--- title: Search email messages --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/go) [Email Security](https://developers.cloudflare.com/api/go/resources/email_security) [Investigate](https://developers.cloudflare.com/api/go/resources/email_security/subresources/investigate) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Search email messages client.EmailSecurity.Investigate.List(ctx, params) (\*V4PagePaginationArray\[[InvestigateListResponse]()], error) GET/accounts/{account\_id}/email-security/investigate Returns information for each email that matches the provided search parameters. ##### Security
API Token The preferred authorization scheme for interacting with the Cloudflare API. Create a token. **Example:**Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
API Email + API Key The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key. **Example:**X-Auth-Email: user@example.com The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys. **Example:**X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
##### Accepted Permissions (at least one required) `Cloud Email Security: Write``Cloud Email Security: Read` ##### ParametersExpand Collapse
params InvestigateListParams AccountID param.Field\[string] Path param: Identifier. maxLength32 Link to this property AlertID param.Field\[string]Optional Query param: Filter by alert ID. Link to this property Cursor param.Field\[string]Optional Query param: Pagination cursor from the previous response’s result_info. Link to this property
DeliveryStatus param.Field\[InvestigateListParamsDeliveryStatus]Optional Query param: Delivery status to filter by. const InvestigateListParamsDeliveryStatusDelivered InvestigateListParamsDeliveryStatus = "delivered" Link to this property const InvestigateListParamsDeliveryStatusMoved InvestigateListParamsDeliveryStatus = "moved" Link to this property const InvestigateListParamsDeliveryStatusQuarantined InvestigateListParamsDeliveryStatus = "quarantined" Link to this property const InvestigateListParamsDeliveryStatusRejected InvestigateListParamsDeliveryStatus = "rejected" Link to this property const InvestigateListParamsDeliveryStatusDeferred InvestigateListParamsDeliveryStatus = "deferred" Link to this property const InvestigateListParamsDeliveryStatusBounced InvestigateListParamsDeliveryStatus = "bounced" Link to this property const InvestigateListParamsDeliveryStatusQueued InvestigateListParamsDeliveryStatus = "queued" Link to this property const InvestigateListParamsDeliveryStatusMoveFailed InvestigateListParamsDeliveryStatus = "move\_failed" Link to this property
Link to this property DetectionsOnly param.Field\[bool]Optional Query param: Whether to include only detections in search results. Link to this property Domain param.Field\[string]Optional Query param: Filter by a domain found in the email — sender domain, recipient domain, or a domain in a link. Link to this property End param.Field\[Time]Optional Query param: The end of the search date range. Defaults to now. formatdate-time Link to this property
FinalDisposition param.Field\[InvestigateListParamsFinalDisposition]Optional Query param: Dispositions to filter by. const InvestigateListParamsFinalDispositionMalicious InvestigateListParamsFinalDisposition = "MALICIOUS" Link to this property const InvestigateListParamsFinalDispositionSuspicious InvestigateListParamsFinalDisposition = "SUSPICIOUS" Link to this property const InvestigateListParamsFinalDispositionSpoof InvestigateListParamsFinalDisposition = "SPOOF" Link to this property const InvestigateListParamsFinalDispositionSpam InvestigateListParamsFinalDisposition = "SPAM" Link to this property const InvestigateListParamsFinalDispositionBulk InvestigateListParamsFinalDisposition = "BULK" Link to this property const InvestigateListParamsFinalDispositionNone InvestigateListParamsFinalDisposition = "NONE" Link to this property
Link to this property
MessageAction param.Field\[InvestigateListParamsMessageAction]Optional Query param: Message actions to filter by. const InvestigateListParamsMessageActionPreview InvestigateListParamsMessageAction = "PREVIEW" Link to this property const InvestigateListParamsMessageActionQuarantineReleased InvestigateListParamsMessageAction = "QUARANTINE\_RELEASED" Link to this property const InvestigateListParamsMessageActionMoved InvestigateListParamsMessageAction = "MOVED" Link to this property
Link to this property MessageID param.Field\[string]Optional Query param: Filter by the RFC 5322 Message-ID header. Link to this property Metric param.Field\[string]Optional Query param: Metric to aggregate the results by. Link to this property Page param.Field\[int64]Optional Query param: Deprecated: Use cursor pagination instead. End of life: November 1, 2026. minimum1 Link to this property PerPage param.Field\[int64]Optional Query param: The number of results per page. Maximum value is 1000. maximum1000 minimum1 Link to this property Query param.Field\[string]Optional Query param: Space-delimited term matched case-insensitively against message metadata — sender, recipient, subject, attachment names and hashes, and message ID. Link to this property Recipient param.Field\[string]Optional Query param: Filter by recipient. Matches an email address or a domain. Link to this property Sender param.Field\[string]Optional Query param: Filter by sender. Matches an email address or a domain. Link to this property SmtpHeloIP param.Field\[string]Optional Query param: Matches messages whose SMTP HELO server IP address equals this value. Link to this property Start param.Field\[Time]Optional Query param: The beginning of the search date range. Defaults to now - 30 days. Must not be in the future. formatdate-time Link to this property Subject param.Field\[string]Optional Query param: Search for messages containing individual keywords in any order within the subject. Link to this property
[Link to this property](<#(resource)%20email_security.investigate%20%3E%20(method)%20list%20%3E%20(params)%20default>) ##### ReturnsExpand Collapse
type InvestigateListResponse struct{…} ID string Unique identifier for a message retrieved from investigation. Link to this property
DeprecatedActionLog \[]InvestigateListResponseActionLog Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. CompletedAt Time Timestamp when action completed. formatdate-time Link to this property
Operation InvestigateListResponseActionLogOperation Type of action performed. One of the following: const InvestigateListResponseActionLogOperationMove InvestigateListResponseActionLogOperation = "MOVE" Link to this property const InvestigateListResponseActionLogOperationRelease InvestigateListResponseActionLogOperation = "RELEASE" Link to this property const InvestigateListResponseActionLogOperationReclassify InvestigateListResponseActionLogOperation = "RECLASSIFY" Link to this property const InvestigateListResponseActionLogOperationSubmission InvestigateListResponseActionLogOperation = "SUBMISSION" Link to this property const InvestigateListResponseActionLogOperationQuarantineRelease InvestigateListResponseActionLogOperation = "QUARANTINE\_RELEASE" Link to this property const InvestigateListResponseActionLogOperationPreview InvestigateListResponseActionLogOperation = "PREVIEW" Link to this property
Link to this property DeprecatedCompletedTimestamp stringOptional Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. Link to this property
Properties InvestigateListResponseActionLogPropertiesOptional Additional properties for the action. Folder stringOptional Target folder for move operations. Link to this property RequestedBy stringOptional User who requested the action. Link to this property
Link to this property Status stringOptional Status of the action. Link to this property
Link to this property ClientRecipients \[]string Link to this property DetectionReasons \[]string Link to this property IsPhishSubmission bool Link to this property IsQuarantined bool Link to this property PostfixID string The identifier of the message. Link to this property
Properties InvestigateListResponseProperties Message processing properties. AllowlistedPattern stringOptional Pattern that allowlisted this message. Link to this property
AllowlistedPatternType InvestigateListResponsePropertiesAllowlistedPatternTypeOptional Type of allowlist pattern. One of the following: const InvestigateListResponsePropertiesAllowlistedPatternTypeQuarantineRelease InvestigateListResponsePropertiesAllowlistedPatternType = "quarantine\_release" Link to this property const InvestigateListResponsePropertiesAllowlistedPatternTypeAcceptableSender InvestigateListResponsePropertiesAllowlistedPatternType = "acceptable\_sender" Link to this property const InvestigateListResponsePropertiesAllowlistedPatternTypeAllowedSender InvestigateListResponsePropertiesAllowlistedPatternType = "allowed\_sender" Link to this property const InvestigateListResponsePropertiesAllowlistedPatternTypeAllowedRecipient InvestigateListResponsePropertiesAllowlistedPatternType = "allowed\_recipient" Link to this property const InvestigateListResponsePropertiesAllowlistedPatternTypeDomainSimilarity InvestigateListResponsePropertiesAllowlistedPatternType = "domain\_similarity" Link to this property const InvestigateListResponsePropertiesAllowlistedPatternTypeDomainRecency InvestigateListResponsePropertiesAllowlistedPatternType = "domain\_recency" Link to this property const InvestigateListResponsePropertiesAllowlistedPatternTypeManagedAcceptableSender InvestigateListResponsePropertiesAllowlistedPatternType = "managed\_acceptable\_sender" Link to this property const InvestigateListResponsePropertiesAllowlistedPatternTypeOutboundNdr InvestigateListResponsePropertiesAllowlistedPatternType = "outbound\_ndr" Link to this property
Link to this property BlocklistedMessage boolOptional Whether message was blocklisted. Link to this property BlocklistedPattern stringOptional Pattern that blocklisted this message. Link to this property
WhitelistedPatternType InvestigateListResponsePropertiesWhitelistedPatternTypeOptional Legacy field for allowlist pattern type. One of the following: const InvestigateListResponsePropertiesWhitelistedPatternTypeQuarantineRelease InvestigateListResponsePropertiesWhitelistedPatternType = "quarantine\_release" Link to this property const InvestigateListResponsePropertiesWhitelistedPatternTypeAcceptableSender InvestigateListResponsePropertiesWhitelistedPatternType = "acceptable\_sender" Link to this property const InvestigateListResponsePropertiesWhitelistedPatternTypeAllowedSender InvestigateListResponsePropertiesWhitelistedPatternType = "allowed\_sender" Link to this property const InvestigateListResponsePropertiesWhitelistedPatternTypeAllowedRecipient InvestigateListResponsePropertiesWhitelistedPatternType = "allowed\_recipient" Link to this property const InvestigateListResponsePropertiesWhitelistedPatternTypeDomainSimilarity InvestigateListResponsePropertiesWhitelistedPatternType = "domain\_similarity" Link to this property const InvestigateListResponsePropertiesWhitelistedPatternTypeDomainRecency InvestigateListResponsePropertiesWhitelistedPatternType = "domain\_recency" Link to this property const InvestigateListResponsePropertiesWhitelistedPatternTypeManagedAcceptableSender InvestigateListResponsePropertiesWhitelistedPatternType = "managed\_acceptable\_sender" Link to this property const InvestigateListResponsePropertiesWhitelistedPatternTypeOutboundNdr InvestigateListResponsePropertiesWhitelistedPatternType = "outbound\_ndr" Link to this property
Link to this property
Link to this property DeprecatedTs string Use scanned_at instead. Deprecated, use scanned_at instead. End of life: November 1, 2026. Link to this property AlertID stringOptional Link to this property
DeliveryMode InvestigateListResponseDeliveryModeOptional One of the following: const InvestigateListResponseDeliveryModeDirect InvestigateListResponseDeliveryMode = "DIRECT" Link to this property const InvestigateListResponseDeliveryModeBcc InvestigateListResponseDeliveryMode = "BCC" Link to this property const InvestigateListResponseDeliveryModeJournal InvestigateListResponseDeliveryMode = "JOURNAL" Link to this property const InvestigateListResponseDeliveryModeReviewSubmission InvestigateListResponseDeliveryMode = "REVIEW\_SUBMISSION" Link to this property const InvestigateListResponseDeliveryModeDMARCUnverified InvestigateListResponseDeliveryMode = "DMARC\_UNVERIFIED" Link to this property const InvestigateListResponseDeliveryModeDMARCFailureReport InvestigateListResponseDeliveryMode = "DMARC\_FAILURE\_REPORT" Link to this property const InvestigateListResponseDeliveryModeDMARCAggregateReport InvestigateListResponseDeliveryMode = "DMARC\_AGGREGATE\_REPORT" Link to this property const InvestigateListResponseDeliveryModeThreatIntelSubmission InvestigateListResponseDeliveryMode = "THREAT\_INTEL\_SUBMISSION" Link to this property const InvestigateListResponseDeliveryModeSimulationSubmission InvestigateListResponseDeliveryMode = "SIMULATION\_SUBMISSION" Link to this property const InvestigateListResponseDeliveryModeAPI InvestigateListResponseDeliveryMode = "API" Link to this property const InvestigateListResponseDeliveryModeRetroScan InvestigateListResponseDeliveryMode = "RETRO\_SCAN" Link to this property
Link to this property
DeliveryStatus \[]InvestigateListResponseDeliveryStatusOptional One of the following: const InvestigateListResponseDeliveryStatusDelivered InvestigateListResponseDeliveryStatus = "delivered" Link to this property const InvestigateListResponseDeliveryStatusMoved InvestigateListResponseDeliveryStatus = "moved" Link to this property const InvestigateListResponseDeliveryStatusQuarantined InvestigateListResponseDeliveryStatus = "quarantined" Link to this property const InvestigateListResponseDeliveryStatusRejected InvestigateListResponseDeliveryStatus = "rejected" Link to this property const InvestigateListResponseDeliveryStatusDeferred InvestigateListResponseDeliveryStatus = "deferred" Link to this property const InvestigateListResponseDeliveryStatusBounced InvestigateListResponseDeliveryStatus = "bounced" Link to this property const InvestigateListResponseDeliveryStatusQueued InvestigateListResponseDeliveryStatus = "queued" Link to this property const InvestigateListResponseDeliveryStatusMoveFailed InvestigateListResponseDeliveryStatus = "move\_failed" Link to this property
Link to this property EdfHash stringOptional Link to this property EnvelopeFrom stringOptional Link to this property EnvelopeTo \[]stringOptional Link to this property
FinalDisposition InvestigateListResponseFinalDispositionOptional The verdict Email Security assigns to a message. One of the following: const InvestigateListResponseFinalDispositionMalicious InvestigateListResponseFinalDisposition = "MALICIOUS" Link to this property const InvestigateListResponseFinalDispositionMaliciousBec InvestigateListResponseFinalDisposition = "MALICIOUS-BEC" Link to this property const InvestigateListResponseFinalDispositionSuspicious InvestigateListResponseFinalDisposition = "SUSPICIOUS" Link to this property const InvestigateListResponseFinalDispositionSpoof InvestigateListResponseFinalDisposition = "SPOOF" Link to this property const InvestigateListResponseFinalDispositionSpam InvestigateListResponseFinalDisposition = "SPAM" Link to this property const InvestigateListResponseFinalDispositionBulk InvestigateListResponseFinalDisposition = "BULK" Link to this property const InvestigateListResponseFinalDispositionEncrypted InvestigateListResponseFinalDisposition = "ENCRYPTED" Link to this property const InvestigateListResponseFinalDispositionExternal InvestigateListResponseFinalDisposition = "EXTERNAL" Link to this property const InvestigateListResponseFinalDispositionUnknown InvestigateListResponseFinalDisposition = "UNKNOWN" Link to this property const InvestigateListResponseFinalDispositionNone InvestigateListResponseFinalDisposition = "NONE" Link to this property
Link to this property
DeprecatedFindings \[]InvestigateListResponseFindingOptional Use the findings field from GET /investigate/{investigate\_id}/detections instead. Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message. Attachment stringOptional Link to this property Detail stringOptional Link to this property
Detection InvestigateListResponseFindingsDetectionOptional The verdict Email Security assigns to a message. One of the following: const InvestigateListResponseFindingsDetectionMalicious InvestigateListResponseFindingsDetection = "MALICIOUS" Link to this property const InvestigateListResponseFindingsDetectionMaliciousBec InvestigateListResponseFindingsDetection = "MALICIOUS-BEC" Link to this property const InvestigateListResponseFindingsDetectionSuspicious InvestigateListResponseFindingsDetection = "SUSPICIOUS" Link to this property const InvestigateListResponseFindingsDetectionSpoof InvestigateListResponseFindingsDetection = "SPOOF" Link to this property const InvestigateListResponseFindingsDetectionSpam InvestigateListResponseFindingsDetection = "SPAM" Link to this property const InvestigateListResponseFindingsDetectionBulk InvestigateListResponseFindingsDetection = "BULK" Link to this property const InvestigateListResponseFindingsDetectionEncrypted InvestigateListResponseFindingsDetection = "ENCRYPTED" Link to this property const InvestigateListResponseFindingsDetectionExternal InvestigateListResponseFindingsDetection = "EXTERNAL" Link to this property const InvestigateListResponseFindingsDetectionUnknown InvestigateListResponseFindingsDetection = "UNKNOWN" Link to this property const InvestigateListResponseFindingsDetectionNone InvestigateListResponseFindingsDetection = "NONE" Link to this property
Link to this property Field stringOptional Link to this property Name stringOptional Link to this property Portion stringOptional Link to this property Reason stringOptional Link to this property Score float64Optional formatdouble Link to this property Value stringOptional Link to this property
Link to this property From stringOptional Link to this property FromName stringOptional Link to this property HtmltextStructureHash stringOptional Link to this property MessageID stringOptional Link to this property
PostDeliveryOperations \[]InvestigateListResponsePostDeliveryOperationOptional Post-delivery operations performed on this message. One of the following: const InvestigateListResponsePostDeliveryOperationPreview InvestigateListResponsePostDeliveryOperation = "PREVIEW" Link to this property const InvestigateListResponsePostDeliveryOperationQuarantineRelease InvestigateListResponsePostDeliveryOperation = "QUARANTINE\_RELEASE" Link to this property const InvestigateListResponsePostDeliveryOperationSubmission InvestigateListResponsePostDeliveryOperation = "SUBMISSION" Link to this property const InvestigateListResponsePostDeliveryOperationMove InvestigateListResponsePostDeliveryOperation = "MOVE" Link to this property
Link to this property PostfixIDOutbound stringOptional Link to this property Replyto stringOptional Link to this property ScannedAt TimeOptional When the message was scanned (UTC). formatdate-time Link to this property SentAt TimeOptional When the message was sent (UTC). formatdate-time Link to this property SentDate stringOptional Link to this property SmtpHeloServerIP stringOptional Link to this property SmtpPreviousHopIP stringOptional Link to this property Subject stringOptional Link to this property ThreatCategories \[]stringOptional Link to this property To \[]stringOptional Link to this property ToName \[]stringOptional Link to this property
Validation InvestigateListResponseValidationOptional Comment stringOptional Link to this property
DKIM InvestigateListResponseValidationDKIMOptional One of the following: const InvestigateListResponseValidationDKIMPass InvestigateListResponseValidationDKIM = "pass" Link to this property const InvestigateListResponseValidationDKIMNeutral InvestigateListResponseValidationDKIM = "neutral" Link to this property const InvestigateListResponseValidationDKIMFail InvestigateListResponseValidationDKIM = "fail" Link to this property const InvestigateListResponseValidationDKIMError InvestigateListResponseValidationDKIM = "error" Link to this property const InvestigateListResponseValidationDKIMNone InvestigateListResponseValidationDKIM = "none" Link to this property
Link to this property
DMARC InvestigateListResponseValidationDMARCOptional One of the following: const InvestigateListResponseValidationDMARCPass InvestigateListResponseValidationDMARC = "pass" Link to this property const InvestigateListResponseValidationDMARCNeutral InvestigateListResponseValidationDMARC = "neutral" Link to this property const InvestigateListResponseValidationDMARCFail InvestigateListResponseValidationDMARC = "fail" Link to this property const InvestigateListResponseValidationDMARCError InvestigateListResponseValidationDMARC = "error" Link to this property const InvestigateListResponseValidationDMARCNone InvestigateListResponseValidationDMARC = "none" Link to this property
Link to this property
SPF InvestigateListResponseValidationSPFOptional One of the following: const InvestigateListResponseValidationSPFPass InvestigateListResponseValidationSPF = "pass" Link to this property const InvestigateListResponseValidationSPFNeutral InvestigateListResponseValidationSPF = "neutral" Link to this property const InvestigateListResponseValidationSPFFail InvestigateListResponseValidationSPF = "fail" Link to this property const InvestigateListResponseValidationSPFError InvestigateListResponseValidationSPF = "error" Link to this property const InvestigateListResponseValidationSPFNone InvestigateListResponseValidationSPF = "none" Link to this property
Link to this property
Link to this property XOriginatingIP stringOptional Link to this property
[Link to this property](<#(resource)%20email_security.investigate%20%3E%20(model)%20InvestigateListResponse%20%3E%20(schema)>) ### Search email messages Go HTTPTypeScriptPythonGoTerraform ``` package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) page, err := client.EmailSecurity.Investigate.List(context.TODO(), email_security.InvestigateListParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "id": "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", "action_log": [ { "completed_at": "2019-12-27T18:11:19.117Z", "operation": "MOVE", "completed_timestamp": "completed_timestamp", "properties": { "folder": "folder", "requested_by": "requested_by" }, "status": "status" } ], "client_recipients": [ "string" ], "detection_reasons": [ "string" ], "is_phish_submission": true, "is_quarantined": true, "postfix_id": "4Njp3P0STMz2c02Q", "properties": { "allowlisted_pattern": "allowlisted_pattern", "allowlisted_pattern_type": "quarantine_release", "blocklisted_message": true, "blocklisted_pattern": "blocklisted_pattern", "whitelisted_pattern_type": "quarantine_release" }, "ts": "ts", "alert_id": "alert_id", "delivery_mode": "DIRECT", "delivery_status": [ "delivered" ], "edf_hash": "edf_hash", "envelope_from": "envelope_from", "envelope_to": [ "string" ], "final_disposition": "MALICIOUS", "findings": [ { "attachment": "attachment", "detail": "detail", "detection": "MALICIOUS", "field": "field", "name": "name", "portion": "portion", "reason": "reason", "score": 0, "value": "value" } ], "from": "from", "from_name": "from_name", "htmltext_structure_hash": "htmltext_structure_hash", "message_id": "message_id", "post_delivery_operations": [ "PREVIEW" ], "postfix_id_outbound": "postfix_id_outbound", "replyto": "replyto", "scanned_at": "2019-12-27T18:11:19.117Z", "sent_at": "2019-12-27T18:11:19.117Z", "sent_date": "sent_date", "smtp_helo_server_ip": "smtp_helo_server_ip", "smtp_previous_hop_ip": "smtp_previous_hop_ip", "subject": "subject", "threat_categories": [ "string" ], "to": [ "string" ], "to_name": [ "string" ], "validation": { "comment": "comment", "dkim": "pass", "dmarc": "pass", "spf": "pass" }, "x_originating_ip": "x_originating_ip" } ], "result_info": { "count": 0, "per_page": 0, "total_count": 0, "next": "next", "page": 0, "previous": "previous" }, "success": true } ``` ##### Returns Examples 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "id": "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", "action_log": [ { "completed_at": "2019-12-27T18:11:19.117Z", "operation": "MOVE", "completed_timestamp": "completed_timestamp", "properties": { "folder": "folder", "requested_by": "requested_by" }, "status": "status" } ], "client_recipients": [ "string" ], "detection_reasons": [ "string" ], "is_phish_submission": true, "is_quarantined": true, "postfix_id": "4Njp3P0STMz2c02Q", "properties": { "allowlisted_pattern": "allowlisted_pattern", "allowlisted_pattern_type": "quarantine_release", "blocklisted_message": true, "blocklisted_pattern": "blocklisted_pattern", "whitelisted_pattern_type": "quarantine_release" }, "ts": "ts", "alert_id": "alert_id", "delivery_mode": "DIRECT", "delivery_status": [ "delivered" ], "edf_hash": "edf_hash", "envelope_from": "envelope_from", "envelope_to": [ "string" ], "final_disposition": "MALICIOUS", "findings": [ { "attachment": "attachment", "detail": "detail", "detection": "MALICIOUS", "field": "field", "name": "name", "portion": "portion", "reason": "reason", "score": 0, "value": "value" } ], "from": "from", "from_name": "from_name", "htmltext_structure_hash": "htmltext_structure_hash", "message_id": "message_id", "post_delivery_operations": [ "PREVIEW" ], "postfix_id_outbound": "postfix_id_outbound", "replyto": "replyto", "scanned_at": "2019-12-27T18:11:19.117Z", "sent_at": "2019-12-27T18:11:19.117Z", "sent_date": "sent_date", "smtp_helo_server_ip": "smtp_helo_server_ip", "smtp_previous_hop_ip": "smtp_previous_hop_ip", "subject": "subject", "threat_categories": [ "string" ], "to": [ "string" ], "to_name": [ "string" ], "validation": { "comment": "comment", "dkim": "pass", "dmarc": "pass", "spf": "pass" }, "x_originating_ip": "x_originating_ip" } ], "result_info": { "count": 0, "per_page": 0, "total_count": 0, "next": "next", "page": 0, "previous": "previous" }, "success": true } ```