Link to this property DetectionReasons \[]string Link to this property IsPhishSubmission bool Link to this property IsQuarantined bool Link to this property PostfixID string The identifier of the message. Link to this property
Properties InvestigateGetResponseProperties Message processing properties. AllowlistedPattern stringOptional Pattern that allowlisted this message. Link to this property
AllowlistedPatternType InvestigateGetResponsePropertiesAllowlistedPatternTypeOptional Type of allowlist pattern. One of the following: const InvestigateGetResponsePropertiesAllowlistedPatternTypeQuarantineRelease InvestigateGetResponsePropertiesAllowlistedPatternType = "quarantine\_release" Link to this property const InvestigateGetResponsePropertiesAllowlistedPatternTypeAcceptableSender InvestigateGetResponsePropertiesAllowlistedPatternType = "acceptable\_sender" Link to this property const InvestigateGetResponsePropertiesAllowlistedPatternTypeAllowedSender InvestigateGetResponsePropertiesAllowlistedPatternType = "allowed\_sender" Link to this property const InvestigateGetResponsePropertiesAllowlistedPatternTypeAllowedRecipient InvestigateGetResponsePropertiesAllowlistedPatternType = "allowed\_recipient" Link to this property const InvestigateGetResponsePropertiesAllowlistedPatternTypeDomainSimilarity InvestigateGetResponsePropertiesAllowlistedPatternType = "domain\_similarity" Link to this property const InvestigateGetResponsePropertiesAllowlistedPatternTypeDomainRecency InvestigateGetResponsePropertiesAllowlistedPatternType = "domain\_recency" Link to this property const InvestigateGetResponsePropertiesAllowlistedPatternTypeManagedAcceptableSender InvestigateGetResponsePropertiesAllowlistedPatternType = "managed\_acceptable\_sender" Link to this property const InvestigateGetResponsePropertiesAllowlistedPatternTypeOutboundNdr InvestigateGetResponsePropertiesAllowlistedPatternType = "outbound\_ndr" Link to this property
Link to this property BlocklistedMessage boolOptional Whether message was blocklisted. Link to this property BlocklistedPattern stringOptional Pattern that blocklisted this message. Link to this property
WhitelistedPatternType InvestigateGetResponsePropertiesWhitelistedPatternTypeOptional Legacy field for allowlist pattern type. One of the following: const InvestigateGetResponsePropertiesWhitelistedPatternTypeQuarantineRelease InvestigateGetResponsePropertiesWhitelistedPatternType = "quarantine\_release" Link to this property const InvestigateGetResponsePropertiesWhitelistedPatternTypeAcceptableSender InvestigateGetResponsePropertiesWhitelistedPatternType = "acceptable\_sender" Link to this property const InvestigateGetResponsePropertiesWhitelistedPatternTypeAllowedSender InvestigateGetResponsePropertiesWhitelistedPatternType = "allowed\_sender" Link to this property const InvestigateGetResponsePropertiesWhitelistedPatternTypeAllowedRecipient InvestigateGetResponsePropertiesWhitelistedPatternType = "allowed\_recipient" Link to this property const InvestigateGetResponsePropertiesWhitelistedPatternTypeDomainSimilarity InvestigateGetResponsePropertiesWhitelistedPatternType = "domain\_similarity" Link to this property const InvestigateGetResponsePropertiesWhitelistedPatternTypeDomainRecency InvestigateGetResponsePropertiesWhitelistedPatternType = "domain\_recency" Link to this property const InvestigateGetResponsePropertiesWhitelistedPatternTypeManagedAcceptableSender InvestigateGetResponsePropertiesWhitelistedPatternType = "managed\_acceptable\_sender" Link to this property const InvestigateGetResponsePropertiesWhitelistedPatternTypeOutboundNdr InvestigateGetResponsePropertiesWhitelistedPatternType = "outbound\_ndr" Link to this property
Link to this property
Link to this property DeprecatedTs string Use scanned_at instead. Deprecated, use scanned_at instead. End of life: November 1, 2026. Link to this property AlertID stringOptional Link to this property
DeliveryMode InvestigateGetResponseDeliveryModeOptional One of the following: const InvestigateGetResponseDeliveryModeDirect InvestigateGetResponseDeliveryMode = "DIRECT" Link to this property const InvestigateGetResponseDeliveryModeBcc InvestigateGetResponseDeliveryMode = "BCC" Link to this property const InvestigateGetResponseDeliveryModeJournal InvestigateGetResponseDeliveryMode = "JOURNAL" Link to this property const InvestigateGetResponseDeliveryModeReviewSubmission InvestigateGetResponseDeliveryMode = "REVIEW\_SUBMISSION" Link to this property const InvestigateGetResponseDeliveryModeDMARCUnverified InvestigateGetResponseDeliveryMode = "DMARC\_UNVERIFIED" Link to this property const InvestigateGetResponseDeliveryModeDMARCFailureReport InvestigateGetResponseDeliveryMode = "DMARC\_FAILURE\_REPORT" Link to this property const InvestigateGetResponseDeliveryModeDMARCAggregateReport InvestigateGetResponseDeliveryMode = "DMARC\_AGGREGATE\_REPORT" Link to this property const InvestigateGetResponseDeliveryModeThreatIntelSubmission InvestigateGetResponseDeliveryMode = "THREAT\_INTEL\_SUBMISSION" Link to this property const InvestigateGetResponseDeliveryModeSimulationSubmission InvestigateGetResponseDeliveryMode = "SIMULATION\_SUBMISSION" Link to this property const InvestigateGetResponseDeliveryModeAPI InvestigateGetResponseDeliveryMode = "API" Link to this property const InvestigateGetResponseDeliveryModeRetroScan InvestigateGetResponseDeliveryMode = "RETRO\_SCAN" Link to this property
Link to this property
DeliveryStatus \[]InvestigateGetResponseDeliveryStatusOptional One of the following: const InvestigateGetResponseDeliveryStatusDelivered InvestigateGetResponseDeliveryStatus = "delivered" Link to this property const InvestigateGetResponseDeliveryStatusMoved InvestigateGetResponseDeliveryStatus = "moved" Link to this property const InvestigateGetResponseDeliveryStatusQuarantined InvestigateGetResponseDeliveryStatus = "quarantined" Link to this property const InvestigateGetResponseDeliveryStatusRejected InvestigateGetResponseDeliveryStatus = "rejected" Link to this property const InvestigateGetResponseDeliveryStatusDeferred InvestigateGetResponseDeliveryStatus = "deferred" Link to this property const InvestigateGetResponseDeliveryStatusBounced InvestigateGetResponseDeliveryStatus = "bounced" Link to this property const InvestigateGetResponseDeliveryStatusQueued InvestigateGetResponseDeliveryStatus = "queued" Link to this property const InvestigateGetResponseDeliveryStatusMoveFailed InvestigateGetResponseDeliveryStatus = "move\_failed" Link to this property
Link to this property EdfHash stringOptional Link to this property EnvelopeFrom stringOptional Link to this property EnvelopeTo \[]stringOptional Link to this property
FinalDisposition InvestigateGetResponseFinalDispositionOptional The verdict Email Security assigns to a message. One of the following: const InvestigateGetResponseFinalDispositionMalicious InvestigateGetResponseFinalDisposition = "MALICIOUS" Link to this property const InvestigateGetResponseFinalDispositionMaliciousBec InvestigateGetResponseFinalDisposition = "MALICIOUS-BEC" Link to this property const InvestigateGetResponseFinalDispositionSuspicious InvestigateGetResponseFinalDisposition = "SUSPICIOUS" Link to this property const InvestigateGetResponseFinalDispositionSpoof InvestigateGetResponseFinalDisposition = "SPOOF" Link to this property const InvestigateGetResponseFinalDispositionSpam InvestigateGetResponseFinalDisposition = "SPAM" Link to this property const InvestigateGetResponseFinalDispositionBulk InvestigateGetResponseFinalDisposition = "BULK" Link to this property const InvestigateGetResponseFinalDispositionEncrypted InvestigateGetResponseFinalDisposition = "ENCRYPTED" Link to this property const InvestigateGetResponseFinalDispositionExternal InvestigateGetResponseFinalDisposition = "EXTERNAL" Link to this property const InvestigateGetResponseFinalDispositionUnknown InvestigateGetResponseFinalDisposition = "UNKNOWN" Link to this property const InvestigateGetResponseFinalDispositionNone InvestigateGetResponseFinalDisposition = "NONE" Link to this property
Link to this property
DeprecatedFindings \[]InvestigateGetResponseFindingOptional Use the findings field from GET /investigate/{investigate\_id}/detections instead. Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message. Attachment stringOptional Link to this property Detail stringOptional Link to this property
Detection InvestigateGetResponseFindingsDetectionOptional The verdict Email Security assigns to a message. One of the following: const InvestigateGetResponseFindingsDetectionMalicious InvestigateGetResponseFindingsDetection = "MALICIOUS" Link to this property const InvestigateGetResponseFindingsDetectionMaliciousBec InvestigateGetResponseFindingsDetection = "MALICIOUS-BEC" Link to this property const InvestigateGetResponseFindingsDetectionSuspicious InvestigateGetResponseFindingsDetection = "SUSPICIOUS" Link to this property const InvestigateGetResponseFindingsDetectionSpoof InvestigateGetResponseFindingsDetection = "SPOOF" Link to this property const InvestigateGetResponseFindingsDetectionSpam InvestigateGetResponseFindingsDetection = "SPAM" Link to this property const InvestigateGetResponseFindingsDetectionBulk InvestigateGetResponseFindingsDetection = "BULK" Link to this property const InvestigateGetResponseFindingsDetectionEncrypted InvestigateGetResponseFindingsDetection = "ENCRYPTED" Link to this property const InvestigateGetResponseFindingsDetectionExternal InvestigateGetResponseFindingsDetection = "EXTERNAL" Link to this property const InvestigateGetResponseFindingsDetectionUnknown InvestigateGetResponseFindingsDetection = "UNKNOWN" Link to this property const InvestigateGetResponseFindingsDetectionNone InvestigateGetResponseFindingsDetection = "NONE" Link to this property
Link to this property Field stringOptional Link to this property Name stringOptional Link to this property Portion stringOptional Link to this property Reason stringOptional Link to this property Score float64Optional formatdouble Link to this property Value stringOptional Link to this property
Link to this property From stringOptional Link to this property FromName stringOptional Link to this property HtmltextStructureHash stringOptional Link to this property MessageID stringOptional Link to this property
PostDeliveryOperations \[]InvestigateGetResponsePostDeliveryOperationOptional Post-delivery operations performed on this message. One of the following: const InvestigateGetResponsePostDeliveryOperationPreview InvestigateGetResponsePostDeliveryOperation = "PREVIEW" Link to this property const InvestigateGetResponsePostDeliveryOperationQuarantineRelease InvestigateGetResponsePostDeliveryOperation = "QUARANTINE\_RELEASE" Link to this property const InvestigateGetResponsePostDeliveryOperationSubmission InvestigateGetResponsePostDeliveryOperation = "SUBMISSION" Link to this property const InvestigateGetResponsePostDeliveryOperationMove InvestigateGetResponsePostDeliveryOperation = "MOVE" Link to this property
Link to this property PostfixIDOutbound stringOptional Link to this property Replyto stringOptional Link to this property ScannedAt TimeOptional When the message was scanned (UTC). formatdate-time Link to this property SentAt TimeOptional When the message was sent (UTC). formatdate-time Link to this property SentDate stringOptional Link to this property SmtpHeloServerIP stringOptional Link to this property SmtpPreviousHopIP stringOptional Link to this property Subject stringOptional Link to this property ThreatCategories \[]stringOptional Link to this property To \[]stringOptional Link to this property ToName \[]stringOptional Link to this property
Validation InvestigateGetResponseValidationOptional Comment stringOptional Link to this property
DKIM InvestigateGetResponseValidationDKIMOptional One of the following: const InvestigateGetResponseValidationDKIMPass InvestigateGetResponseValidationDKIM = "pass" Link to this property const InvestigateGetResponseValidationDKIMNeutral InvestigateGetResponseValidationDKIM = "neutral" Link to this property const InvestigateGetResponseValidationDKIMFail InvestigateGetResponseValidationDKIM = "fail" Link to this property const InvestigateGetResponseValidationDKIMError InvestigateGetResponseValidationDKIM = "error" Link to this property const InvestigateGetResponseValidationDKIMNone InvestigateGetResponseValidationDKIM = "none" Link to this property
Link to this property
DMARC InvestigateGetResponseValidationDMARCOptional One of the following: const InvestigateGetResponseValidationDMARCPass InvestigateGetResponseValidationDMARC = "pass" Link to this property const InvestigateGetResponseValidationDMARCNeutral InvestigateGetResponseValidationDMARC = "neutral" Link to this property const InvestigateGetResponseValidationDMARCFail InvestigateGetResponseValidationDMARC = "fail" Link to this property const InvestigateGetResponseValidationDMARCError InvestigateGetResponseValidationDMARC = "error" Link to this property const InvestigateGetResponseValidationDMARCNone InvestigateGetResponseValidationDMARC = "none" Link to this property
Link to this property
SPF InvestigateGetResponseValidationSPFOptional One of the following: const InvestigateGetResponseValidationSPFPass InvestigateGetResponseValidationSPF = "pass" Link to this property const InvestigateGetResponseValidationSPFNeutral InvestigateGetResponseValidationSPF = "neutral" Link to this property const InvestigateGetResponseValidationSPFFail InvestigateGetResponseValidationSPF = "fail" Link to this property const InvestigateGetResponseValidationSPFError InvestigateGetResponseValidationSPF = "error" Link to this property const InvestigateGetResponseValidationSPFNone InvestigateGetResponseValidationSPF = "none" Link to this property
Link to this property
Link to this property XOriginatingIP stringOptional Link to this property
[Link to this property](<#(resource)%20email_security.investigate%20%3E%20(model)%20InvestigateGetResponse%20%3E%20(schema)>) ### Get message details Go HTTPTypeScriptPythonGoTerraform ``` package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) investigate, err := client.EmailSecurity.Investigate.Get( context.TODO(), "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", email_security.InvestigateGetParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", investigate.ID) } ``` 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "id": "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", "action_log": [ { "completed_at": "2019-12-27T18:11:19.117Z", "operation": "MOVE", "completed_timestamp": "completed_timestamp", "properties": { "folder": "folder", "requested_by": "requested_by" }, "status": "status" } ], "client_recipients": [ "string" ], "detection_reasons": [ "string" ], "is_phish_submission": true, "is_quarantined": true, "postfix_id": "4Njp3P0STMz2c02Q", "properties": { "allowlisted_pattern": "allowlisted_pattern", "allowlisted_pattern_type": "quarantine_release", "blocklisted_message": true, "blocklisted_pattern": "blocklisted_pattern", "whitelisted_pattern_type": "quarantine_release" }, "ts": "ts", "alert_id": "alert_id", "delivery_mode": "DIRECT", "delivery_status": [ "delivered" ], "edf_hash": "edf_hash", "envelope_from": "envelope_from", "envelope_to": [ "string" ], "final_disposition": "MALICIOUS", "findings": [ { "attachment": "attachment", "detail": "detail", "detection": "MALICIOUS", "field": "field", "name": "name", "portion": "portion", "reason": "reason", "score": 0, "value": "value" } ], "from": "from", "from_name": "from_name", "htmltext_structure_hash": "htmltext_structure_hash", "message_id": "message_id", "post_delivery_operations": [ "PREVIEW" ], "postfix_id_outbound": "postfix_id_outbound", "replyto": "replyto", "scanned_at": "2019-12-27T18:11:19.117Z", "sent_at": "2019-12-27T18:11:19.117Z", "sent_date": "sent_date", "smtp_helo_server_ip": "smtp_helo_server_ip", "smtp_previous_hop_ip": "smtp_previous_hop_ip", "subject": "subject", "threat_categories": [ "string" ], "to": [ "string" ], "to_name": [ "string" ], "validation": { "comment": "comment", "dkim": "pass", "dmarc": "pass", "spf": "pass" }, "x_originating_ip": "x_originating_ip" }, "success": true } ``` ##### Returns Examples 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "id": "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", "action_log": [ { "completed_at": "2019-12-27T18:11:19.117Z", "operation": "MOVE", "completed_timestamp": "completed_timestamp", "properties": { "folder": "folder", "requested_by": "requested_by" }, "status": "status" } ], "client_recipients": [ "string" ], "detection_reasons": [ "string" ], "is_phish_submission": true, "is_quarantined": true, "postfix_id": "4Njp3P0STMz2c02Q", "properties": { "allowlisted_pattern": "allowlisted_pattern", "allowlisted_pattern_type": "quarantine_release", "blocklisted_message": true, "blocklisted_pattern": "blocklisted_pattern", "whitelisted_pattern_type": "quarantine_release" }, "ts": "ts", "alert_id": "alert_id", "delivery_mode": "DIRECT", "delivery_status": [ "delivered" ], "edf_hash": "edf_hash", "envelope_from": "envelope_from", "envelope_to": [ "string" ], "final_disposition": "MALICIOUS", "findings": [ { "attachment": "attachment", "detail": "detail", "detection": "MALICIOUS", "field": "field", "name": "name", "portion": "portion", "reason": "reason", "score": 0, "value": "value" } ], "from": "from", "from_name": "from_name", "htmltext_structure_hash": "htmltext_structure_hash", "message_id": "message_id", "post_delivery_operations": [ "PREVIEW" ], "postfix_id_outbound": "postfix_id_outbound", "replyto": "replyto", "scanned_at": "2019-12-27T18:11:19.117Z", "sent_at": "2019-12-27T18:11:19.117Z", "sent_date": "sent_date", "smtp_helo_server_ip": "smtp_helo_server_ip", "smtp_previous_hop_ip": "smtp_previous_hop_ip", "subject": "subject", "threat_categories": [ "string" ], "to": [ "string" ], "to_name": [ "string" ], "validation": { "comment": "comment", "dkim": "pass", "dmarc": "pass", "spf": "pass" }, "x_originating_ip": "x_originating_ip" }, "success": true } ```