--- title: Investigate --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) [Email Security](https://developers.cloudflare.com/api/python/resources/email_security) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Investigate ##### [Search email messages](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/methods/list) email\_security.investigate.list(InvestigateListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[InvestigateListResponse]()] GET/accounts/{account\_id}/email-security/investigate ##### [Get message details](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/methods/get) email\_security.investigate.get(strinvestigate\_id, InvestigateGetParams\*\*kwargs) -> [InvestigateGetResponse]() GET/accounts/{account\_id}/email-security/investigate/{investigate\_id} ##### ModelsExpand Collapse
class InvestigateListResponse: … id: str Unique identifier for a message retrieved from investigation. Link to this property
Deprecatedaction\_log: List\[ActionLog] Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. completed\_at: datetime Timestamp when action completed. formatdate-time Link to this property
operation: Literal\["MOVE", "RELEASE", "RECLASSIFY", 3 more] Type of action performed. One of the following: "MOVE" Link to this property "RELEASE" Link to this property "RECLASSIFY" Link to this property "SUBMISSION" Link to this property "QUARANTINE\_RELEASE" Link to this property "PREVIEW" Link to this property
Link to this property Deprecatedcompleted\_timestamp: Optional\[str] Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. Link to this property
properties: Optional\[ActionLogProperties] Additional properties for the action. folder: Optional\[str] Target folder for move operations. Link to this property requested\_by: Optional\[str] User who requested the action. Link to this property
Link to this property status: Optional\[str] Status of the action. Link to this property
Link to this property client\_recipients: List\[str] Link to this property detection\_reasons: List\[str] Link to this property is\_phish\_submission: bool Link to this property is\_quarantined: bool Link to this property postfix\_id: str The identifier of the message. Link to this property
properties: Properties Message processing properties. allowlisted\_pattern: Optional\[str] Pattern that allowlisted this message. Link to this property
allowlisted\_pattern\_type: Optional\[Literal\["quarantine\_release", "acceptable\_sender", "allowed\_sender", 5 more]] Type of allowlist pattern. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property blocklisted\_message: Optional\[bool] Whether message was blocklisted. Link to this property blocklisted\_pattern: Optional\[str] Pattern that blocklisted this message. Link to this property
whitelisted\_pattern\_type: Optional\[Literal\["quarantine\_release", "acceptable\_sender", "allowed\_sender", 5 more]] Legacy field for allowlist pattern type. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property
Link to this property Deprecatedts: str Use scanned_at instead. Deprecated, use scanned_at instead. End of life: November 1, 2026. Link to this property alert\_id: Optional\[str] Link to this property
delivery\_mode: Optional\[Literal\["DIRECT", "BCC", "JOURNAL", 8 more]] One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "REVIEW\_SUBMISSION" Link to this property "DMARC\_UNVERIFIED" Link to this property "DMARC\_FAILURE\_REPORT" Link to this property "DMARC\_AGGREGATE\_REPORT" Link to this property "THREAT\_INTEL\_SUBMISSION" Link to this property "SIMULATION\_SUBMISSION" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
delivery\_status: Optional\[List\[Literal\["delivered", "moved", "quarantined", 5 more]]] One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property edf\_hash: Optional\[str] Link to this property envelope\_from: Optional\[str] Link to this property envelope\_to: Optional\[List\[str]] Link to this property
final\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Deprecatedfindings: Optional\[List\[Finding]] Use the findings field from GET /investigate/{investigate\_id}/detections instead. Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message. attachment: Optional\[str] Link to this property detail: Optional\[str] Link to this property
detection: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field: Optional\[str] Link to this property name: Optional\[str] Link to this property portion: Optional\[str] Link to this property reason: Optional\[str] Link to this property score: Optional\[float] formatdouble Link to this property value: Optional\[str] Link to this property
Link to this property from\_: Optional\[str] Link to this property from\_name: Optional\[str] Link to this property htmltext\_structure\_hash: Optional\[str] Link to this property message\_id: Optional\[str] Link to this property
post\_delivery\_operations: Optional\[List\[Literal\["PREVIEW", "QUARANTINE\_RELEASE", "SUBMISSION", "MOVE"]]] Post-delivery operations performed on this message. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASE" Link to this property "SUBMISSION" Link to this property "MOVE" Link to this property
Link to this property postfix\_id\_outbound: Optional\[str] Link to this property replyto: Optional\[str] Link to this property scanned\_at: Optional\[datetime] When the message was scanned (UTC). formatdate-time Link to this property sent\_at: Optional\[datetime] When the message was sent (UTC). formatdate-time Link to this property sent\_date: Optional\[str] Link to this property smtp\_helo\_server\_ip: Optional\[str] Link to this property smtp\_previous\_hop\_ip: Optional\[str] Link to this property subject: Optional\[str] Link to this property threat\_categories: Optional\[List\[str]] Link to this property to: Optional\[List\[str]] Link to this property to\_name: Optional\[List\[str]] Link to this property
validation: Optional\[Validation] comment: Optional\[str] Link to this property
dkim: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property x\_originating\_ip: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.investigate%20%3E%20(model)%20investigate_list_response%20%3E%20(schema)>)
class InvestigateGetResponse: … id: str Unique identifier for a message retrieved from investigation. Link to this property
Deprecatedaction\_log: List\[ActionLog] Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. completed\_at: datetime Timestamp when action completed. formatdate-time Link to this property
operation: Literal\["MOVE", "RELEASE", "RECLASSIFY", 3 more] Type of action performed. One of the following: "MOVE" Link to this property "RELEASE" Link to this property "RECLASSIFY" Link to this property "SUBMISSION" Link to this property "QUARANTINE\_RELEASE" Link to this property "PREVIEW" Link to this property
Link to this property Deprecatedcompleted\_timestamp: Optional\[str] Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. Link to this property
properties: Optional\[ActionLogProperties] Additional properties for the action. folder: Optional\[str] Target folder for move operations. Link to this property requested\_by: Optional\[str] User who requested the action. Link to this property
Link to this property status: Optional\[str] Status of the action. Link to this property
Link to this property client\_recipients: List\[str] Link to this property detection\_reasons: List\[str] Link to this property is\_phish\_submission: bool Link to this property is\_quarantined: bool Link to this property postfix\_id: str The identifier of the message. Link to this property
properties: Properties Message processing properties. allowlisted\_pattern: Optional\[str] Pattern that allowlisted this message. Link to this property
allowlisted\_pattern\_type: Optional\[Literal\["quarantine\_release", "acceptable\_sender", "allowed\_sender", 5 more]] Type of allowlist pattern. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property blocklisted\_message: Optional\[bool] Whether message was blocklisted. Link to this property blocklisted\_pattern: Optional\[str] Pattern that blocklisted this message. Link to this property
whitelisted\_pattern\_type: Optional\[Literal\["quarantine\_release", "acceptable\_sender", "allowed\_sender", 5 more]] Legacy field for allowlist pattern type. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property
Link to this property Deprecatedts: str Use scanned_at instead. Deprecated, use scanned_at instead. End of life: November 1, 2026. Link to this property alert\_id: Optional\[str] Link to this property
delivery\_mode: Optional\[Literal\["DIRECT", "BCC", "JOURNAL", 8 more]] One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "REVIEW\_SUBMISSION" Link to this property "DMARC\_UNVERIFIED" Link to this property "DMARC\_FAILURE\_REPORT" Link to this property "DMARC\_AGGREGATE\_REPORT" Link to this property "THREAT\_INTEL\_SUBMISSION" Link to this property "SIMULATION\_SUBMISSION" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
delivery\_status: Optional\[List\[Literal\["delivered", "moved", "quarantined", 5 more]]] One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property edf\_hash: Optional\[str] Link to this property envelope\_from: Optional\[str] Link to this property envelope\_to: Optional\[List\[str]] Link to this property
final\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Deprecatedfindings: Optional\[List\[Finding]] Use the findings field from GET /investigate/{investigate\_id}/detections instead. Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message. attachment: Optional\[str] Link to this property detail: Optional\[str] Link to this property
detection: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field: Optional\[str] Link to this property name: Optional\[str] Link to this property portion: Optional\[str] Link to this property reason: Optional\[str] Link to this property score: Optional\[float] formatdouble Link to this property value: Optional\[str] Link to this property
Link to this property from\_: Optional\[str] Link to this property from\_name: Optional\[str] Link to this property htmltext\_structure\_hash: Optional\[str] Link to this property message\_id: Optional\[str] Link to this property
post\_delivery\_operations: Optional\[List\[Literal\["PREVIEW", "QUARANTINE\_RELEASE", "SUBMISSION", "MOVE"]]] Post-delivery operations performed on this message. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASE" Link to this property "SUBMISSION" Link to this property "MOVE" Link to this property
Link to this property postfix\_id\_outbound: Optional\[str] Link to this property replyto: Optional\[str] Link to this property scanned\_at: Optional\[datetime] When the message was scanned (UTC). formatdate-time Link to this property sent\_at: Optional\[datetime] When the message was sent (UTC). formatdate-time Link to this property sent\_date: Optional\[str] Link to this property smtp\_helo\_server\_ip: Optional\[str] Link to this property smtp\_previous\_hop\_ip: Optional\[str] Link to this property subject: Optional\[str] Link to this property threat\_categories: Optional\[List\[str]] Link to this property to: Optional\[List\[str]] Link to this property to\_name: Optional\[List\[str]] Link to this property
validation: Optional\[Validation] comment: Optional\[str] Link to this property
dkim: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property x\_originating\_ip: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.investigate%20%3E%20(model)%20investigate_get_response%20%3E%20(schema)>) #### InvestigateDetections ##### [Get message detection details](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/detections/methods/get) email\_security.investigate.detections.get(strinvestigate\_id, DetectionGetParams\*\*kwargs) -> [DetectionGetResponse]() GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/detections ##### ModelsExpand Collapse
class DetectionGetResponse: … action: str Link to this property
attachments: List\[Attachment] size: int Size of the attachment in bytes. minimum0 Link to this property content\_type: Optional\[str] MIME type of the attachment. Link to this property
detection: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] Detection result for this attachment. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property encrypted: Optional\[bool] Whether the attachment is encrypted. Link to this property filename: Optional\[str] Name of the attached file. Link to this property md5: Optional\[str] MD5 hash of the attachment. Link to this property name: Optional\[str] Attachment name (alternative to filename). Link to this property sha1: Optional\[str] SHA1 hash of the attachment. Link to this property sha256: Optional\[str] SHA256 hash of the attachment. Link to this property
Link to this property
findings: Optional\[List\[Finding]] attachment: Optional\[str] Link to this property detail: Optional\[str] Link to this property
detection: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] Detection result associated with this finding. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field: Optional\[str] Link to this property name: Optional\[str] Link to this property portion: Optional\[str] Link to this property reason: Optional\[str] Link to this property score: Optional\[float] formatdouble Link to this property value: Optional\[str] Link to this property
Link to this property
headers: List\[Header] name: str Link to this property value: str Link to this property
Link to this property
links: List\[Link] href: str Link to this property text: Optional\[str] Link to this property
Link to this property
sender\_info: SenderInfo as\_name: Optional\[str] The name of the autonomous system. Link to this property as\_number: Optional\[int] The number of the autonomous system. Link to this property geo: Optional\[str] Link to this property ip: Optional\[str] Link to this property pld: Optional\[str] Link to this property
Link to this property
threat\_categories: List\[ThreatCategory] id: Optional\[int] Link to this property description: Optional\[str] Link to this property name: Optional\[str] Link to this property
Link to this property
validation: Validation comment: Optional\[str] Link to this property
dkim: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property
final\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.detections%20%3E%20(model)%20detection_get_response%20%3E%20(schema)>) #### InvestigatePreview ##### [Get preview for a detection](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/preview/methods/get) email\_security.investigate.preview.get(strinvestigate\_id, PreviewGetParams\*\*kwargs) -> [PreviewGetResponse]() GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/preview ##### [Generate preview for a non-detection message](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/preview/methods/create) email\_security.investigate.preview.create(PreviewCreateParams\*\*kwargs) -> [PreviewCreateResponse]() POST/accounts/{account\_id}/email-security/investigate/preview ##### ModelsExpand Collapse
class PreviewGetResponse: … screenshot: str A base64 encoded PNG image of the email. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.preview%20%3E%20(model)%20preview_get_response%20%3E%20(schema)>)
class PreviewCreateResponse: … screenshot: str A base64 encoded PNG image of the email. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.preview%20%3E%20(model)%20preview_create_response%20%3E%20(schema)>) #### InvestigateRaw ##### [Get raw email content](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/raw/methods/get) email\_security.investigate.raw.get(strinvestigate\_id, RawGetParams\*\*kwargs) -> [RawGetResponse]() GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/raw ##### ModelsExpand Collapse
class RawGetResponse: … raw: str A UTF-8 encoded eml file of the email. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>) #### InvestigateTrace ##### [Get email trace](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/trace/methods/get) email\_security.investigate.trace.get(strinvestigate\_id, TraceGetParams\*\*kwargs) -> [TraceGetResponse]() GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/trace ##### ModelsExpand Collapse
class TraceGetResponse: …
inbound: Inbound
lines: Optional\[List\[InboundLine]] lineno: Optional\[int] Line number in the trace log. Link to this property logged\_at: Optional\[datetime] formatdate-time Link to this property message: Optional\[str] Link to this property Deprecatedts: Optional\[str] Use logged_at instead. Deprecated, use logged_at instead. End of life: November 1, 2026. Link to this property
Link to this property pending: Optional\[bool] Link to this property
Link to this property
outbound: Outbound
lines: Optional\[List\[OutboundLine]] lineno: Optional\[int] Line number in the trace log. Link to this property logged\_at: Optional\[datetime] formatdate-time Link to this property message: Optional\[str] Link to this property Deprecatedts: Optional\[str] Use logged_at instead. Deprecated, use logged_at instead. End of life: November 1, 2026. Link to this property
Link to this property pending: Optional\[bool] Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.trace%20%3E%20(model)%20trace_get_response%20%3E%20(schema)>) #### InvestigateMove ##### [Move a message](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/move/methods/create) email\_security.investigate.move.create(strinvestigate\_id, MoveCreateParams\*\*kwargs) -> SyncSinglePage\[[MoveCreateResponse]()] POST/accounts/{account\_id}/email-security/investigate/{investigate\_id}/move ##### [Move messages](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/move/methods/bulk) email\_security.investigate.move.bulk(MoveBulkParams\*\*kwargs) -> SyncSinglePage\[[MoveBulkResponse]()] POST/accounts/{account\_id}/email-security/investigate/move ##### ModelsExpand Collapse
class MoveCreateResponse: … success: bool Whether the operation succeeded. Link to this property completed\_at: Optional\[datetime] When the move operation completed (UTC). formatdate-time Link to this property Deprecatedcompleted\_timestamp: Optional\[datetime] Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. formatdate-time Link to this property destination: Optional\[str] Destination folder for the message. Link to this property Deprecateditem\_count: Optional\[int] This field is deprecated. Number of items moved. End of life: November 1, 2026. Link to this property message\_id: Optional\[str] Message identifier. Link to this property operation: Optional\[str] Type of operation performed. Link to this property recipient: Optional\[str] Recipient email address. Link to this property status: Optional\[str] Operation status. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.move%20%3E%20(model)%20move_create_response%20%3E%20(schema)>)
class MoveBulkResponse: … success: bool Whether the operation succeeded. Link to this property completed\_at: Optional\[datetime] When the move operation completed (UTC). formatdate-time Link to this property Deprecatedcompleted\_timestamp: Optional\[datetime] Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. formatdate-time Link to this property destination: Optional\[str] Destination folder for the message. Link to this property Deprecateditem\_count: Optional\[int] This field is deprecated. Number of items moved. End of life: November 1, 2026. Link to this property message\_id: Optional\[str] Message identifier. Link to this property operation: Optional\[str] Type of operation performed. Link to this property recipient: Optional\[str] Recipient email address. Link to this property status: Optional\[str] Operation status. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.move%20%3E%20(model)%20move_bulk_response%20%3E%20(schema)>) #### InvestigateReclassify ##### [Change email classification](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/reclassify/methods/create) Deprecated email\_security.investigate.reclassify.create(strinvestigate\_id, ReclassifyCreateParams\*\*kwargs) -> object POST/accounts/{account\_id}/email-security/investigate/{investigate\_id}/reclassify #### InvestigateRelease ##### [Release messages from quarantine](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/release/methods/bulk) email\_security.investigate.release.bulk(ReleaseBulkParams\*\*kwargs) -> SyncSinglePage\[[ReleaseBulkResponse]()] POST/accounts/{account\_id}/email-security/investigate/release ##### ModelsExpand Collapse
class ReleaseBulkResponse: … id: str Unique identifier for a message retrieved from investigation. Link to this property delivered: Optional\[List\[str]] Link to this property failed: Optional\[List\[str]] Link to this property Deprecatedpostfix\_id: Optional\[str] Use id instead. Deprecated, use id instead. End of life: November 1, 2026. Link to this property undelivered: Optional\[List\[str]] Link to this property
[Link to this property](<#(resource)%20email_security.investigate.release%20%3E%20(model)%20release_bulk_response%20%3E%20(schema)>) #### InvestigateBulk ##### [List bulk action jobs](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/bulk/methods/list) email\_security.investigate.bulk.list(BulkListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[BulkListResponse]()] GET/accounts/{account\_id}/email-security/investigate/bulk ##### [Create a bulk action job](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/bulk/methods/create) email\_security.investigate.bulk.create(BulkCreateParams\*\*kwargs) -> [BulkCreateResponse]() POST/accounts/{account\_id}/email-security/investigate/bulk ##### [Get bulk action job details](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/bulk/methods/get) email\_security.investigate.bulk.get(strjob\_id, BulkGetParams\*\*kwargs) -> [BulkGetResponse]() GET/accounts/{account\_id}/email-security/investigate/bulk/{job\_id} ##### [Delete a bulk action job](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/bulk/methods/delete) email\_security.investigate.bulk.delete(strjob\_id, BulkDeleteParams\*\*kwargs) -> [BulkDeleteResponse]() DELETE/accounts/{account\_id}/email-security/investigate/bulk/{job\_id} ##### ModelsExpand Collapse
class BulkListResponse: …
action\_params: ActionParams One of the following:
class ActionParamsMove: …
destination: Literal\["Inbox", "JunkEmail", "DeletedItems", 2 more] The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: Literal\["MOVE"] Link to this property
Deprecatedexpected\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
class ActionParamsRelease: … type: Literal\["RELEASE"] Link to this property
Link to this property
Link to this property
action\_type: Literal\["MOVE", "RELEASE"] One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: datetime formatdate-time Link to this property job\_id: str formatuuid Link to this property messages\_cancelled: int Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: int Link to this property messages\_pending: int Link to this property messages\_skipped: int Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: int Link to this property
search\_params: SearchParams Deprecatedaction\_log: Optional\[bool] Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id: Optional\[str] Alert ID of the detection to filter by. Link to this property
delivery\_status: Optional\[Literal\["delivered", "moved", "quarantined", 5 more]] Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only: Optional\[bool] Whether to include only detections in search results. Link to this property domain: Optional\[str] Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end: Optional\[datetime] End of search date range. formatdate-time Link to this property exact\_subject: Optional\[str] Match messages whose subject line equals this value exactly. Link to this property
final\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action: Optional\[Literal\["PREVIEW", "QUARANTINE\_RELEASED", "MOVED"]] Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id: Optional\[str] Message-ID header value to filter by. Link to this property metric: Optional\[str] Metric name to filter the search by. Link to this property query: Optional\[str] Space-delimited search term. Case-insensitive. Link to this property recipient: Optional\[str] Match messages whose recipient is this email address or domain. Link to this property sender: Optional\[str] Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip: Optional\[str] Matches messages whose SMTP HELO server IP address equals this value. Link to this property start: Optional\[datetime] Beginning of search date range. formatdate-time Link to this property subject: Optional\[str] Match messages whose subject contains these keywords, in any order. Link to this property submissions: Optional\[bool] Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: Literal\["PENDING", "DISCOVERING", "PROCESSING", 3 more] Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: int Link to this property comment: Optional\[str] Link to this property completed\_at: Optional\[datetime] formatdate-time Link to this property started\_at: Optional\[datetime] formatdate-time Link to this property status\_message: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_list_response%20%3E%20(schema)>)
class BulkCreateResponse: …
action\_params: ActionParams One of the following:
class ActionParamsMove: …
destination: Literal\["Inbox", "JunkEmail", "DeletedItems", 2 more] The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: Literal\["MOVE"] Link to this property
Deprecatedexpected\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
class ActionParamsRelease: … type: Literal\["RELEASE"] Link to this property
Link to this property
Link to this property
action\_type: Literal\["MOVE", "RELEASE"] One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: datetime formatdate-time Link to this property job\_id: str formatuuid Link to this property messages\_cancelled: int Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: int Link to this property messages\_pending: int Link to this property messages\_skipped: int Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: int Link to this property
search\_params: SearchParams Deprecatedaction\_log: Optional\[bool] Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id: Optional\[str] Alert ID of the detection to filter by. Link to this property
delivery\_status: Optional\[Literal\["delivered", "moved", "quarantined", 5 more]] Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only: Optional\[bool] Whether to include only detections in search results. Link to this property domain: Optional\[str] Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end: Optional\[datetime] End of search date range. formatdate-time Link to this property exact\_subject: Optional\[str] Match messages whose subject line equals this value exactly. Link to this property
final\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action: Optional\[Literal\["PREVIEW", "QUARANTINE\_RELEASED", "MOVED"]] Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id: Optional\[str] Message-ID header value to filter by. Link to this property metric: Optional\[str] Metric name to filter the search by. Link to this property query: Optional\[str] Space-delimited search term. Case-insensitive. Link to this property recipient: Optional\[str] Match messages whose recipient is this email address or domain. Link to this property sender: Optional\[str] Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip: Optional\[str] Matches messages whose SMTP HELO server IP address equals this value. Link to this property start: Optional\[datetime] Beginning of search date range. formatdate-time Link to this property subject: Optional\[str] Match messages whose subject contains these keywords, in any order. Link to this property submissions: Optional\[bool] Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: Literal\["PENDING", "DISCOVERING", "PROCESSING", 3 more] Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: int Link to this property comment: Optional\[str] Link to this property completed\_at: Optional\[datetime] formatdate-time Link to this property started\_at: Optional\[datetime] formatdate-time Link to this property status\_message: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_create_response%20%3E%20(schema)>)
class BulkGetResponse: …
action\_params: ActionParams One of the following:
class ActionParamsMove: …
destination: Literal\["Inbox", "JunkEmail", "DeletedItems", 2 more] The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: Literal\["MOVE"] Link to this property
Deprecatedexpected\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
class ActionParamsRelease: … type: Literal\["RELEASE"] Link to this property
Link to this property
Link to this property
action\_type: Literal\["MOVE", "RELEASE"] One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: datetime formatdate-time Link to this property job\_id: str formatuuid Link to this property messages\_cancelled: int Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: int Link to this property messages\_pending: int Link to this property messages\_skipped: int Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: int Link to this property
search\_params: SearchParams Deprecatedaction\_log: Optional\[bool] Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id: Optional\[str] Alert ID of the detection to filter by. Link to this property
delivery\_status: Optional\[Literal\["delivered", "moved", "quarantined", 5 more]] Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only: Optional\[bool] Whether to include only detections in search results. Link to this property domain: Optional\[str] Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end: Optional\[datetime] End of search date range. formatdate-time Link to this property exact\_subject: Optional\[str] Match messages whose subject line equals this value exactly. Link to this property
final\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action: Optional\[Literal\["PREVIEW", "QUARANTINE\_RELEASED", "MOVED"]] Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id: Optional\[str] Message-ID header value to filter by. Link to this property metric: Optional\[str] Metric name to filter the search by. Link to this property query: Optional\[str] Space-delimited search term. Case-insensitive. Link to this property recipient: Optional\[str] Match messages whose recipient is this email address or domain. Link to this property sender: Optional\[str] Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip: Optional\[str] Matches messages whose SMTP HELO server IP address equals this value. Link to this property start: Optional\[datetime] Beginning of search date range. formatdate-time Link to this property subject: Optional\[str] Match messages whose subject contains these keywords, in any order. Link to this property submissions: Optional\[bool] Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: Literal\["PENDING", "DISCOVERING", "PROCESSING", 3 more] Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: int Link to this property comment: Optional\[str] Link to this property completed\_at: Optional\[datetime] formatdate-time Link to this property started\_at: Optional\[datetime] formatdate-time Link to this property status\_message: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_get_response%20%3E%20(schema)>)
class BulkDeleteResponse: … id: str formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_delete_response%20%3E%20(schema)>) #### InvestigateBulkCancel ##### [Cancel a bulk action job](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/bulk/subresources/cancel/methods/create) email\_security.investigate.bulk.cancel.create(strjob\_id, CancelCreateParams\*\*kwargs) -> [CancelCreateResponse]() POST/accounts/{account\_id}/email-security/investigate/bulk/{job\_id}/cancel ##### ModelsExpand Collapse
class CancelCreateResponse: …
action\_params: ActionParams One of the following:
class ActionParamsMove: …
destination: Literal\["Inbox", "JunkEmail", "DeletedItems", 2 more] The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: Literal\["MOVE"] Link to this property
Deprecatedexpected\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
class ActionParamsRelease: … type: Literal\["RELEASE"] Link to this property
Link to this property
Link to this property
action\_type: Literal\["MOVE", "RELEASE"] One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: datetime formatdate-time Link to this property job\_id: str formatuuid Link to this property messages\_cancelled: int Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: int Link to this property messages\_pending: int Link to this property messages\_skipped: int Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: int Link to this property
search\_params: SearchParams Deprecatedaction\_log: Optional\[bool] Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id: Optional\[str] Alert ID of the detection to filter by. Link to this property
delivery\_status: Optional\[Literal\["delivered", "moved", "quarantined", 5 more]] Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only: Optional\[bool] Whether to include only detections in search results. Link to this property domain: Optional\[str] Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end: Optional\[datetime] End of search date range. formatdate-time Link to this property exact\_subject: Optional\[str] Match messages whose subject line equals this value exactly. Link to this property
final\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action: Optional\[Literal\["PREVIEW", "QUARANTINE\_RELEASED", "MOVED"]] Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id: Optional\[str] Message-ID header value to filter by. Link to this property metric: Optional\[str] Metric name to filter the search by. Link to this property query: Optional\[str] Space-delimited search term. Case-insensitive. Link to this property recipient: Optional\[str] Match messages whose recipient is this email address or domain. Link to this property sender: Optional\[str] Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip: Optional\[str] Matches messages whose SMTP HELO server IP address equals this value. Link to this property start: Optional\[datetime] Beginning of search date range. formatdate-time Link to this property subject: Optional\[str] Match messages whose subject contains these keywords, in any order. Link to this property submissions: Optional\[bool] Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: Literal\["PENDING", "DISCOVERING", "PROCESSING", 3 more] Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: int Link to this property comment: Optional\[str] Link to this property completed\_at: Optional\[datetime] formatdate-time Link to this property started\_at: Optional\[datetime] formatdate-time Link to this property status\_message: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk.cancel%20%3E%20(model)%20cancel_create_response%20%3E%20(schema)>) #### InvestigateBulkMessages ##### [List messages for a bulk action job](https://developers.cloudflare.com/api/python/resources/email_security/subresources/investigate/subresources/bulk/subresources/messages/methods/list) email\_security.investigate.bulk.messages.list(strjob\_id, MessageListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[MessageListResponse]()] GET/accounts/{account\_id}/email-security/investigate/bulk/{job\_id}/messages ##### ModelsExpand Collapse
class MessageListResponse: …
action\_params: ActionParams One of the following:
class ActionParamsMove: … client\_recipient: str Link to this property
destination: Literal\["Inbox", "JunkEmail", "DeletedItems", 2 more] The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: Literal\["MOVE"] Link to this property
Deprecatedexpected\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
class ActionParamsRelease: … client\_recipient: str Link to this property type: Literal\["RELEASE"] Link to this property
Link to this property
Link to this property
action\_type: Literal\["MOVE", "RELEASE"] One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: datetime formatdate-time Link to this property message\_id: str formatuuid Link to this property postfix\_id: str Link to this property retry\_count: int Link to this property
status: Literal\["PENDING", "PROCESSING", "COMPLETED", 3 more] Status of a message within a bulk action job. One of the following: "PENDING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property "SKIPPED" Link to this property
Link to this property alert\_id: Optional\[str] Link to this property email\_message\_id: Optional\[str] Link to this property
message: Optional\[Message] id: str Unique identifier for a message retrieved from investigation. Link to this property
Deprecatedaction\_log: List\[MessageActionLog] Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. completed\_at: datetime Timestamp when action completed. formatdate-time Link to this property
operation: Literal\["MOVE", "RELEASE", "RECLASSIFY", 3 more] Type of action performed. One of the following: "MOVE" Link to this property "RELEASE" Link to this property "RECLASSIFY" Link to this property "SUBMISSION" Link to this property "QUARANTINE\_RELEASE" Link to this property "PREVIEW" Link to this property
Link to this property Deprecatedcompleted\_timestamp: Optional\[str] Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. Link to this property
properties: Optional\[MessageActionLogProperties] Additional properties for the action. folder: Optional\[str] Target folder for move operations. Link to this property requested\_by: Optional\[str] User who requested the action. Link to this property
Link to this property status: Optional\[str] Status of the action. Link to this property
Link to this property client\_recipients: List\[str] Link to this property detection\_reasons: List\[str] Link to this property is\_phish\_submission: bool Link to this property is\_quarantined: bool Link to this property postfix\_id: str The identifier of the message. Link to this property
properties: MessageProperties Message processing properties. allowlisted\_pattern: Optional\[str] Pattern that allowlisted this message. Link to this property
allowlisted\_pattern\_type: Optional\[Literal\["quarantine\_release", "acceptable\_sender", "allowed\_sender", 5 more]] Type of allowlist pattern. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property blocklisted\_message: Optional\[bool] Whether message was blocklisted. Link to this property blocklisted\_pattern: Optional\[str] Pattern that blocklisted this message. Link to this property
whitelisted\_pattern\_type: Optional\[Literal\["quarantine\_release", "acceptable\_sender", "allowed\_sender", 5 more]] Legacy field for allowlist pattern type. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property
Link to this property Deprecatedts: str Use scanned_at instead. Deprecated, use scanned_at instead. End of life: November 1, 2026. Link to this property alert\_id: Optional\[str] Link to this property
delivery\_mode: Optional\[Literal\["DIRECT", "BCC", "JOURNAL", 8 more]] One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "REVIEW\_SUBMISSION" Link to this property "DMARC\_UNVERIFIED" Link to this property "DMARC\_FAILURE\_REPORT" Link to this property "DMARC\_AGGREGATE\_REPORT" Link to this property "THREAT\_INTEL\_SUBMISSION" Link to this property "SIMULATION\_SUBMISSION" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
delivery\_status: Optional\[List\[Literal\["delivered", "moved", "quarantined", 5 more]]] One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property edf\_hash: Optional\[str] Link to this property envelope\_from: Optional\[str] Link to this property envelope\_to: Optional\[List\[str]] Link to this property
final\_disposition: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Deprecatedfindings: Optional\[List\[MessageFinding]] Use the findings field from GET /investigate/{investigate\_id}/detections instead. Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message. attachment: Optional\[str] Link to this property detail: Optional\[str] Link to this property
detection: Optional\[Literal\["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]] The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field: Optional\[str] Link to this property name: Optional\[str] Link to this property portion: Optional\[str] Link to this property reason: Optional\[str] Link to this property score: Optional\[float] formatdouble Link to this property value: Optional\[str] Link to this property
Link to this property from\_: Optional\[str] Link to this property from\_name: Optional\[str] Link to this property htmltext\_structure\_hash: Optional\[str] Link to this property message\_id: Optional\[str] Link to this property
post\_delivery\_operations: Optional\[List\[Literal\["PREVIEW", "QUARANTINE\_RELEASE", "SUBMISSION", "MOVE"]]] Post-delivery operations performed on this message. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASE" Link to this property "SUBMISSION" Link to this property "MOVE" Link to this property
Link to this property postfix\_id\_outbound: Optional\[str] Link to this property replyto: Optional\[str] Link to this property scanned\_at: Optional\[datetime] When the message was scanned (UTC). formatdate-time Link to this property sent\_at: Optional\[datetime] When the message was sent (UTC). formatdate-time Link to this property sent\_date: Optional\[str] Link to this property smtp\_helo\_server\_ip: Optional\[str] Link to this property smtp\_previous\_hop\_ip: Optional\[str] Link to this property subject: Optional\[str] Link to this property threat\_categories: Optional\[List\[str]] Link to this property to: Optional\[List\[str]] Link to this property to\_name: Optional\[List\[str]] Link to this property
validation: Optional\[MessageValidation] comment: Optional\[str] Link to this property
dkim: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf: Optional\[Literal\["pass", "neutral", "fail", 2 more]] One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property x\_originating\_ip: Optional\[str] Link to this property
Link to this property processed\_at: Optional\[datetime] formatdate-time Link to this property retry\_after: Optional\[datetime] When to retry the action if it failed. formatdate-time Link to this property status\_message: Optional\[str] Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk.messages%20%3E%20(model)%20message_list_response%20%3E%20(schema)>)