Skip to content
Cloudflare API
Start here
API Reference
Email Security
Submissions

List reclassify submissions

email_security.submissions.list(SubmissionListParams**kwargs) -> SyncV4PagePaginationArray[SubmissionListResponse]
GET/accounts/{account_id}/email-security/submissions

Returns information for submissions made to reclassify emails. Shows the status, outcome, and disposition changes for reclassification requests made by users or the security team. Useful for tracking false positive/negative reports.

Security
API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
ParametersExpand Collapse
account_id: str

Identifier.

maxLength32
direction: Optional[Literal["asc", "desc"]]

The sorting direction.

One of the following:
"asc"
"desc"
end: Optional[Union[str, datetime]]

The end of the search date range. Defaults to now.

formatdate-time
escalated_from_user: Optional[bool]

When true, return only submissions that were escalated by an end user (vs. by the security team). When false, return only submissions that were not escalated by an end user. When omitted, no filter is applied.

order: Optional[Literal["submission_id", "subject", "original_disposition", 3 more]]

Field to sort by.

One of the following:
"submission_id"
"subject"
"original_disposition"
"requested_disposition"
"outcome_disposition"
"requested_at"
original_disposition: Optional[Literal["MALICIOUS", "SUSPICIOUS", "SPOOF", 3 more]]

The disposition a message is submitted to have.

One of the following:
"MALICIOUS"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"NONE"
outcome_disposition: Optional[Literal["MALICIOUS", "SUSPICIOUS", "SPOOF", 3 more]]

The disposition a message is submitted to have.

One of the following:
"MALICIOUS"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"NONE"
page: Optional[int]

Current page within paginated list of results.

minimum1
per_page: Optional[int]

The number of results per page. Maximum value is 1000.

maximum1000
minimum1
query: Optional[str]

Search term for filtering submissions.

requested_disposition: Optional[Literal["MALICIOUS", "SUSPICIOUS", "SPOOF", 3 more]]

The disposition a message is submitted to have.

One of the following:
"MALICIOUS"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"NONE"
start: Optional[Union[str, datetime]]

The beginning of the search date range. Defaults to now - 30 days.

formatdate-time
status: Optional[str]

Filter by review status — escalated, reviewed, or unreviewed.

submission_id: Optional[str]

Filter by a specific submission ID.

type: Optional[Literal["TEAM", "USER"]]

Filter by who created the submission — TEAM for security team members or USER for end users.

One of the following:
"TEAM"
"USER"
ReturnsExpand Collapse
class SubmissionListResponse: …
requested_at: datetime

When the submission was requested (UTC).

formatdate-time
submission_id: str
customer_status: Optional[Literal["escalated", "reviewed", "unreviewed"]]
One of the following:
"escalated"
"reviewed"
"unreviewed"
escalated_as: Optional[Literal["MALICIOUS", "SUSPICIOUS", "SPOOF", 3 more]]

The disposition a message is submitted to have.

One of the following:
"MALICIOUS"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"NONE"
escalated_at: Optional[datetime]

When the submission was escalated to the security team.

formatdate-time
escalated_by: Optional[str]

Email address of the user who escalated the submission.

escalated_submission_id: Optional[str]

Submission ID of the escalated team submission, when this user submission was escalated.

original_disposition: Optional[Literal["MALICIOUS", "SUSPICIOUS", "SPOOF", 3 more]]

The disposition a message is submitted to have.

One of the following:
"MALICIOUS"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"NONE"
original_edf_hash: Optional[str]

EDF hash of the original message.

original_postfix_id: Optional[str]

The postfix ID of the original message that was submitted.

outcome: Optional[str]

Processing outcome of the submission.

outcome_disposition: Optional[Literal["MALICIOUS", "SUSPICIOUS", "SPOOF", 3 more]]

The disposition a message is submitted to have.

One of the following:
"MALICIOUS"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"NONE"
requested_by: Optional[str]

Email address of the user who requested the submission.

requested_disposition: Optional[Literal["MALICIOUS", "SUSPICIOUS", "SPOOF", 3 more]]

The disposition a message is submitted to have.

One of the following:
"MALICIOUS"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"NONE"
Deprecatedrequested_ts: Optional[str]

Use requested_at instead.

Deprecated, use requested_at instead.

status: Optional[str]

Processing status of the submission.

subject: Optional[str]

Subject line of the submitted message.

type: Optional[Literal["Team", "User"]]

Indicates whether a team member or an end user created the submission.

One of the following:
"Team"
"User"

List reclassify submissions

import os
from cloudflare import Cloudflare

client = Cloudflare(
    api_token=os.environ.get("CLOUDFLARE_API_TOKEN"),  # This is the default and can be omitted
)
page = client.email_security.submissions.list(
    account_id="023e105f4ecef8ad9ca31a8372d0c353",
)
page = page.result[0]
print(page.submission_id)
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "requested_at": "2019-12-27T18:11:19.117Z",
      "submission_id": "submission_id",
      "customer_status": "escalated",
      "escalated_as": "MALICIOUS",
      "escalated_at": "2019-12-27T18:11:19.117Z",
      "escalated_by": "escalated_by",
      "escalated_submission_id": "escalated_submission_id",
      "original_disposition": "MALICIOUS",
      "original_edf_hash": "original_edf_hash",
      "original_postfix_id": "original_postfix_id",
      "outcome": "outcome",
      "outcome_disposition": "MALICIOUS",
      "requested_by": "requested_by",
      "requested_disposition": "MALICIOUS",
      "requested_ts": "requested_ts",
      "status": "status",
      "subject": "subject",
      "type": "Team"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000
  }
}
Returns Examples
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "requested_at": "2019-12-27T18:11:19.117Z",
      "submission_id": "submission_id",
      "customer_status": "escalated",
      "escalated_as": "MALICIOUS",
      "escalated_at": "2019-12-27T18:11:19.117Z",
      "escalated_by": "escalated_by",
      "escalated_submission_id": "escalated_submission_id",
      "original_disposition": "MALICIOUS",
      "original_edf_hash": "original_edf_hash",
      "original_postfix_id": "original_postfix_id",
      "outcome": "outcome",
      "outcome_disposition": "MALICIOUS",
      "requested_by": "requested_by",
      "requested_disposition": "MALICIOUS",
      "requested_ts": "requested_ts",
      "status": "status",
      "subject": "subject",
      "type": "Team"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000
  }
}