--- title: Email Security --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Email Security #### Email SecurityInvestigate ##### [Search email messages](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/methods/list) email\_security.investigate.list(InvestigateListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[InvestigateListResponse]()] GET/accounts/{account\_id}/email-security/investigate ##### [Get message details](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/methods/get) email\_security.investigate.get(strinvestigate\_id, InvestigateGetParams\*\*kwargs) -> [InvestigateGetResponse]() GET/accounts/{account\_id}/email-security/investigate/{investigate\_id} ##### ModelsExpand Collapse
class InvestigateListResponse: … id: str Unique identifier for a message retrieved from investigation. Link to this property
Deprecatedaction\_log: List\[ActionLog] Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. completed\_at: datetime Timestamp when action completed. formatdate-time Link to this property
operation: Literal\["MOVE", "RELEASE", "RECLASSIFY", 3 more] Type of action performed. One of the following: "MOVE" Link to this property "RELEASE" Link to this property "RECLASSIFY" Link to this property "SUBMISSION" Link to this property "QUARANTINE\_RELEASE" Link to this property "PREVIEW" Link to this property
Link to this property Deprecatedcompleted\_timestamp: Optional\[str] Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. Link to this property
properties: Optional\[ActionLogProperties] Additional properties for the action. folder: Optional\[str] Target folder for move operations. Link to this property requested\_by: Optional\[str] User who requested the action. Link to this property
Link to this property status: Optional\[str] Status of the action. Link to this property
Link to this property client\_recipients: List\[str] Link to this property detection\_reasons: List\[str] Link to this property is\_phish\_submission: bool Link to this property is\_quarantined: bool Link to this property postfix\_id: str The identifier of the message. Link to this property
properties: Properties Message processing properties. allowlisted\_pattern: Optional\[str] Pattern that allowlisted this message. Link to this property
allowlisted\_pattern\_type: Optional\[Literal\["quarantine\_release", "acceptable\_sender", "allowed\_sender", 5 more]] Type of allowlist pattern. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property blocklisted\_message: Optional\[bool] Whether message was blocklisted. Link to this property blocklisted\_pattern: Optional\[str] Pattern that blocklisted this message. Link to this property
whitelisted\_pattern\_type: Optional\[Literal\["quarantine\_release", "acceptable\_sender", "allowed\_sender", 5 more]] Legacy field for allowlist pattern type. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property
Link to this property Deprecatedts: str Use scanned_at instead. Deprecated, use scanned_at instead. End of life: November 1, 2026. Link to this property alert\_id: Optional\[str] Link to this property
delivery\_mode: Optional\[Literal\["DIRECT", "BCC", "JOURNAL", 8 more]] One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "REVIEW\_SUBMISSION" Link to this property "DMARC\_UNVERIFIED" Link to this property "DMARC\_FAILURE\_REPORT" Link to this property "DMARC\_AGGREGATE\_REPORT" Link to this property "THREAT\_INTEL\_SUBMISSION" Link to this property "SIMULATION\_SUBMISSION" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
delivery\_status: Optional\[List\[Literal\["delivered", "moved", "quarantined", 5 more]]] One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property edf\_hash: Optional\[str] Link to this property envelope\_from: Optional\[str] Link to this property envelope\_to: Optional\[List\[str]] Link to this property
final\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Deprecatedfindings: Optional\[List\[Finding]] Use the findings field from GET /investigate/{investigate\_id}/detections instead. Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message. attachment: Optional\[str] Link to this property detail: Optional\[str] Link to this property
detection: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field: Optional\[str] Link to this property name: Optional\[str] Link to this property portion: Optional\[str] Link to this property reason: Optional\[str] Link to this property score: Optional\[float] formatdouble Link to this property value: Optional\[str] Link to this property
Link to this property from\_: Optional\[str] Link to this property from\_name: Optional\[str] Link to this property htmltext\_structure\_hash: Optional\[str] Link to this property message\_id: Optional\[str] Link to this property
post\_delivery\_operations: Optional\[List\[Literal\["PREVIEW", "QUARANTINE\_RELEASE", "SUBMISSION", "MOVE"]]] Post-delivery operations performed on this message. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASE" Link to this property "SUBMISSION" Link to this property "MOVE" Link to this property
Link to this property postfix\_id\_outbound: Optional\[str] Link to this property replyto: Optional\[str] Link to this property scanned\_at: Optional\[datetime] When the message was scanned (UTC). formatdate-time Link to this property sent\_at: Optional\[datetime] When the message was sent (UTC). formatdate-time Link to this property sent\_date: Optional\[str] Link to this property smtp\_helo\_server\_ip: Optional\[str] Link to this property smtp\_previous\_hop\_ip: Optional\[str] Link to this property subject: Optional\[str] Link to this property threat\_categories: Optional\[List\[str]] Link to this property to: Optional\[List\[str]] Link to this property to\_name: Optional\[List\[str]] Link to this property
validation: Optional\[Validation] comment: Optional\[str] Link to this property
dkim: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property x\_originating\_ip: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.investigate%20%3E%20(model)%20investigate_list_response%20%3E%20(schema)>)
class InvestigateGetResponse: … id: str Unique identifier for a message retrieved from investigation. Link to this property
Deprecatedaction\_log: List\[ActionLog] Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. completed\_at: datetime Timestamp when action completed. formatdate-time Link to this property
operation: Literal\["MOVE", "RELEASE", "RECLASSIFY", 3 more] Type of action performed. One of the following: "MOVE" Link to this property "RELEASE" Link to this property "RECLASSIFY" Link to this property "SUBMISSION" Link to this property "QUARANTINE\_RELEASE" Link to this property "PREVIEW" Link to this property
Link to this property Deprecatedcompleted\_timestamp: Optional\[str] Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. Link to this property
properties: Optional\[ActionLogProperties] Additional properties for the action. folder: Optional\[str] Target folder for move operations. Link to this property requested\_by: Optional\[str] User who requested the action. Link to this property
Link to this property status: Optional\[str] Status of the action. Link to this property
Link to this property client\_recipients: List\[str] Link to this property detection\_reasons: List\[str] Link to this property is\_phish\_submission: bool Link to this property is\_quarantined: bool Link to this property postfix\_id: str The identifier of the message. Link to this property
properties: Properties Message processing properties. allowlisted\_pattern: Optional\[str] Pattern that allowlisted this message. Link to this property
allowlisted\_pattern\_type: Optional\[Literal\["quarantine\_release", "acceptable\_sender", "allowed\_sender", 5 more]] Type of allowlist pattern. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property blocklisted\_message: Optional\[bool] Whether message was blocklisted. Link to this property blocklisted\_pattern: Optional\[str] Pattern that blocklisted this message. Link to this property
whitelisted\_pattern\_type: Optional\[Literal\["quarantine\_release", "acceptable\_sender", "allowed\_sender", 5 more]] Legacy field for allowlist pattern type. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property
Link to this property Deprecatedts: str Use scanned_at instead. Deprecated, use scanned_at instead. End of life: November 1, 2026. Link to this property alert\_id: Optional\[str] Link to this property
delivery\_mode: Optional\[Literal\["DIRECT", "BCC", "JOURNAL", 8 more]] One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "REVIEW\_SUBMISSION" Link to this property "DMARC\_UNVERIFIED" Link to this property "DMARC\_FAILURE\_REPORT" Link to this property "DMARC\_AGGREGATE\_REPORT" Link to this property "THREAT\_INTEL\_SUBMISSION" Link to this property "SIMULATION\_SUBMISSION" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
delivery\_status: Optional\[List\[Literal\["delivered", "moved", "quarantined", 5 more]]] One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property edf\_hash: Optional\[str] Link to this property envelope\_from: Optional\[str] Link to this property envelope\_to: Optional\[List\[str]] Link to this property
final\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Deprecatedfindings: Optional\[List\[Finding]] Use the findings field from GET /investigate/{investigate\_id}/detections instead. Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message. attachment: Optional\[str] Link to this property detail: Optional\[str] Link to this property
detection: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field: Optional\[str] Link to this property name: Optional\[str] Link to this property portion: Optional\[str] Link to this property reason: Optional\[str] Link to this property score: Optional\[float] formatdouble Link to this property value: Optional\[str] Link to this property
Link to this property from\_: Optional\[str] Link to this property from\_name: Optional\[str] Link to this property htmltext\_structure\_hash: Optional\[str] Link to this property message\_id: Optional\[str] Link to this property
post\_delivery\_operations: Optional\[List\[Literal\["PREVIEW", "QUARANTINE\_RELEASE", "SUBMISSION", "MOVE"]]] Post-delivery operations performed on this message. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASE" Link to this property "SUBMISSION" Link to this property "MOVE" Link to this property
Link to this property postfix\_id\_outbound: Optional\[str] Link to this property replyto: Optional\[str] Link to this property scanned\_at: Optional\[datetime] When the message was scanned (UTC). formatdate-time Link to this property sent\_at: Optional\[datetime] When the message was sent (UTC). formatdate-time Link to this property sent\_date: Optional\[str] Link to this property smtp\_helo\_server\_ip: Optional\[str] Link to this property smtp\_previous\_hop\_ip: Optional\[str] Link to this property subject: Optional\[str] Link to this property threat\_categories: Optional\[List\[str]] Link to this property to: Optional\[List\[str]] Link to this property to\_name: Optional\[List\[str]] Link to this property
validation: Optional\[Validation] comment: Optional\[str] Link to this property
dkim: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property x\_originating\_ip: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.investigate%20%3E%20(model)%20investigate_get_response%20%3E%20(schema)>) #### Email SecurityInvestigateDetections ##### [Get message detection details](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/detections/methods/get) email\_security.investigate.detections.get(strinvestigate\_id, DetectionGetParams\*\*kwargs) -> [DetectionGetResponse]() GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/detections ##### ModelsExpand Collapse
class DetectionGetResponse: … action: str Link to this property
attachments: List\[Attachment] size: int Size of the attachment in bytes. minimum0 Link to this property content\_type: Optional\[str] MIME type of the attachment. Link to this property
detection: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] Detection result for this attachment. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property encrypted: Optional\[bool] Whether the attachment is encrypted. Link to this property filename: Optional\[str] Name of the attached file. Link to this property md5: Optional\[str] MD5 hash of the attachment. Link to this property name: Optional\[str] Attachment name (alternative to filename). Link to this property sha1: Optional\[str] SHA1 hash of the attachment. Link to this property sha256: Optional\[str] SHA256 hash of the attachment. Link to this property
Link to this property
findings: Optional\[List\[Finding]] attachment: Optional\[str] Link to this property detail: Optional\[str] Link to this property
detection: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] Detection result associated with this finding. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field: Optional\[str] Link to this property name: Optional\[str] Link to this property portion: Optional\[str] Link to this property reason: Optional\[str] Link to this property score: Optional\[float] formatdouble Link to this property value: Optional\[str] Link to this property
Link to this property
headers: List\[Header] name: str Link to this property value: str Link to this property
Link to this property
links: List\[Link] href: str Link to this property text: Optional\[str] Link to this property
Link to this property
sender\_info: SenderInfo as\_name: Optional\[str] The name of the autonomous system. Link to this property as\_number: Optional\[int] The number of the autonomous system. Link to this property geo: Optional\[str] Link to this property ip: Optional\[str] Link to this property pld: Optional\[str] Link to this property
Link to this property
threat\_categories: List\[ThreatCategory] id: Optional\[int] Link to this property description: Optional\[str] Link to this property name: Optional\[str] Link to this property
Link to this property
validation: Validation comment: Optional\[str] Link to this property
dkim: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property
final\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.detections%20%3E%20(model)%20detection_get_response%20%3E%20(schema)>) #### Email SecurityInvestigatePreview ##### [Get preview for a detection](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/preview/methods/get) email\_security.investigate.preview.get(strinvestigate\_id, PreviewGetParams\*\*kwargs) -> [PreviewGetResponse]() GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/preview ##### [Generate preview for a non-detection message](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/preview/methods/create) email\_security.investigate.preview.create(PreviewCreateParams\*\*kwargs) -> [PreviewCreateResponse]() POST/accounts/{account\_id}/email-security/investigate/preview ##### ModelsExpand Collapse
class PreviewGetResponse: … screenshot: str A base64 encoded PNG image of the email. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.preview%20%3E%20(model)%20preview_get_response%20%3E%20(schema)>)
class PreviewCreateResponse: … screenshot: str A base64 encoded PNG image of the email. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.preview%20%3E%20(model)%20preview_create_response%20%3E%20(schema)>) #### Email SecurityInvestigateRaw ##### [Get raw email content](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/raw/methods/get) email\_security.investigate.raw.get(strinvestigate\_id, RawGetParams\*\*kwargs) -> [RawGetResponse]() GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/raw ##### ModelsExpand Collapse
class RawGetResponse: … raw: str A UTF-8 encoded eml file of the email. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>) #### Email SecurityInvestigateTrace ##### [Get email trace](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/trace/methods/get) email\_security.investigate.trace.get(strinvestigate\_id, TraceGetParams\*\*kwargs) -> [TraceGetResponse]() GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/trace ##### ModelsExpand Collapse
class TraceGetResponse: …
inbound: Inbound
lines: Optional\[List\[InboundLine]] lineno: Optional\[int] Line number in the trace log. Link to this property logged\_at: Optional\[datetime] formatdate-time Link to this property message: Optional\[str] Link to this property Deprecatedts: Optional\[str] Use logged_at instead. Deprecated, use logged_at instead. End of life: November 1, 2026. Link to this property
Link to this property pending: Optional\[bool] Link to this property
Link to this property
outbound: Outbound
lines: Optional\[List\[OutboundLine]] lineno: Optional\[int] Line number in the trace log. Link to this property logged\_at: Optional\[datetime] formatdate-time Link to this property message: Optional\[str] Link to this property Deprecatedts: Optional\[str] Use logged_at instead. Deprecated, use logged_at instead. End of life: November 1, 2026. Link to this property
Link to this property pending: Optional\[bool] Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.trace%20%3E%20(model)%20trace_get_response%20%3E%20(schema)>) #### Email SecurityInvestigateMove ##### [Move a message](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/move/methods/create) email\_security.investigate.move.create(strinvestigate\_id, MoveCreateParams\*\*kwargs) -> SyncSinglePage\[[MoveCreateResponse]()] POST/accounts/{account\_id}/email-security/investigate/{investigate\_id}/move ##### [Move messages](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/move/methods/bulk) email\_security.investigate.move.bulk(MoveBulkParams\*\*kwargs) -> SyncSinglePage\[[MoveBulkResponse]()] POST/accounts/{account\_id}/email-security/investigate/move ##### ModelsExpand Collapse
class MoveCreateResponse: … success: bool Whether the operation succeeded. Link to this property completed\_at: Optional\[datetime] When the move operation completed (UTC). formatdate-time Link to this property Deprecatedcompleted\_timestamp: Optional\[datetime] Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. formatdate-time Link to this property destination: Optional\[str] Destination folder for the message. Link to this property Deprecateditem\_count: Optional\[int] This field is deprecated. Number of items moved. End of life: November 1, 2026. Link to this property message\_id: Optional\[str] Message identifier. Link to this property operation: Optional\[str] Type of operation performed. Link to this property recipient: Optional\[str] Recipient email address. Link to this property status: Optional\[str] Operation status. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.move%20%3E%20(model)%20move_create_response%20%3E%20(schema)>)
class MoveBulkResponse: … success: bool Whether the operation succeeded. Link to this property completed\_at: Optional\[datetime] When the move operation completed (UTC). formatdate-time Link to this property Deprecatedcompleted\_timestamp: Optional\[datetime] Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. formatdate-time Link to this property destination: Optional\[str] Destination folder for the message. Link to this property Deprecateditem\_count: Optional\[int] This field is deprecated. Number of items moved. End of life: November 1, 2026. Link to this property message\_id: Optional\[str] Message identifier. Link to this property operation: Optional\[str] Type of operation performed. Link to this property recipient: Optional\[str] Recipient email address. Link to this property status: Optional\[str] Operation status. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.move%20%3E%20(model)%20move_bulk_response%20%3E%20(schema)>) #### Email SecurityInvestigateReclassify ##### [Change email classification](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/reclassify/methods/create) Deprecated email\_security.investigate.reclassify.create(strinvestigate\_id, ReclassifyCreateParams\*\*kwargs) -> object POST/accounts/{account\_id}/email-security/investigate/{investigate\_id}/reclassify #### Email SecurityInvestigateRelease ##### [Release messages from quarantine](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/release/methods/bulk) email\_security.investigate.release.bulk(ReleaseBulkParams\*\*kwargs) -> SyncSinglePage\[[ReleaseBulkResponse]()] POST/accounts/{account\_id}/email-security/investigate/release ##### ModelsExpand Collapse
class ReleaseBulkResponse: … id: str Unique identifier for a message retrieved from investigation. Link to this property delivered: Optional\[List\[str]] Link to this property failed: Optional\[List\[str]] Link to this property Deprecatedpostfix\_id: Optional\[str] Use id instead. Deprecated, use id instead. End of life: November 1, 2026. Link to this property undelivered: Optional\[List\[str]] Link to this property
[Link to this property](<#(resource)%20email_security.investigate.release%20%3E%20(model)%20release_bulk_response%20%3E%20(schema)>) #### Email SecurityInvestigateBulk ##### [List bulk action jobs](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/bulk/methods/list) email\_security.investigate.bulk.list(BulkListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[BulkListResponse]()] GET/accounts/{account\_id}/email-security/investigate/bulk ##### [Create a bulk action job](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/bulk/methods/create) email\_security.investigate.bulk.create(BulkCreateParams\*\*kwargs) -> [BulkCreateResponse]() POST/accounts/{account\_id}/email-security/investigate/bulk ##### [Get bulk action job details](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/bulk/methods/get) email\_security.investigate.bulk.get(strjob\_id, BulkGetParams\*\*kwargs) -> [BulkGetResponse]() GET/accounts/{account\_id}/email-security/investigate/bulk/{job\_id} ##### [Delete a bulk action job](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/bulk/methods/delete) email\_security.investigate.bulk.delete(strjob\_id, BulkDeleteParams\*\*kwargs) -> [BulkDeleteResponse]() DELETE/accounts/{account\_id}/email-security/investigate/bulk/{job\_id} ##### ModelsExpand Collapse
class BulkListResponse: …
action\_params: ActionParams One of the following:
class ActionParamsMove: …
destination: Literal\["Inbox", "JunkEmail", "DeletedItems", 2 more] The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: Literal\["MOVE"] Link to this property
Deprecatedexpected\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
class ActionParamsRelease: … type: Literal\["RELEASE"] Link to this property
Link to this property
Link to this property
action\_type: Literal\["MOVE", "RELEASE"] One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: datetime formatdate-time Link to this property job\_id: str formatuuid Link to this property messages\_cancelled: int Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: int Link to this property messages\_pending: int Link to this property messages\_skipped: int Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: int Link to this property
search\_params: SearchParams Deprecatedaction\_log: Optional\[bool] Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id: Optional\[str] Alert ID of the detection to filter by. Link to this property
delivery\_status: Optional\[Literal\["delivered", "moved", "quarantined", 5 more]] Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only: Optional\[bool] Whether to include only detections in search results. Link to this property domain: Optional\[str] Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end: Optional\[datetime] End of search date range. formatdate-time Link to this property exact\_subject: Optional\[str] Match messages whose subject line equals this value exactly. Link to this property
final\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action: Optional\[Literal\["PREVIEW", "QUARANTINE\_RELEASED", "MOVED"]] Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id: Optional\[str] Message-ID header value to filter by. Link to this property metric: Optional\[str] Metric name to filter the search by. Link to this property query: Optional\[str] Space-delimited search term. Case-insensitive. Link to this property recipient: Optional\[str] Match messages whose recipient is this email address or domain. Link to this property sender: Optional\[str] Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip: Optional\[str] Matches messages whose SMTP HELO server IP address equals this value. Link to this property start: Optional\[datetime] Beginning of search date range. formatdate-time Link to this property subject: Optional\[str] Match messages whose subject contains these keywords, in any order. Link to this property submissions: Optional\[bool] Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: Literal\["PENDING", "DISCOVERING", "PROCESSING", 3 more] Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: int Link to this property comment: Optional\[str] Link to this property completed\_at: Optional\[datetime] formatdate-time Link to this property started\_at: Optional\[datetime] formatdate-time Link to this property status\_message: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_list_response%20%3E%20(schema)>)
class BulkCreateResponse: …
action\_params: ActionParams One of the following:
class ActionParamsMove: …
destination: Literal\["Inbox", "JunkEmail", "DeletedItems", 2 more] The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: Literal\["MOVE"] Link to this property
Deprecatedexpected\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
class ActionParamsRelease: … type: Literal\["RELEASE"] Link to this property
Link to this property
Link to this property
action\_type: Literal\["MOVE", "RELEASE"] One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: datetime formatdate-time Link to this property job\_id: str formatuuid Link to this property messages\_cancelled: int Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: int Link to this property messages\_pending: int Link to this property messages\_skipped: int Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: int Link to this property
search\_params: SearchParams Deprecatedaction\_log: Optional\[bool] Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id: Optional\[str] Alert ID of the detection to filter by. Link to this property
delivery\_status: Optional\[Literal\["delivered", "moved", "quarantined", 5 more]] Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only: Optional\[bool] Whether to include only detections in search results. Link to this property domain: Optional\[str] Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end: Optional\[datetime] End of search date range. formatdate-time Link to this property exact\_subject: Optional\[str] Match messages whose subject line equals this value exactly. Link to this property
final\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action: Optional\[Literal\["PREVIEW", "QUARANTINE\_RELEASED", "MOVED"]] Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id: Optional\[str] Message-ID header value to filter by. Link to this property metric: Optional\[str] Metric name to filter the search by. Link to this property query: Optional\[str] Space-delimited search term. Case-insensitive. Link to this property recipient: Optional\[str] Match messages whose recipient is this email address or domain. Link to this property sender: Optional\[str] Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip: Optional\[str] Matches messages whose SMTP HELO server IP address equals this value. Link to this property start: Optional\[datetime] Beginning of search date range. formatdate-time Link to this property subject: Optional\[str] Match messages whose subject contains these keywords, in any order. Link to this property submissions: Optional\[bool] Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: Literal\["PENDING", "DISCOVERING", "PROCESSING", 3 more] Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: int Link to this property comment: Optional\[str] Link to this property completed\_at: Optional\[datetime] formatdate-time Link to this property started\_at: Optional\[datetime] formatdate-time Link to this property status\_message: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_create_response%20%3E%20(schema)>)
class BulkGetResponse: …
action\_params: ActionParams One of the following:
class ActionParamsMove: …
destination: Literal\["Inbox", "JunkEmail", "DeletedItems", 2 more] The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: Literal\["MOVE"] Link to this property
Deprecatedexpected\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
class ActionParamsRelease: … type: Literal\["RELEASE"] Link to this property
Link to this property
Link to this property
action\_type: Literal\["MOVE", "RELEASE"] One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: datetime formatdate-time Link to this property job\_id: str formatuuid Link to this property messages\_cancelled: int Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: int Link to this property messages\_pending: int Link to this property messages\_skipped: int Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: int Link to this property
search\_params: SearchParams Deprecatedaction\_log: Optional\[bool] Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id: Optional\[str] Alert ID of the detection to filter by. Link to this property
delivery\_status: Optional\[Literal\["delivered", "moved", "quarantined", 5 more]] Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only: Optional\[bool] Whether to include only detections in search results. Link to this property domain: Optional\[str] Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end: Optional\[datetime] End of search date range. formatdate-time Link to this property exact\_subject: Optional\[str] Match messages whose subject line equals this value exactly. Link to this property
final\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action: Optional\[Literal\["PREVIEW", "QUARANTINE\_RELEASED", "MOVED"]] Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id: Optional\[str] Message-ID header value to filter by. Link to this property metric: Optional\[str] Metric name to filter the search by. Link to this property query: Optional\[str] Space-delimited search term. Case-insensitive. Link to this property recipient: Optional\[str] Match messages whose recipient is this email address or domain. Link to this property sender: Optional\[str] Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip: Optional\[str] Matches messages whose SMTP HELO server IP address equals this value. Link to this property start: Optional\[datetime] Beginning of search date range. formatdate-time Link to this property subject: Optional\[str] Match messages whose subject contains these keywords, in any order. Link to this property submissions: Optional\[bool] Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: Literal\["PENDING", "DISCOVERING", "PROCESSING", 3 more] Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: int Link to this property comment: Optional\[str] Link to this property completed\_at: Optional\[datetime] formatdate-time Link to this property started\_at: Optional\[datetime] formatdate-time Link to this property status\_message: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_get_response%20%3E%20(schema)>)
class BulkDeleteResponse: … id: str formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_delete_response%20%3E%20(schema)>) #### Email SecurityInvestigateBulkCancel ##### [Cancel a bulk action job](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/bulk/subresources/cancel/methods/create) email\_security.investigate.bulk.cancel.create(strjob\_id, CancelCreateParams\*\*kwargs) -> [CancelCreateResponse]() POST/accounts/{account\_id}/email-security/investigate/bulk/{job\_id}/cancel ##### ModelsExpand Collapse
class CancelCreateResponse: …
action\_params: ActionParams One of the following:
class ActionParamsMove: …
destination: Literal\["Inbox", "JunkEmail", "DeletedItems", 2 more] The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: Literal\["MOVE"] Link to this property
Deprecatedexpected\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
class ActionParamsRelease: … type: Literal\["RELEASE"] Link to this property
Link to this property
Link to this property
action\_type: Literal\["MOVE", "RELEASE"] One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: datetime formatdate-time Link to this property job\_id: str formatuuid Link to this property messages\_cancelled: int Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: int Link to this property messages\_pending: int Link to this property messages\_skipped: int Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: int Link to this property
search\_params: SearchParams Deprecatedaction\_log: Optional\[bool] Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id: Optional\[str] Alert ID of the detection to filter by. Link to this property
delivery\_status: Optional\[Literal\["delivered", "moved", "quarantined", 5 more]] Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only: Optional\[bool] Whether to include only detections in search results. Link to this property domain: Optional\[str] Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end: Optional\[datetime] End of search date range. formatdate-time Link to this property exact\_subject: Optional\[str] Match messages whose subject line equals this value exactly. Link to this property
final\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action: Optional\[Literal\["PREVIEW", "QUARANTINE\_RELEASED", "MOVED"]] Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id: Optional\[str] Message-ID header value to filter by. Link to this property metric: Optional\[str] Metric name to filter the search by. Link to this property query: Optional\[str] Space-delimited search term. Case-insensitive. Link to this property recipient: Optional\[str] Match messages whose recipient is this email address or domain. Link to this property sender: Optional\[str] Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip: Optional\[str] Matches messages whose SMTP HELO server IP address equals this value. Link to this property start: Optional\[datetime] Beginning of search date range. formatdate-time Link to this property subject: Optional\[str] Match messages whose subject contains these keywords, in any order. Link to this property submissions: Optional\[bool] Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: Literal\["PENDING", "DISCOVERING", "PROCESSING", 3 more] Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: int Link to this property comment: Optional\[str] Link to this property completed\_at: Optional\[datetime] formatdate-time Link to this property started\_at: Optional\[datetime] formatdate-time Link to this property status\_message: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk.cancel%20%3E%20(model)%20cancel_create_response%20%3E%20(schema)>) #### Email SecurityInvestigateBulkMessages ##### [List messages for a bulk action job](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/bulk/subresources/messages/methods/list) email\_security.investigate.bulk.messages.list(strjob\_id, MessageListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[MessageListResponse]()] GET/accounts/{account\_id}/email-security/investigate/bulk/{job\_id}/messages ##### ModelsExpand Collapse
class MessageListResponse: …
action\_params: ActionParams One of the following:
class ActionParamsMove: … client\_recipient: str Link to this property
destination: Literal\["Inbox", "JunkEmail", "DeletedItems", 2 more] The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: Literal\["MOVE"] Link to this property
Deprecatedexpected\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
class ActionParamsRelease: … client\_recipient: str Link to this property type: Literal\["RELEASE"] Link to this property
Link to this property
Link to this property
action\_type: Literal\["MOVE", "RELEASE"] One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: datetime formatdate-time Link to this property message\_id: str formatuuid Link to this property postfix\_id: str Link to this property retry\_count: int Link to this property
status: Literal\["PENDING", "PROCESSING", "COMPLETED", 3 more] Status of a message within a bulk action job. One of the following: "PENDING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property "SKIPPED" Link to this property
Link to this property alert\_id: Optional\[str] Link to this property email\_message\_id: Optional\[str] Link to this property
message: Optional\[Message] id: str Unique identifier for a message retrieved from investigation. Link to this property
Deprecatedaction\_log: List\[MessageActionLog] Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. completed\_at: datetime Timestamp when action completed. formatdate-time Link to this property
operation: Literal\["MOVE", "RELEASE", "RECLASSIFY", 3 more] Type of action performed. One of the following: "MOVE" Link to this property "RELEASE" Link to this property "RECLASSIFY" Link to this property "SUBMISSION" Link to this property "QUARANTINE\_RELEASE" Link to this property "PREVIEW" Link to this property
Link to this property Deprecatedcompleted\_timestamp: Optional\[str] Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. Link to this property
properties: Optional\[MessageActionLogProperties] Additional properties for the action. folder: Optional\[str] Target folder for move operations. Link to this property requested\_by: Optional\[str] User who requested the action. Link to this property
Link to this property status: Optional\[str] Status of the action. Link to this property
Link to this property client\_recipients: List\[str] Link to this property detection\_reasons: List\[str] Link to this property is\_phish\_submission: bool Link to this property is\_quarantined: bool Link to this property postfix\_id: str The identifier of the message. Link to this property
properties: MessageProperties Message processing properties. allowlisted\_pattern: Optional\[str] Pattern that allowlisted this message. Link to this property
allowlisted\_pattern\_type: Optional\[Literal\["quarantine\_release", "acceptable\_sender", "allowed\_sender", 5 more]] Type of allowlist pattern. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property blocklisted\_message: Optional\[bool] Whether message was blocklisted. Link to this property blocklisted\_pattern: Optional\[str] Pattern that blocklisted this message. Link to this property
whitelisted\_pattern\_type: Optional\[Literal\["quarantine\_release", "acceptable\_sender", "allowed\_sender", 5 more]] Legacy field for allowlist pattern type. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property
Link to this property Deprecatedts: str Use scanned_at instead. Deprecated, use scanned_at instead. End of life: November 1, 2026. Link to this property alert\_id: Optional\[str] Link to this property
delivery\_mode: Optional\[Literal\["DIRECT", "BCC", "JOURNAL", 8 more]] One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "REVIEW\_SUBMISSION" Link to this property "DMARC\_UNVERIFIED" Link to this property "DMARC\_FAILURE\_REPORT" Link to this property "DMARC\_AGGREGATE\_REPORT" Link to this property "THREAT\_INTEL\_SUBMISSION" Link to this property "SIMULATION\_SUBMISSION" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
delivery\_status: Optional\[List\[Literal\["delivered", "moved", "quarantined", 5 more]]] One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property edf\_hash: Optional\[str] Link to this property envelope\_from: Optional\[str] Link to this property envelope\_to: Optional\[List\[str]] Link to this property
final\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Deprecatedfindings: Optional\[List\[MessageFinding]] Use the findings field from GET /investigate/{investigate\_id}/detections instead. Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message. attachment: Optional\[str] Link to this property detail: Optional\[str] Link to this property
detection: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field: Optional\[str] Link to this property name: Optional\[str] Link to this property portion: Optional\[str] Link to this property reason: Optional\[str] Link to this property score: Optional\[float] formatdouble Link to this property value: Optional\[str] Link to this property
Link to this property from\_: Optional\[str] Link to this property from\_name: Optional\[str] Link to this property htmltext\_structure\_hash: Optional\[str] Link to this property message\_id: Optional\[str] Link to this property
post\_delivery\_operations: Optional\[List\[Literal\["PREVIEW", "QUARANTINE\_RELEASE", "SUBMISSION", "MOVE"]]] Post-delivery operations performed on this message. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASE" Link to this property "SUBMISSION" Link to this property "MOVE" Link to this property
Link to this property postfix\_id\_outbound: Optional\[str] Link to this property replyto: Optional\[str] Link to this property scanned\_at: Optional\[datetime] When the message was scanned (UTC). formatdate-time Link to this property sent\_at: Optional\[datetime] When the message was sent (UTC). formatdate-time Link to this property sent\_date: Optional\[str] Link to this property smtp\_helo\_server\_ip: Optional\[str] Link to this property smtp\_previous\_hop\_ip: Optional\[str] Link to this property subject: Optional\[str] Link to this property threat\_categories: Optional\[List\[str]] Link to this property to: Optional\[List\[str]] Link to this property to\_name: Optional\[List\[str]] Link to this property
validation: Optional\[MessageValidation] comment: Optional\[str] Link to this property
dkim: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property x\_originating\_ip: Optional\[str] Link to this property
Link to this property processed\_at: Optional\[datetime] formatdate-time Link to this property retry\_after: Optional\[datetime] When to retry the action if it failed. formatdate-time Link to this property status\_message: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk.messages%20%3E%20(model)%20message_list_response%20%3E%20(schema)>) #### Email SecurityPhishguard #### Email SecurityPhishguardReports ##### [List PhishGuard reports](https://developers.cloudflare.com/api/python/resources/email_security/subresources/phishguard/subresources/reports/methods/list) email\_security.phishguard.reports.list(ReportListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[ReportListResponse]()] GET/accounts/{account\_id}/email-security/phishguard/reports ##### ModelsExpand Collapse
class ReportListResponse: … id: int Link to this property content: str Link to this property
disposition: Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more] The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
fields: Fields to: List\[str] Link to this property from\_: Optional\[str] Link to this property occurred\_at: Optional\[datetime] formatdate-time Link to this property postfix\_id: Optional\[str] Link to this property Deprecatedts: Optional\[datetime] Use occurred_at instead. Deprecated, use occurred_at instead. formatdate-time Link to this property
Link to this property priority: str Link to this property title: str Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property
tags: Optional\[List\[Tag]] category: str Link to this property value: str Link to this property
Link to this property Deprecatedts: Optional\[datetime] Use created_at instead. Deprecated, use created_at instead. formatdate-time Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.phishguard.reports%20%3E%20(model)%20report_list_response%20%3E%20(schema)>) #### Email SecuritySettings #### Email SecuritySettingsAllow Policies ##### [List email allow policies](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/allow_policies/methods/list) email\_security.settings.allow\_policies.list(AllowPolicyListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[AllowPolicyListResponse]()] GET/accounts/{account\_id}/email-security/settings/allow\_policies ##### [Get an email allow policy](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/allow_policies/methods/get) email\_security.settings.allow\_policies.get(strpolicy\_id, AllowPolicyGetParams\*\*kwargs) -> [AllowPolicyGetResponse]() GET/accounts/{account\_id}/email-security/settings/allow\_policies/{policy\_id} ##### [Create email allow policy](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/allow_policies/methods/create) email\_security.settings.allow\_policies.create(AllowPolicyCreateParams\*\*kwargs) -> [AllowPolicyCreateResponse]() POST/accounts/{account\_id}/email-security/settings/allow\_policies ##### [Update an email allow policy](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/allow_policies/methods/edit) email\_security.settings.allow\_policies.edit(strpolicy\_id, AllowPolicyEditParams\*\*kwargs) -> [AllowPolicyEditResponse]() PATCH/accounts/{account\_id}/email-security/settings/allow\_policies/{policy\_id} ##### [Delete an email allow policy](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/allow_policies/methods/delete) email\_security.settings.allow\_policies.delete(strpolicy\_id, AllowPolicyDeleteParams\*\*kwargs) -> [AllowPolicyDeleteResponse]() DELETE/accounts/{account\_id}/email-security/settings/allow\_policies/{policy\_id} ##### [Batch allow policy operations](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/allow_policies/methods/batch) email\_security.settings.allow\_policies.batch(AllowPolicyBatchParams\*\*kwargs) -> [AllowPolicyBatchResponse]() POST/accounts/{account\_id}/email-security/settings/allow\_policies/batch ##### ModelsExpand Collapse
class AllowPolicyListResponse: … An email allow policy. id: str Allow policy identifier. formatuuid Link to this property created\_at: datetime formatdate-time Link to this property Deprecatedlast\_modified: datetime Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments: Optional\[str] maxLength1024 Link to this property is\_acceptable\_sender: Optional\[bool] Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient: Optional\[bool] Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient: Optional\[bool] Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex: Optional\[bool] Link to this property Deprecatedis\_sender: Optional\[bool] Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof: Optional\[bool] Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender: Optional\[bool] Bypasses all detections and link following for messages from this sender. Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: Optional\[Literal\["EMAIL", "DOMAIN", "IP", "UNKNOWN"]] Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender: Optional\[bool] Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_list_response%20%3E%20(schema)>)
class AllowPolicyGetResponse: … An email allow policy. id: str Allow policy identifier. formatuuid Link to this property created\_at: datetime formatdate-time Link to this property Deprecatedlast\_modified: datetime Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments: Optional\[str] maxLength1024 Link to this property is\_acceptable\_sender: Optional\[bool] Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient: Optional\[bool] Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient: Optional\[bool] Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex: Optional\[bool] Link to this property Deprecatedis\_sender: Optional\[bool] Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof: Optional\[bool] Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender: Optional\[bool] Bypasses all detections and link following for messages from this sender. Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: Optional\[Literal\["EMAIL", "DOMAIN", "IP", "UNKNOWN"]] Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender: Optional\[bool] Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_get_response%20%3E%20(schema)>)
class AllowPolicyCreateResponse: … An email allow policy. id: str Allow policy identifier. formatuuid Link to this property created\_at: datetime formatdate-time Link to this property Deprecatedlast\_modified: datetime Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments: Optional\[str] maxLength1024 Link to this property is\_acceptable\_sender: Optional\[bool] Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient: Optional\[bool] Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient: Optional\[bool] Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex: Optional\[bool] Link to this property Deprecatedis\_sender: Optional\[bool] Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof: Optional\[bool] Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender: Optional\[bool] Bypasses all detections and link following for messages from this sender. Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: Optional\[Literal\["EMAIL", "DOMAIN", "IP", "UNKNOWN"]] Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender: Optional\[bool] Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_create_response%20%3E%20(schema)>)
class AllowPolicyEditResponse: … An email allow policy. id: str Allow policy identifier. formatuuid Link to this property created\_at: datetime formatdate-time Link to this property Deprecatedlast\_modified: datetime Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments: Optional\[str] maxLength1024 Link to this property is\_acceptable\_sender: Optional\[bool] Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient: Optional\[bool] Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient: Optional\[bool] Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex: Optional\[bool] Link to this property Deprecatedis\_sender: Optional\[bool] Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof: Optional\[bool] Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender: Optional\[bool] Bypasses all detections and link following for messages from this sender. Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: Optional\[Literal\["EMAIL", "DOMAIN", "IP", "UNKNOWN"]] Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender: Optional\[bool] Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_edit_response%20%3E%20(schema)>)
class AllowPolicyDeleteResponse: … id: str Allow policy identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_delete_response%20%3E%20(schema)>)
class AllowPolicyBatchResponse: …
deletes: Optional\[List\[Delete]] id: str Allow policy identifier. formatuuid Link to this property
Link to this property
patches: Optional\[List\[Patch]] id: str Allow policy identifier. formatuuid Link to this property created\_at: datetime formatdate-time Link to this property Deprecatedlast\_modified: datetime Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments: Optional\[str] maxLength1024 Link to this property is\_acceptable\_sender: Optional\[bool] Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient: Optional\[bool] Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient: Optional\[bool] Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex: Optional\[bool] Link to this property Deprecatedis\_sender: Optional\[bool] Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof: Optional\[bool] Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender: Optional\[bool] Bypasses all detections and link following for messages from this sender. Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: Optional\[Literal\["EMAIL", "DOMAIN", "IP", "UNKNOWN"]] Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender: Optional\[bool] Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
Link to this property
posts: Optional\[List\[Post]] id: str Allow policy identifier. formatuuid Link to this property created\_at: datetime formatdate-time Link to this property Deprecatedlast\_modified: datetime Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments: Optional\[str] maxLength1024 Link to this property is\_acceptable\_sender: Optional\[bool] Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient: Optional\[bool] Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient: Optional\[bool] Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex: Optional\[bool] Link to this property Deprecatedis\_sender: Optional\[bool] Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof: Optional\[bool] Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender: Optional\[bool] Bypasses all detections and link following for messages from this sender. Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: Optional\[Literal\["EMAIL", "DOMAIN", "IP", "UNKNOWN"]] Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender: Optional\[bool] Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
Link to this property
puts: Optional\[List\[Put]] id: str Allow policy identifier. formatuuid Link to this property created\_at: datetime formatdate-time Link to this property Deprecatedlast\_modified: datetime Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments: Optional\[str] maxLength1024 Link to this property is\_acceptable\_sender: Optional\[bool] Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient: Optional\[bool] Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient: Optional\[bool] Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex: Optional\[bool] Link to this property Deprecatedis\_sender: Optional\[bool] Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof: Optional\[bool] Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender: Optional\[bool] Bypasses all detections and link following for messages from this sender. Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: Optional\[Literal\["EMAIL", "DOMAIN", "IP", "UNKNOWN"]] Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender: Optional\[bool] Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_batch_response%20%3E%20(schema)>) #### Email SecuritySettingsBlock Senders ##### [List blocked email senders](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/block_senders/methods/list) email\_security.settings.block\_senders.list(BlockSenderListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[BlockSenderListResponse]()] GET/accounts/{account\_id}/email-security/settings/block\_senders ##### [Get a blocked email sender](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/block_senders/methods/get) email\_security.settings.block\_senders.get(strpattern\_id, BlockSenderGetParams\*\*kwargs) -> [BlockSenderGetResponse]() GET/accounts/{account\_id}/email-security/settings/block\_senders/{pattern\_id} ##### [Create blocked email sender](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/block_senders/methods/create) email\_security.settings.block\_senders.create(BlockSenderCreateParams\*\*kwargs) -> [BlockSenderCreateResponse]() POST/accounts/{account\_id}/email-security/settings/block\_senders ##### [Update a blocked email sender](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/block_senders/methods/edit) email\_security.settings.block\_senders.edit(strpattern\_id, BlockSenderEditParams\*\*kwargs) -> [BlockSenderEditResponse]() PATCH/accounts/{account\_id}/email-security/settings/block\_senders/{pattern\_id} ##### [Delete a blocked email sender](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/block_senders/methods/delete) email\_security.settings.block\_senders.delete(strpattern\_id, BlockSenderDeleteParams\*\*kwargs) -> [BlockSenderDeleteResponse]() DELETE/accounts/{account\_id}/email-security/settings/block\_senders/{pattern\_id} ##### [Batch blocked sender operations](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/block_senders/methods/batch) email\_security.settings.block\_senders.batch(BlockSenderBatchParams\*\*kwargs) -> [BlockSenderBatchResponse]() POST/accounts/{account\_id}/email-security/settings/block\_senders/batch ##### ModelsExpand Collapse
class BlockSenderListResponse: … A blocked sender pattern. id: Optional\[str] Blocked sender pattern identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property is\_regex: Optional\[bool] Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: Optional\[Literal\["EMAIL", "DOMAIN", "IP", "UNKNOWN"]] Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_list_response%20%3E%20(schema)>)
class BlockSenderGetResponse: … A blocked sender pattern. id: Optional\[str] Blocked sender pattern identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property is\_regex: Optional\[bool] Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: Optional\[Literal\["EMAIL", "DOMAIN", "IP", "UNKNOWN"]] Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_get_response%20%3E%20(schema)>)
class BlockSenderCreateResponse: … A blocked sender pattern. id: Optional\[str] Blocked sender pattern identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property is\_regex: Optional\[bool] Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: Optional\[Literal\["EMAIL", "DOMAIN", "IP", "UNKNOWN"]] Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_create_response%20%3E%20(schema)>)
class BlockSenderEditResponse: … A blocked sender pattern. id: Optional\[str] Blocked sender pattern identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property is\_regex: Optional\[bool] Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: Optional\[Literal\["EMAIL", "DOMAIN", "IP", "UNKNOWN"]] Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_edit_response%20%3E%20(schema)>)
class BlockSenderDeleteResponse: … id: str Blocked sender pattern identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_delete_response%20%3E%20(schema)>)
class BlockSenderBatchResponse: …
deletes: Optional\[List\[Delete]] id: str Blocked sender pattern identifier. formatuuid Link to this property
Link to this property
patches: Optional\[List\[Patch]] id: Optional\[str] Blocked sender pattern identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property is\_regex: Optional\[bool] Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: Optional\[Literal\["EMAIL", "DOMAIN", "IP", "UNKNOWN"]] Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
Link to this property
posts: Optional\[List\[Post]] id: Optional\[str] Blocked sender pattern identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property is\_regex: Optional\[bool] Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: Optional\[Literal\["EMAIL", "DOMAIN", "IP", "UNKNOWN"]] Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
Link to this property
puts: Optional\[List\[Put]] id: Optional\[str] Blocked sender pattern identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property is\_regex: Optional\[bool] Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: Optional\[Literal\["EMAIL", "DOMAIN", "IP", "UNKNOWN"]] Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_batch_response%20%3E%20(schema)>) #### Email SecuritySettingsContent Policies ##### [List content policies](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/content_policies/methods/list) email\_security.settings.content\_policies.list(ContentPolicyListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[ContentPolicyListResponse]()] GET/accounts/{account\_id}/email-security/settings/content\_policies ##### [Get a content policy](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/content_policies/methods/get) email\_security.settings.content\_policies.get(strpolicy\_id, ContentPolicyGetParams\*\*kwargs) -> [ContentPolicyGetResponse]() GET/accounts/{account\_id}/email-security/settings/content\_policies/{policy\_id} ##### [Create a content policy](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/content_policies/methods/create) email\_security.settings.content\_policies.create(ContentPolicyCreateParams\*\*kwargs) -> [ContentPolicyCreateResponse]() POST/accounts/{account\_id}/email-security/settings/content\_policies ##### [Update a content policy](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/content_policies/methods/edit) email\_security.settings.content\_policies.edit(strpolicy\_id, ContentPolicyEditParams\*\*kwargs) -> [ContentPolicyEditResponse]() PATCH/accounts/{account\_id}/email-security/settings/content\_policies/{policy\_id} ##### [Delete a content policy](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/content_policies/methods/delete) email\_security.settings.content\_policies.delete(strpolicy\_id, ContentPolicyDeleteParams\*\*kwargs) -> [ContentPolicyDeleteResponse]() DELETE/accounts/{account\_id}/email-security/settings/content\_policies/{policy\_id} ##### [Batch content policy operations](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/content_policies/methods/batch) email\_security.settings.content\_policies.batch(ContentPolicyBatchParams\*\*kwargs) -> [ContentPolicyBatchResponse]() POST/accounts/{account\_id}/email-security/settings/content\_policies/batch ##### ModelsExpand Collapse
class ContentPolicyListResponse: … A content policy pattern that matches against the subject or body of an email. id: Optional\[str] Content policy identifier. formatuuid Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property enabled: Optional\[bool] Whether the policy is active. Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property name: Optional\[str] Human-readable name of the policy. maxLength256 minLength1 Link to this property notes: Optional\[str] Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern: Optional\[str] Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets: Optional\[List\[Literal\["SUBJECT", "BODY"]]] Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_list_response%20%3E%20(schema)>)
class ContentPolicyGetResponse: … A content policy pattern that matches against the subject or body of an email. id: Optional\[str] Content policy identifier. formatuuid Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property enabled: Optional\[bool] Whether the policy is active. Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property name: Optional\[str] Human-readable name of the policy. maxLength256 minLength1 Link to this property notes: Optional\[str] Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern: Optional\[str] Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets: Optional\[List\[Literal\["SUBJECT", "BODY"]]] Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_get_response%20%3E%20(schema)>)
class ContentPolicyCreateResponse: … A content policy pattern that matches against the subject or body of an email. id: Optional\[str] Content policy identifier. formatuuid Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property enabled: Optional\[bool] Whether the policy is active. Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property name: Optional\[str] Human-readable name of the policy. maxLength256 minLength1 Link to this property notes: Optional\[str] Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern: Optional\[str] Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets: Optional\[List\[Literal\["SUBJECT", "BODY"]]] Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_create_response%20%3E%20(schema)>)
class ContentPolicyEditResponse: … A content policy pattern that matches against the subject or body of an email. id: Optional\[str] Content policy identifier. formatuuid Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property enabled: Optional\[bool] Whether the policy is active. Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property name: Optional\[str] Human-readable name of the policy. maxLength256 minLength1 Link to this property notes: Optional\[str] Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern: Optional\[str] Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets: Optional\[List\[Literal\["SUBJECT", "BODY"]]] Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_edit_response%20%3E%20(schema)>)
class ContentPolicyDeleteResponse: … id: str Content policy identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_delete_response%20%3E%20(schema)>)
class ContentPolicyBatchResponse: …
deletes: Optional\[List\[Delete]] id: str Content policy identifier. formatuuid Link to this property
Link to this property
patches: Optional\[List\[Patch]] id: Optional\[str] Content policy identifier. formatuuid Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property enabled: Optional\[bool] Whether the policy is active. Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property name: Optional\[str] Human-readable name of the policy. maxLength256 minLength1 Link to this property notes: Optional\[str] Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern: Optional\[str] Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets: Optional\[List\[Literal\["SUBJECT", "BODY"]]] Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
Link to this property
posts: Optional\[List\[Post]] id: Optional\[str] Content policy identifier. formatuuid Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property enabled: Optional\[bool] Whether the policy is active. Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property name: Optional\[str] Human-readable name of the policy. maxLength256 minLength1 Link to this property notes: Optional\[str] Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern: Optional\[str] Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets: Optional\[List\[Literal\["SUBJECT", "BODY"]]] Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
Link to this property
puts: Optional\[List\[Put]] id: Optional\[str] Content policy identifier. formatuuid Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property enabled: Optional\[bool] Whether the policy is active. Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property name: Optional\[str] Human-readable name of the policy. maxLength256 minLength1 Link to this property notes: Optional\[str] Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern: Optional\[str] Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets: Optional\[List\[Literal\["SUBJECT", "BODY"]]] Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_batch_response%20%3E%20(schema)>) #### Email SecuritySettingsDomains ##### [List protected email domains](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/domains/methods/list) email\_security.settings.domains.list(DomainListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[DomainListResponse]()] GET/accounts/{account\_id}/email-security/settings/domains ##### [Get an email domain](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/domains/methods/get) email\_security.settings.domains.get(strdomain\_id, DomainGetParams\*\*kwargs) -> [DomainGetResponse]() GET/accounts/{account\_id}/email-security/settings/domains/{domain\_id} ##### [Replace an email domain](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/domains/methods/update) email\_security.settings.domains.update(strdomain\_id, DomainUpdateParams\*\*kwargs) -> [DomainUpdateResponse]() PUT/accounts/{account\_id}/email-security/settings/domains/{domain\_id} ##### [Update an email domain](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/domains/methods/edit) email\_security.settings.domains.edit(strdomain\_id, DomainEditParams\*\*kwargs) -> [DomainEditResponse]() PATCH/accounts/{account\_id}/email-security/settings/domains/{domain\_id} ##### [Add a new email domain](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/domains/methods/create) email\_security.settings.domains.create(DomainCreateParams\*\*kwargs) -> [DomainCreateResponse]() POST/accounts/{account\_id}/email-security/settings/domains ##### [Unprotect an email domain](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/domains/methods/delete) email\_security.settings.domains.delete(strdomain\_id, DomainDeleteParams\*\*kwargs) -> [DomainDeleteResponse]() DELETE/accounts/{account\_id}/email-security/settings/domains/{domain\_id} ##### [Batch domain operations](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/domains/methods/batch) email\_security.settings.domains.batch(DomainBatchParams\*\*kwargs) -> [DomainBatchResponse]() POST/accounts/{account\_id}/email-security/settings/domains/batch ##### [Unprotect multiple email domains](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/domains/methods/bulk_delete) Deprecated email\_security.settings.domains.bulk\_delete(DomainBulkDeleteParams\*\*kwargs) -> SyncSinglePage\[[DomainBulkDeleteResponse]()] DELETE/accounts/{account\_id}/email-security/settings/domains ##### ModelsExpand Collapse
class DomainListResponse: … id: Optional\[str] Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes: Optional\[List\[Literal\["DIRECT", "BCC", "JOURNAL", 2 more]]] One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization: Optional\[Authorization] authorized: bool Link to this property timestamp: datetime formatdate-time Link to this property status\_message: Optional\[str] Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property
dmarc\_status: Optional\[Literal\["none", "good", "invalid"]] One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain: Optional\[str] Link to this property
drop\_dispositions: Optional\[List\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]] One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed: Optional\[EmailsProcessed] timestamp: datetime formatdate-time Link to this property total\_emails\_processed: int minimum0 Link to this property total\_emails\_processed\_previous: int minimum0 Link to this property
Link to this property
folder: Optional\[Literal\["AllItems", "Inbox"]] The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider: Optional\[Literal\["Microsoft", "Google"]] One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id: Optional\[str] formatuuid Link to this property ip\_restrictions: Optional\[List\[str]] Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops: Optional\[int] Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property o365\_tenant\_id: Optional\[str] Link to this property
regions: Optional\[List\[Literal\["GLOBAL", "AU", "DE", 2 more]]] One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound: Optional\[bool] Link to this property require\_tls\_outbound: Optional\[bool] Link to this property
spf\_status: Optional\[Literal\["none", "good", "neutral", 2 more]] One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status: Optional\[Literal\["PENDING", "ACTIVE", "FAILED", "TIMEOUT"]] One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_list_response%20%3E%20(schema)>)
class DomainGetResponse: … id: Optional\[str] Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes: Optional\[List\[Literal\["DIRECT", "BCC", "JOURNAL", 2 more]]] One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization: Optional\[Authorization] authorized: bool Link to this property timestamp: datetime formatdate-time Link to this property status\_message: Optional\[str] Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property
dmarc\_status: Optional\[Literal\["none", "good", "invalid"]] One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain: Optional\[str] Link to this property
drop\_dispositions: Optional\[List\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]] One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed: Optional\[EmailsProcessed] timestamp: datetime formatdate-time Link to this property total\_emails\_processed: int minimum0 Link to this property total\_emails\_processed\_previous: int minimum0 Link to this property
Link to this property
folder: Optional\[Literal\["AllItems", "Inbox"]] The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider: Optional\[Literal\["Microsoft", "Google"]] One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id: Optional\[str] formatuuid Link to this property ip\_restrictions: Optional\[List\[str]] Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops: Optional\[int] Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property o365\_tenant\_id: Optional\[str] Link to this property
regions: Optional\[List\[Literal\["GLOBAL", "AU", "DE", 2 more]]] One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound: Optional\[bool] Link to this property require\_tls\_outbound: Optional\[bool] Link to this property
spf\_status: Optional\[Literal\["none", "good", "neutral", 2 more]] One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status: Optional\[Literal\["PENDING", "ACTIVE", "FAILED", "TIMEOUT"]] One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_get_response%20%3E%20(schema)>)
class DomainUpdateResponse: … id: Optional\[str] Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes: Optional\[List\[Literal\["DIRECT", "BCC", "JOURNAL", 2 more]]] One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization: Optional\[Authorization] authorized: bool Link to this property timestamp: datetime formatdate-time Link to this property status\_message: Optional\[str] Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property
dmarc\_status: Optional\[Literal\["none", "good", "invalid"]] One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain: Optional\[str] Link to this property
drop\_dispositions: Optional\[List\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]] One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed: Optional\[EmailsProcessed] timestamp: datetime formatdate-time Link to this property total\_emails\_processed: int minimum0 Link to this property total\_emails\_processed\_previous: int minimum0 Link to this property
Link to this property
folder: Optional\[Literal\["AllItems", "Inbox"]] The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider: Optional\[Literal\["Microsoft", "Google"]] One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id: Optional\[str] formatuuid Link to this property ip\_restrictions: Optional\[List\[str]] Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops: Optional\[int] Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property o365\_tenant\_id: Optional\[str] Link to this property
regions: Optional\[List\[Literal\["GLOBAL", "AU", "DE", 2 more]]] One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound: Optional\[bool] Link to this property require\_tls\_outbound: Optional\[bool] Link to this property
spf\_status: Optional\[Literal\["none", "good", "neutral", 2 more]] One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status: Optional\[Literal\["PENDING", "ACTIVE", "FAILED", "TIMEOUT"]] One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_update_response%20%3E%20(schema)>)
class DomainEditResponse: … id: Optional\[str] Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes: Optional\[List\[Literal\["DIRECT", "BCC", "JOURNAL", 2 more]]] One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization: Optional\[Authorization] authorized: bool Link to this property timestamp: datetime formatdate-time Link to this property status\_message: Optional\[str] Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property
dmarc\_status: Optional\[Literal\["none", "good", "invalid"]] One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain: Optional\[str] Link to this property
drop\_dispositions: Optional\[List\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]] One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed: Optional\[EmailsProcessed] timestamp: datetime formatdate-time Link to this property total\_emails\_processed: int minimum0 Link to this property total\_emails\_processed\_previous: int minimum0 Link to this property
Link to this property
folder: Optional\[Literal\["AllItems", "Inbox"]] The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider: Optional\[Literal\["Microsoft", "Google"]] One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id: Optional\[str] formatuuid Link to this property ip\_restrictions: Optional\[List\[str]] Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops: Optional\[int] Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property o365\_tenant\_id: Optional\[str] Link to this property
regions: Optional\[List\[Literal\["GLOBAL", "AU", "DE", 2 more]]] One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound: Optional\[bool] Link to this property require\_tls\_outbound: Optional\[bool] Link to this property
spf\_status: Optional\[Literal\["none", "good", "neutral", 2 more]] One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status: Optional\[Literal\["PENDING", "ACTIVE", "FAILED", "TIMEOUT"]] One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_edit_response%20%3E%20(schema)>)
class DomainCreateResponse: … id: Optional\[str] Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes: Optional\[List\[Literal\["DIRECT", "BCC", "JOURNAL", 2 more]]] One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization: Optional\[Authorization] authorized: bool Link to this property timestamp: datetime formatdate-time Link to this property status\_message: Optional\[str] Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property
dmarc\_status: Optional\[Literal\["none", "good", "invalid"]] One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain: Optional\[str] Link to this property
drop\_dispositions: Optional\[List\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]] One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed: Optional\[EmailsProcessed] timestamp: datetime formatdate-time Link to this property total\_emails\_processed: int minimum0 Link to this property total\_emails\_processed\_previous: int minimum0 Link to this property
Link to this property
folder: Optional\[Literal\["AllItems", "Inbox"]] The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider: Optional\[Literal\["Microsoft", "Google"]] One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id: Optional\[str] formatuuid Link to this property ip\_restrictions: Optional\[List\[str]] Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops: Optional\[int] Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property o365\_tenant\_id: Optional\[str] Link to this property
regions: Optional\[List\[Literal\["GLOBAL", "AU", "DE", 2 more]]] One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound: Optional\[bool] Link to this property require\_tls\_outbound: Optional\[bool] Link to this property
spf\_status: Optional\[Literal\["none", "good", "neutral", 2 more]] One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status: Optional\[Literal\["PENDING", "ACTIVE", "FAILED", "TIMEOUT"]] One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_create_response%20%3E%20(schema)>)
class DomainDeleteResponse: … id: str Domain identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_delete_response%20%3E%20(schema)>)
class DomainBatchResponse: …
deletes: List\[Delete] id: str Domain identifier. formatuuid Link to this property
Link to this property
patches: List\[Patch] id: Optional\[str] Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes: Optional\[List\[Literal\["DIRECT", "BCC", "JOURNAL", 2 more]]] One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization: Optional\[PatchAuthorization] authorized: bool Link to this property timestamp: datetime formatdate-time Link to this property status\_message: Optional\[str] Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property
dmarc\_status: Optional\[Literal\["none", "good", "invalid"]] One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain: Optional\[str] Link to this property
drop\_dispositions: Optional\[List\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]] One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed: Optional\[PatchEmailsProcessed] timestamp: datetime formatdate-time Link to this property total\_emails\_processed: int minimum0 Link to this property total\_emails\_processed\_previous: int minimum0 Link to this property
Link to this property
folder: Optional\[Literal\["AllItems", "Inbox"]] The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider: Optional\[Literal\["Microsoft", "Google"]] One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id: Optional\[str] formatuuid Link to this property ip\_restrictions: Optional\[List\[str]] Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops: Optional\[int] Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property o365\_tenant\_id: Optional\[str] Link to this property
regions: Optional\[List\[Literal\["GLOBAL", "AU", "DE", 2 more]]] One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound: Optional\[bool] Link to this property require\_tls\_outbound: Optional\[bool] Link to this property
spf\_status: Optional\[Literal\["none", "good", "neutral", 2 more]] One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status: Optional\[Literal\["PENDING", "ACTIVE", "FAILED", "TIMEOUT"]] One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport: Optional\[str] Link to this property
Link to this property
posts: List\[Post] id: Optional\[str] Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes: Optional\[List\[Literal\["DIRECT", "BCC", "JOURNAL", 2 more]]] One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization: Optional\[PostAuthorization] authorized: bool Link to this property timestamp: datetime formatdate-time Link to this property status\_message: Optional\[str] Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property
dmarc\_status: Optional\[Literal\["none", "good", "invalid"]] One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain: Optional\[str] Link to this property
drop\_dispositions: Optional\[List\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]] One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed: Optional\[PostEmailsProcessed] timestamp: datetime formatdate-time Link to this property total\_emails\_processed: int minimum0 Link to this property total\_emails\_processed\_previous: int minimum0 Link to this property
Link to this property
folder: Optional\[Literal\["AllItems", "Inbox"]] The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider: Optional\[Literal\["Microsoft", "Google"]] One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id: Optional\[str] formatuuid Link to this property ip\_restrictions: Optional\[List\[str]] Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops: Optional\[int] Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property o365\_tenant\_id: Optional\[str] Link to this property
regions: Optional\[List\[Literal\["GLOBAL", "AU", "DE", 2 more]]] One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound: Optional\[bool] Link to this property require\_tls\_outbound: Optional\[bool] Link to this property
spf\_status: Optional\[Literal\["none", "good", "neutral", 2 more]] One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status: Optional\[Literal\["PENDING", "ACTIVE", "FAILED", "TIMEOUT"]] One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport: Optional\[str] Link to this property
Link to this property
puts: List\[Put] id: Optional\[str] Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes: Optional\[List\[Literal\["DIRECT", "BCC", "JOURNAL", 2 more]]] One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization: Optional\[PutAuthorization] authorized: bool Link to this property timestamp: datetime formatdate-time Link to this property status\_message: Optional\[str] Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property
dmarc\_status: Optional\[Literal\["none", "good", "invalid"]] One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain: Optional\[str] Link to this property
drop\_dispositions: Optional\[List\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]] One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed: Optional\[PutEmailsProcessed] timestamp: datetime formatdate-time Link to this property total\_emails\_processed: int minimum0 Link to this property total\_emails\_processed\_previous: int minimum0 Link to this property
Link to this property
folder: Optional\[Literal\["AllItems", "Inbox"]] The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider: Optional\[Literal\["Microsoft", "Google"]] One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id: Optional\[str] formatuuid Link to this property ip\_restrictions: Optional\[List\[str]] Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops: Optional\[int] Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property o365\_tenant\_id: Optional\[str] Link to this property
regions: Optional\[List\[Literal\["GLOBAL", "AU", "DE", 2 more]]] One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound: Optional\[bool] Link to this property require\_tls\_outbound: Optional\[bool] Link to this property
spf\_status: Optional\[Literal\["none", "good", "neutral", 2 more]] One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status: Optional\[Literal\["PENDING", "ACTIVE", "FAILED", "TIMEOUT"]] One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport: Optional\[str] Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_batch_response%20%3E%20(schema)>)
class DomainBulkDeleteResponse: … id: str Domain identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_bulk_delete_response%20%3E%20(schema)>) #### Email SecuritySettingsImpersonation Registry ##### [List impersonation registry entries](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/impersonation_registry/methods/list) email\_security.settings.impersonation\_registry.list(ImpersonationRegistryListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[ImpersonationRegistryListResponse]()] GET/accounts/{account\_id}/email-security/settings/impersonation\_registry ##### [Get an impersonation registry entry](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/impersonation_registry/methods/get) email\_security.settings.impersonation\_registry.get(strimpersonation\_registry\_id, ImpersonationRegistryGetParams\*\*kwargs) -> [ImpersonationRegistryGetResponse]() GET/accounts/{account\_id}/email-security/settings/impersonation\_registry/{impersonation\_registry\_id} ##### [Create impersonation registry entry](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/impersonation_registry/methods/create) email\_security.settings.impersonation\_registry.create(ImpersonationRegistryCreateParams\*\*kwargs) -> [ImpersonationRegistryCreateResponse]() POST/accounts/{account\_id}/email-security/settings/impersonation\_registry ##### [Update an impersonation registry entry](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/impersonation_registry/methods/edit) email\_security.settings.impersonation\_registry.edit(strimpersonation\_registry\_id, ImpersonationRegistryEditParams\*\*kwargs) -> [ImpersonationRegistryEditResponse]() PATCH/accounts/{account\_id}/email-security/settings/impersonation\_registry/{impersonation\_registry\_id} ##### [Delete an impersonation registry entry](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/impersonation_registry/methods/delete) email\_security.settings.impersonation\_registry.delete(strimpersonation\_registry\_id, ImpersonationRegistryDeleteParams\*\*kwargs) -> [ImpersonationRegistryDeleteResponse]() DELETE/accounts/{account\_id}/email-security/settings/impersonation\_registry/{impersonation\_registry\_id} ##### ModelsExpand Collapse
class ImpersonationRegistryListResponse: … An impersonation registry entry. id: Optional\[str] Impersonation registry entry identifier. formatuuid Link to this property comments: Optional\[str] Optional note describing the entry. Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property directory\_id: Optional\[int] Identifier of the directory the entry was synced from, when directory-synced. Link to this property directory\_node\_id: Optional\[int] Identifier of the directory node the entry was synced from, when directory-synced. Link to this property email: Optional\[str] Email address (or pattern) of the protected identity. Link to this property Deprecatedexternal\_directory\_node\_id: Optional\[str] This field is deprecated. Deprecated. External identifier of the directory node. Link to this property is\_email\_regex: Optional\[bool] Whether email is a regular expression instead of a literal address. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property name: Optional\[str] Display name of the protected identity. maxLength1024 Link to this property
provenance: Optional\[Literal\["A1S\_INTERNAL", "SNOOPY-CASB\_OFFICE\_365", "SNOOPY-OFFICE\_365", "SNOOPY-GOOGLE\_DIRECTORY"]] Source the entry was created from. One of the following: "A1S\_INTERNAL" Link to this property "SNOOPY-CASB\_OFFICE\_365" Link to this property "SNOOPY-OFFICE\_365" Link to this property "SNOOPY-GOOGLE\_DIRECTORY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.impersonation_registry%20%3E%20(model)%20impersonation_registry_list_response%20%3E%20(schema)>)
class ImpersonationRegistryGetResponse: … An impersonation registry entry. id: Optional\[str] Impersonation registry entry identifier. formatuuid Link to this property comments: Optional\[str] Optional note describing the entry. Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property directory\_id: Optional\[int] Identifier of the directory the entry was synced from, when directory-synced. Link to this property directory\_node\_id: Optional\[int] Identifier of the directory node the entry was synced from, when directory-synced. Link to this property email: Optional\[str] Email address (or pattern) of the protected identity. Link to this property Deprecatedexternal\_directory\_node\_id: Optional\[str] This field is deprecated. Deprecated. External identifier of the directory node. Link to this property is\_email\_regex: Optional\[bool] Whether email is a regular expression instead of a literal address. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property name: Optional\[str] Display name of the protected identity. maxLength1024 Link to this property
provenance: Optional\[Literal\["A1S\_INTERNAL", "SNOOPY-CASB\_OFFICE\_365", "SNOOPY-OFFICE\_365", "SNOOPY-GOOGLE\_DIRECTORY"]] Source the entry was created from. One of the following: "A1S\_INTERNAL" Link to this property "SNOOPY-CASB\_OFFICE\_365" Link to this property "SNOOPY-OFFICE\_365" Link to this property "SNOOPY-GOOGLE\_DIRECTORY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.impersonation_registry%20%3E%20(model)%20impersonation_registry_get_response%20%3E%20(schema)>)
class ImpersonationRegistryCreateResponse: … An impersonation registry entry. id: Optional\[str] Impersonation registry entry identifier. formatuuid Link to this property comments: Optional\[str] Optional note describing the entry. Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property directory\_id: Optional\[int] Identifier of the directory the entry was synced from, when directory-synced. Link to this property directory\_node\_id: Optional\[int] Identifier of the directory node the entry was synced from, when directory-synced. Link to this property email: Optional\[str] Email address (or pattern) of the protected identity. Link to this property Deprecatedexternal\_directory\_node\_id: Optional\[str] This field is deprecated. Deprecated. External identifier of the directory node. Link to this property is\_email\_regex: Optional\[bool] Whether email is a regular expression instead of a literal address. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property name: Optional\[str] Display name of the protected identity. maxLength1024 Link to this property
provenance: Optional\[Literal\["A1S\_INTERNAL", "SNOOPY-CASB\_OFFICE\_365", "SNOOPY-OFFICE\_365", "SNOOPY-GOOGLE\_DIRECTORY"]] Source the entry was created from. One of the following: "A1S\_INTERNAL" Link to this property "SNOOPY-CASB\_OFFICE\_365" Link to this property "SNOOPY-OFFICE\_365" Link to this property "SNOOPY-GOOGLE\_DIRECTORY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.impersonation_registry%20%3E%20(model)%20impersonation_registry_create_response%20%3E%20(schema)>)
class ImpersonationRegistryEditResponse: … An impersonation registry entry. id: Optional\[str] Impersonation registry entry identifier. formatuuid Link to this property comments: Optional\[str] Optional note describing the entry. Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property directory\_id: Optional\[int] Identifier of the directory the entry was synced from, when directory-synced. Link to this property directory\_node\_id: Optional\[int] Identifier of the directory node the entry was synced from, when directory-synced. Link to this property email: Optional\[str] Email address (or pattern) of the protected identity. Link to this property Deprecatedexternal\_directory\_node\_id: Optional\[str] This field is deprecated. Deprecated. External identifier of the directory node. Link to this property is\_email\_regex: Optional\[bool] Whether email is a regular expression instead of a literal address. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property name: Optional\[str] Display name of the protected identity. maxLength1024 Link to this property
provenance: Optional\[Literal\["A1S\_INTERNAL", "SNOOPY-CASB\_OFFICE\_365", "SNOOPY-OFFICE\_365", "SNOOPY-GOOGLE\_DIRECTORY"]] Source the entry was created from. One of the following: "A1S\_INTERNAL" Link to this property "SNOOPY-CASB\_OFFICE\_365" Link to this property "SNOOPY-OFFICE\_365" Link to this property "SNOOPY-GOOGLE\_DIRECTORY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.impersonation_registry%20%3E%20(model)%20impersonation_registry_edit_response%20%3E%20(schema)>)
class ImpersonationRegistryDeleteResponse: … id: str Impersonation registry entry identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.impersonation_registry%20%3E%20(model)%20impersonation_registry_delete_response%20%3E%20(schema)>) #### Email SecuritySettingsSending Domain Restrictions ##### [List sending domain restrictions](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/sending_domain_restrictions/methods/list) email\_security.settings.sending\_domain\_restrictions.list(SendingDomainRestrictionListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[SendingDomainRestrictionListResponse]()] GET/accounts/{account\_id}/email-security/settings/sending\_domain\_restrictions ##### [Get a sending domain restriction](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/sending_domain_restrictions/methods/get) email\_security.settings.sending\_domain\_restrictions.get(strsending\_domain\_restriction\_id, SendingDomainRestrictionGetParams\*\*kwargs) -> [SendingDomainRestrictionGetResponse]() GET/accounts/{account\_id}/email-security/settings/sending\_domain\_restrictions/{sending\_domain\_restriction\_id} ##### [Create a sending domain restriction](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/sending_domain_restrictions/methods/create) email\_security.settings.sending\_domain\_restrictions.create(SendingDomainRestrictionCreateParams\*\*kwargs) -> [SendingDomainRestrictionCreateResponse]() POST/accounts/{account\_id}/email-security/settings/sending\_domain\_restrictions ##### [Update a sending domain restriction](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/sending_domain_restrictions/methods/edit) email\_security.settings.sending\_domain\_restrictions.edit(strsending\_domain\_restriction\_id, SendingDomainRestrictionEditParams\*\*kwargs) -> [SendingDomainRestrictionEditResponse]() PATCH/accounts/{account\_id}/email-security/settings/sending\_domain\_restrictions/{sending\_domain\_restriction\_id} ##### [Delete a sending domain restriction](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/sending_domain_restrictions/methods/delete) email\_security.settings.sending\_domain\_restrictions.delete(strsending\_domain\_restriction\_id, SendingDomainRestrictionDeleteParams\*\*kwargs) -> [SendingDomainRestrictionDeleteResponse]() DELETE/accounts/{account\_id}/email-security/settings/sending\_domain\_restrictions/{sending\_domain\_restriction\_id} ##### ModelsExpand Collapse
class SendingDomainRestrictionListResponse: … A sending domain restriction that enforces TLS (Transport Layer Security) requirements for emails from specific domains. If TLS is required, the system drops mail without TLS from the specified domain. id: Optional\[str] Sending domain restriction identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property domain: Optional\[str] Domain that requires TLS enforcement. Link to this property exclude: Optional\[List\[str]] Subdomains to exempt from TLS requirements. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.sending_domain_restrictions%20%3E%20(model)%20sending_domain_restriction_list_response%20%3E%20(schema)>)
class SendingDomainRestrictionGetResponse: … A sending domain restriction that enforces TLS (Transport Layer Security) requirements for emails from specific domains. If TLS is required, the system drops mail without TLS from the specified domain. id: Optional\[str] Sending domain restriction identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property domain: Optional\[str] Domain that requires TLS enforcement. Link to this property exclude: Optional\[List\[str]] Subdomains to exempt from TLS requirements. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.sending_domain_restrictions%20%3E%20(model)%20sending_domain_restriction_get_response%20%3E%20(schema)>)
class SendingDomainRestrictionCreateResponse: … A sending domain restriction that enforces TLS (Transport Layer Security) requirements for emails from specific domains. If TLS is required, the system drops mail without TLS from the specified domain. id: Optional\[str] Sending domain restriction identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property domain: Optional\[str] Domain that requires TLS enforcement. Link to this property exclude: Optional\[List\[str]] Subdomains to exempt from TLS requirements. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.sending_domain_restrictions%20%3E%20(model)%20sending_domain_restriction_create_response%20%3E%20(schema)>)
class SendingDomainRestrictionEditResponse: … A sending domain restriction that enforces TLS (Transport Layer Security) requirements for emails from specific domains. If TLS is required, the system drops mail without TLS from the specified domain. id: Optional\[str] Sending domain restriction identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property domain: Optional\[str] Domain that requires TLS enforcement. Link to this property exclude: Optional\[List\[str]] Subdomains to exempt from TLS requirements. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.sending_domain_restrictions%20%3E%20(model)%20sending_domain_restriction_edit_response%20%3E%20(schema)>)
class SendingDomainRestrictionDeleteResponse: … id: str Sending domain restriction identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.sending_domain_restrictions%20%3E%20(model)%20sending_domain_restriction_delete_response%20%3E%20(schema)>) #### Email SecuritySettingsTrusted Domains ##### [List trusted email domains](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/trusted_domains/methods/list) email\_security.settings.trusted\_domains.list(TrustedDomainListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[TrustedDomainListResponse]()] GET/accounts/{account\_id}/email-security/settings/trusted\_domains ##### [Get a trusted email domain](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/trusted_domains/methods/get) email\_security.settings.trusted\_domains.get(strtrusted\_domain\_id, TrustedDomainGetParams\*\*kwargs) -> [TrustedDomainGetResponse]() GET/accounts/{account\_id}/email-security/settings/trusted\_domains/{trusted\_domain\_id} ##### [Create trusted email domain](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/trusted_domains/methods/create) email\_security.settings.trusted\_domains.create(TrustedDomainCreateParams\*\*kwargs) -> [TrustedDomainCreateResponse]() POST/accounts/{account\_id}/email-security/settings/trusted\_domains ##### [Update a trusted email domain](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/trusted_domains/methods/edit) email\_security.settings.trusted\_domains.edit(strtrusted\_domain\_id, TrustedDomainEditParams\*\*kwargs) -> [TrustedDomainEditResponse]() PATCH/accounts/{account\_id}/email-security/settings/trusted\_domains/{trusted\_domain\_id} ##### [Delete a trusted email domain](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/trusted_domains/methods/delete) email\_security.settings.trusted\_domains.delete(strtrusted\_domain\_id, TrustedDomainDeleteParams\*\*kwargs) -> [TrustedDomainDeleteResponse]() DELETE/accounts/{account\_id}/email-security/settings/trusted\_domains/{trusted\_domain\_id} ##### [Batch trusted domain operations](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/trusted_domains/methods/batch) email\_security.settings.trusted\_domains.batch(TrustedDomainBatchParams\*\*kwargs) -> [TrustedDomainBatchResponse]() POST/accounts/{account\_id}/email-security/settings/trusted\_domains/batch ##### ModelsExpand Collapse
class TrustedDomainListResponse: … A trusted email domain. id: Optional\[str] Trusted domain identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property is\_recent: Optional\[bool] Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex: Optional\[bool] Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity: Optional\[bool] Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_list_response%20%3E%20(schema)>)
class TrustedDomainGetResponse: … A trusted email domain. id: Optional\[str] Trusted domain identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property is\_recent: Optional\[bool] Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex: Optional\[bool] Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity: Optional\[bool] Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_get_response%20%3E%20(schema)>)
class TrustedDomainCreateResponse: … A trusted email domain. id: Optional\[str] Trusted domain identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property is\_recent: Optional\[bool] Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex: Optional\[bool] Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity: Optional\[bool] Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_create_response%20%3E%20(schema)>)
class TrustedDomainEditResponse: … A trusted email domain. id: Optional\[str] Trusted domain identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property is\_recent: Optional\[bool] Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex: Optional\[bool] Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity: Optional\[bool] Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_edit_response%20%3E%20(schema)>)
class TrustedDomainDeleteResponse: … id: str Trusted domain identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_delete_response%20%3E%20(schema)>)
class TrustedDomainBatchResponse: …
deletes: Optional\[List\[Delete]] id: str Trusted domain identifier. formatuuid Link to this property
Link to this property
patches: Optional\[List\[Patch]] id: Optional\[str] Trusted domain identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property is\_recent: Optional\[bool] Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex: Optional\[bool] Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity: Optional\[bool] Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
Link to this property
posts: Optional\[List\[Post]] id: Optional\[str] Trusted domain identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property is\_recent: Optional\[bool] Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex: Optional\[bool] Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity: Optional\[bool] Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
Link to this property
puts: Optional\[List\[Put]] id: Optional\[str] Trusted domain identifier. formatuuid Link to this property comments: Optional\[str] maxLength1024 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property is\_recent: Optional\[bool] Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex: Optional\[bool] Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity: Optional\[bool] Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property pattern: Optional\[str] The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_batch_response%20%3E%20(schema)>) #### Email SecuritySettingsURL Ignore Patterns ##### [List URL ignore patterns](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/url_ignore_patterns/methods/list) email\_security.settings.url\_ignore\_patterns.list(URLIgnorePatternListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[URLIgnorePatternListResponse]()] GET/accounts/{account\_id}/email-security/settings/url\_ignore\_patterns ##### [Get a URL ignore pattern](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/url_ignore_patterns/methods/get) email\_security.settings.url\_ignore\_patterns.get(strpattern\_id, URLIgnorePatternGetParams\*\*kwargs) -> [URLIgnorePatternGetResponse]() GET/accounts/{account\_id}/email-security/settings/url\_ignore\_patterns/{pattern\_id} ##### [Create a URL ignore pattern](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/url_ignore_patterns/methods/create) email\_security.settings.url\_ignore\_patterns.create(URLIgnorePatternCreateParams\*\*kwargs) -> [URLIgnorePatternCreateResponse]() POST/accounts/{account\_id}/email-security/settings/url\_ignore\_patterns ##### [Update a URL ignore pattern](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/url_ignore_patterns/methods/edit) email\_security.settings.url\_ignore\_patterns.edit(strpattern\_id, URLIgnorePatternEditParams\*\*kwargs) -> [URLIgnorePatternEditResponse]() PATCH/accounts/{account\_id}/email-security/settings/url\_ignore\_patterns/{pattern\_id} ##### [Delete a URL ignore pattern](https://developers.cloudflare.com/api/python/resources/email_security/subresources/settings/subresources/url_ignore_patterns/methods/delete) email\_security.settings.url\_ignore\_patterns.delete(strpattern\_id, URLIgnorePatternDeleteParams\*\*kwargs) -> [URLIgnorePatternDeleteResponse]() DELETE/accounts/{account\_id}/email-security/settings/url\_ignore\_patterns/{pattern\_id} ##### ModelsExpand Collapse
class URLIgnorePatternListResponse: … A URL ignore pattern that exempts matching URLs from Email Security’s URL rewriting. id: str URL ignore pattern identifier. formatuuid Link to this property created\_at: datetime formatdate-time Link to this property pattern: str Regular expression identifying URLs to exempt from rewriting. maxLength1024 minLength1 Link to this property comments: Optional\[str] Optional note describing the reason for the ignore pattern. maxLength1024 Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.url_ignore_patterns%20%3E%20(model)%20url_ignore_pattern_list_response%20%3E%20(schema)>)
class URLIgnorePatternGetResponse: … A URL ignore pattern that exempts matching URLs from Email Security’s URL rewriting. id: str URL ignore pattern identifier. formatuuid Link to this property created\_at: datetime formatdate-time Link to this property pattern: str Regular expression identifying URLs to exempt from rewriting. maxLength1024 minLength1 Link to this property comments: Optional\[str] Optional note describing the reason for the ignore pattern. maxLength1024 Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.url_ignore_patterns%20%3E%20(model)%20url_ignore_pattern_get_response%20%3E%20(schema)>)
class URLIgnorePatternCreateResponse: … A URL ignore pattern that exempts matching URLs from Email Security’s URL rewriting. id: str URL ignore pattern identifier. formatuuid Link to this property created\_at: datetime formatdate-time Link to this property pattern: str Regular expression identifying URLs to exempt from rewriting. maxLength1024 minLength1 Link to this property comments: Optional\[str] Optional note describing the reason for the ignore pattern. maxLength1024 Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.url_ignore_patterns%20%3E%20(model)%20url_ignore_pattern_create_response%20%3E%20(schema)>)
class URLIgnorePatternEditResponse: … A URL ignore pattern that exempts matching URLs from Email Security’s URL rewriting. id: str URL ignore pattern identifier. formatuuid Link to this property created\_at: datetime formatdate-time Link to this property pattern: str Regular expression identifying URLs to exempt from rewriting. maxLength1024 minLength1 Link to this property comments: Optional\[str] Optional note describing the reason for the ignore pattern. maxLength1024 Link to this property Deprecatedlast\_modified: Optional\[datetime] Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.url_ignore_patterns%20%3E%20(model)%20url_ignore_pattern_edit_response%20%3E%20(schema)>)
class URLIgnorePatternDeleteResponse: … id: str URL ignore pattern identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.url_ignore_patterns%20%3E%20(model)%20url_ignore_pattern_delete_response%20%3E%20(schema)>) #### Email SecuritySubmissions ##### [List reclassify submissions](https://developers.cloudflare.com/api/python/resources/email_security/subresources/submissions/methods/list) email\_security.submissions.list(SubmissionListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[SubmissionListResponse]()] GET/accounts/{account\_id}/email-security/submissions ##### ModelsExpand Collapse
class SubmissionListResponse: … requested\_at: datetime When the submission was requested (UTC). formatdate-time Link to this property submission\_id: str Link to this property
customer\_status: Optional\[Literal\["escalated", "reviewed", "unreviewed"]] One of the following: "escalated" Link to this property "reviewed" Link to this property "unreviewed" Link to this property
Link to this property
escalated\_as: Optional\[Literal\["MALICIOUS", "SUSPICIOUS", "SPOOF", 3 more]] The disposition a message is submitted to have. One of the following: "MALICIOUS" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "NONE" Link to this property
Link to this property escalated\_at: Optional\[datetime] When the submission was escalated to the security team. formatdate-time Link to this property escalated\_by: Optional\[str] Email address of the user who escalated the submission. Link to this property escalated\_submission\_id: Optional\[str] Submission ID of the escalated team submission, when this user submission was escalated. Link to this property
original\_disposition: Optional\[Literal\["MALICIOUS", "SUSPICIOUS", "SPOOF", 3 more]] The disposition a message is submitted to have. One of the following: "MALICIOUS" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "NONE" Link to this property
Link to this property original\_edf\_hash: Optional\[str] EDF hash of the original message. Link to this property original\_postfix\_id: Optional\[str] The postfix ID of the original message that was submitted. Link to this property outcome: Optional\[str] Processing outcome of the submission. Link to this property
outcome\_disposition: Optional\[Literal\["MALICIOUS", "SUSPICIOUS", "SPOOF", 3 more]] The disposition a message is submitted to have. One of the following: "MALICIOUS" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "NONE" Link to this property
Link to this property requested\_by: Optional\[str] Email address of the user who requested the submission. Link to this property
requested\_disposition: Optional\[Literal\["MALICIOUS", "SUSPICIOUS", "SPOOF", 3 more]] The disposition a message is submitted to have. One of the following: "MALICIOUS" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "NONE" Link to this property
Link to this property Deprecatedrequested\_ts: Optional\[str] Use requested_at instead. Deprecated, use requested_at instead. Link to this property status: Optional\[str] Processing status of the submission. Link to this property subject: Optional\[str] Subject line of the submitted message. Link to this property
type: Optional\[Literal\["Team", "User"]] Indicates whether a team member or an end user created the submission. One of the following: "Team" Link to this property "User" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.submissions%20%3E%20(model)%20submission_list_response%20%3E%20(schema)>)