--- title: Email Security --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Email Security #### Email SecurityInvestigate ##### [Search email messages](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/methods/list) GET/accounts/{account\_id}/email-security/investigate ##### [Get message details](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/methods/get) GET/accounts/{account\_id}/email-security/investigate/{investigate\_id} ##### ModelsExpand Collapse
InvestigateListResponse object {id, action\_log, client\_recipients, 32 more } id: string Unique identifier for a message retrieved from investigation. Link to this property
Deprecatedaction\_log: array of object {completed\_at, operation, completed\_timestamp, 2 more } Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. completed\_at: string Timestamp when action completed. formatdate-time Link to this property
operation: "MOVE"or "RELEASE"or "RECLASSIFY"or 3 more Type of action performed. One of the following: "MOVE" Link to this property "RELEASE" Link to this property "RECLASSIFY" Link to this property "SUBMISSION" Link to this property "QUARANTINE\_RELEASE" Link to this property "PREVIEW" Link to this property
Link to this property Deprecatedcompleted\_timestamp: optional string Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. Link to this property
properties: optional object {folder, requested\_by } Additional properties for the action. folder: optional string Target folder for move operations. Link to this property requested\_by: optional string User who requested the action. Link to this property
Link to this property status: optional string Status of the action. Link to this property
Link to this property client\_recipients: array of string Link to this property detection\_reasons: array of string Link to this property is\_phish\_submission: boolean Link to this property is\_quarantined: boolean Link to this property postfix\_id: string The identifier of the message. Link to this property
properties: object {allowlisted\_pattern, allowlisted\_pattern\_type, blocklisted\_message, 2 more } Message processing properties. allowlisted\_pattern: optional string Pattern that allowlisted this message. Link to this property
allowlisted\_pattern\_type: optional "quarantine\_release"or "acceptable\_sender"or "allowed\_sender"or 5 more Type of allowlist pattern. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property blocklisted\_message: optional boolean Whether message was blocklisted. Link to this property blocklisted\_pattern: optional string Pattern that blocklisted this message. Link to this property
whitelisted\_pattern\_type: optional "quarantine\_release"or "acceptable\_sender"or "allowed\_sender"or 5 more Legacy field for allowlist pattern type. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property
Link to this property Deprecatedts: string Use scanned_at instead. Deprecated, use scanned_at instead. End of life: November 1, 2026. Link to this property alert\_id: optional string Link to this property
delivery\_mode: optional "DIRECT"or "BCC"or "JOURNAL"or 8 more One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "REVIEW\_SUBMISSION" Link to this property "DMARC\_UNVERIFIED" Link to this property "DMARC\_FAILURE\_REPORT" Link to this property "DMARC\_AGGREGATE\_REPORT" Link to this property "THREAT\_INTEL\_SUBMISSION" Link to this property "SIMULATION\_SUBMISSION" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
delivery\_status: optional array of "delivered"or "moved"or "quarantined"or 5 more One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property edf\_hash: optional string Link to this property envelope\_from: optional string Link to this property envelope\_to: optional array of string Link to this property
final\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Deprecatedfindings: optional array of object {attachment, detail, detection, 6 more } Use the findings field from GET /investigate/{investigate\_id}/detections instead. Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message. attachment: optional string Link to this property detail: optional string Link to this property
detection: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field: optional string Link to this property name: optional string Link to this property portion: optional string Link to this property reason: optional string Link to this property score: optional number formatdouble Link to this property value: optional string Link to this property
Link to this property from: optional string Link to this property from\_name: optional string Link to this property htmltext\_structure\_hash: optional string Link to this property message\_id: optional string Link to this property
post\_delivery\_operations: optional array of "PREVIEW"or "QUARANTINE\_RELEASE"or "SUBMISSION"or "MOVE" Post-delivery operations performed on this message. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASE" Link to this property "SUBMISSION" Link to this property "MOVE" Link to this property
Link to this property postfix\_id\_outbound: optional string Link to this property replyto: optional string Link to this property scanned\_at: optional string When the message was scanned (UTC). formatdate-time Link to this property sent\_at: optional string When the message was sent (UTC). formatdate-time Link to this property sent\_date: optional string Link to this property smtp\_helo\_server\_ip: optional string Link to this property smtp\_previous\_hop\_ip: optional string Link to this property subject: optional string Link to this property threat\_categories: optional array of string Link to this property to: optional array of string Link to this property to\_name: optional array of string Link to this property
validation: optional object {comment, dkim, dmarc, spf } comment: optional string Link to this property
dkim: optional "pass"or "neutral"or "fail"or 2 more One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc: optional "pass"or "neutral"or "fail"or 2 more One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf: optional "pass"or "neutral"or "fail"or 2 more One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property x\_originating\_ip: optional string Link to this property
[Link to this property](<#(resource)%20email_security.investigate%20%3E%20(model)%20investigate_list_response%20%3E%20(schema)>)
InvestigateGetResponse object {id, action\_log, client\_recipients, 32 more } id: string Unique identifier for a message retrieved from investigation. Link to this property
Deprecatedaction\_log: array of object {completed\_at, operation, completed\_timestamp, 2 more } Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. completed\_at: string Timestamp when action completed. formatdate-time Link to this property
operation: "MOVE"or "RELEASE"or "RECLASSIFY"or 3 more Type of action performed. One of the following: "MOVE" Link to this property "RELEASE" Link to this property "RECLASSIFY" Link to this property "SUBMISSION" Link to this property "QUARANTINE\_RELEASE" Link to this property "PREVIEW" Link to this property
Link to this property Deprecatedcompleted\_timestamp: optional string Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. Link to this property
properties: optional object {folder, requested\_by } Additional properties for the action. folder: optional string Target folder for move operations. Link to this property requested\_by: optional string User who requested the action. Link to this property
Link to this property status: optional string Status of the action. Link to this property
Link to this property client\_recipients: array of string Link to this property detection\_reasons: array of string Link to this property is\_phish\_submission: boolean Link to this property is\_quarantined: boolean Link to this property postfix\_id: string The identifier of the message. Link to this property
properties: object {allowlisted\_pattern, allowlisted\_pattern\_type, blocklisted\_message, 2 more } Message processing properties. allowlisted\_pattern: optional string Pattern that allowlisted this message. Link to this property
allowlisted\_pattern\_type: optional "quarantine\_release"or "acceptable\_sender"or "allowed\_sender"or 5 more Type of allowlist pattern. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property blocklisted\_message: optional boolean Whether message was blocklisted. Link to this property blocklisted\_pattern: optional string Pattern that blocklisted this message. Link to this property
whitelisted\_pattern\_type: optional "quarantine\_release"or "acceptable\_sender"or "allowed\_sender"or 5 more Legacy field for allowlist pattern type. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property
Link to this property Deprecatedts: string Use scanned_at instead. Deprecated, use scanned_at instead. End of life: November 1, 2026. Link to this property alert\_id: optional string Link to this property
delivery\_mode: optional "DIRECT"or "BCC"or "JOURNAL"or 8 more One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "REVIEW\_SUBMISSION" Link to this property "DMARC\_UNVERIFIED" Link to this property "DMARC\_FAILURE\_REPORT" Link to this property "DMARC\_AGGREGATE\_REPORT" Link to this property "THREAT\_INTEL\_SUBMISSION" Link to this property "SIMULATION\_SUBMISSION" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
delivery\_status: optional array of "delivered"or "moved"or "quarantined"or 5 more One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property edf\_hash: optional string Link to this property envelope\_from: optional string Link to this property envelope\_to: optional array of string Link to this property
final\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Deprecatedfindings: optional array of object {attachment, detail, detection, 6 more } Use the findings field from GET /investigate/{investigate\_id}/detections instead. Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message. attachment: optional string Link to this property detail: optional string Link to this property
detection: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field: optional string Link to this property name: optional string Link to this property portion: optional string Link to this property reason: optional string Link to this property score: optional number formatdouble Link to this property value: optional string Link to this property
Link to this property from: optional string Link to this property from\_name: optional string Link to this property htmltext\_structure\_hash: optional string Link to this property message\_id: optional string Link to this property
post\_delivery\_operations: optional array of "PREVIEW"or "QUARANTINE\_RELEASE"or "SUBMISSION"or "MOVE" Post-delivery operations performed on this message. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASE" Link to this property "SUBMISSION" Link to this property "MOVE" Link to this property
Link to this property postfix\_id\_outbound: optional string Link to this property replyto: optional string Link to this property scanned\_at: optional string When the message was scanned (UTC). formatdate-time Link to this property sent\_at: optional string When the message was sent (UTC). formatdate-time Link to this property sent\_date: optional string Link to this property smtp\_helo\_server\_ip: optional string Link to this property smtp\_previous\_hop\_ip: optional string Link to this property subject: optional string Link to this property threat\_categories: optional array of string Link to this property to: optional array of string Link to this property to\_name: optional array of string Link to this property
validation: optional object {comment, dkim, dmarc, spf } comment: optional string Link to this property
dkim: optional "pass"or "neutral"or "fail"or 2 more One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc: optional "pass"or "neutral"or "fail"or 2 more One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf: optional "pass"or "neutral"or "fail"or 2 more One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property x\_originating\_ip: optional string Link to this property
[Link to this property](<#(resource)%20email_security.investigate%20%3E%20(model)%20investigate_get_response%20%3E%20(schema)>) #### Email SecurityInvestigateDetections ##### [Get message detection details](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/detections/methods/get) GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/detections ##### ModelsExpand Collapse
DetectionGetResponse object {action, attachments, findings, 6 more } action: string Link to this property
attachments: array of object {size, content\_type, detection, 6 more } size: number Size of the attachment in bytes. minimum0 Link to this property content\_type: optional string MIME type of the attachment. Link to this property
detection: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more Detection result for this attachment. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property encrypted: optional boolean Whether the attachment is encrypted. Link to this property filename: optional string Name of the attached file. Link to this property md5: optional string MD5 hash of the attachment. Link to this property name: optional string Attachment name (alternative to filename). Link to this property sha1: optional string SHA1 hash of the attachment. Link to this property sha256: optional string SHA256 hash of the attachment. Link to this property
Link to this property
findings: array of object {attachment, detail, detection, 6 more } attachment: optional string Link to this property detail: optional string Link to this property
detection: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more Detection result associated with this finding. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field: optional string Link to this property name: optional string Link to this property portion: optional string Link to this property reason: optional string Link to this property score: optional number formatdouble Link to this property value: optional string Link to this property
Link to this property
headers: array of object {name, value } name: string Link to this property value: string Link to this property
Link to this property
links: array of object {href, text } href: string Link to this property text: optional string Link to this property
Link to this property
sender\_info: object {as\_name, as\_number, geo, 2 more } as\_name: optional string The name of the autonomous system. Link to this property as\_number: optional number The number of the autonomous system. Link to this property geo: optional string Link to this property ip: optional string Link to this property pld: optional string Link to this property
Link to this property
threat\_categories: array of object {id, description, name } id: optional number Link to this property description: optional string Link to this property name: optional string Link to this property
Link to this property
validation: object {comment, dkim, dmarc, spf } comment: optional string Link to this property
dkim: optional "pass"or "neutral"or "fail"or 2 more One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc: optional "pass"or "neutral"or "fail"or 2 more One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf: optional "pass"or "neutral"or "fail"or 2 more One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property
final\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.detections%20%3E%20(model)%20detection_get_response%20%3E%20(schema)>) #### Email SecurityInvestigatePreview ##### [Get preview for a detection](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/preview/methods/get) GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/preview ##### [Generate preview for a non-detection message](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/preview/methods/create) POST/accounts/{account\_id}/email-security/investigate/preview ##### ModelsExpand Collapse
PreviewGetResponse object {screenshot } screenshot: string A base64 encoded PNG image of the email. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.preview%20%3E%20(model)%20preview_get_response%20%3E%20(schema)>)
PreviewCreateResponse object {screenshot } screenshot: string A base64 encoded PNG image of the email. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.preview%20%3E%20(model)%20preview_create_response%20%3E%20(schema)>) #### Email SecurityInvestigateRaw ##### [Get raw email content](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/raw/methods/get) GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/raw ##### ModelsExpand Collapse
RawGetResponse object {raw } raw: string A UTF-8 encoded eml file of the email. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>) #### Email SecurityInvestigateTrace ##### [Get email trace](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/trace/methods/get) GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/trace ##### ModelsExpand Collapse
TraceGetResponse object {inbound, outbound }
inbound: object {lines, pending }
lines: optional array of object {lineno, logged\_at, message, ts } lineno: optional number Line number in the trace log. Link to this property logged\_at: optional string formatdate-time Link to this property message: optional string Link to this property Deprecatedts: optional string Use logged_at instead. Deprecated, use logged_at instead. End of life: November 1, 2026. Link to this property
Link to this property pending: optional boolean Link to this property
Link to this property
outbound: object {lines, pending }
lines: optional array of object {lineno, logged\_at, message, ts } lineno: optional number Line number in the trace log. Link to this property logged\_at: optional string formatdate-time Link to this property message: optional string Link to this property Deprecatedts: optional string Use logged_at instead. Deprecated, use logged_at instead. End of life: November 1, 2026. Link to this property
Link to this property pending: optional boolean Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.trace%20%3E%20(model)%20trace_get_response%20%3E%20(schema)>) #### Email SecurityInvestigateMove ##### [Move a message](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/move/methods/create) POST/accounts/{account\_id}/email-security/investigate/{investigate\_id}/move ##### [Move messages](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/move/methods/bulk) POST/accounts/{account\_id}/email-security/investigate/move ##### ModelsExpand Collapse
MoveCreateResponse object {success, completed\_at, completed\_timestamp, 6 more } success: boolean Whether the operation succeeded. Link to this property completed\_at: optional string When the move operation completed (UTC). formatdate-time Link to this property Deprecatedcompleted\_timestamp: optional string Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. formatdate-time Link to this property destination: optional string Destination folder for the message. Link to this property Deprecateditem\_count: optional number This field is deprecated. Number of items moved. End of life: November 1, 2026. Link to this property message\_id: optional string Message identifier. Link to this property operation: optional string Type of operation performed. Link to this property recipient: optional string Recipient email address. Link to this property status: optional string Operation status. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.move%20%3E%20(model)%20move_create_response%20%3E%20(schema)>)
MoveBulkResponse object {success, completed\_at, completed\_timestamp, 6 more } success: boolean Whether the operation succeeded. Link to this property completed\_at: optional string When the move operation completed (UTC). formatdate-time Link to this property Deprecatedcompleted\_timestamp: optional string Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. formatdate-time Link to this property destination: optional string Destination folder for the message. Link to this property Deprecateditem\_count: optional number This field is deprecated. Number of items moved. End of life: November 1, 2026. Link to this property message\_id: optional string Message identifier. Link to this property operation: optional string Type of operation performed. Link to this property recipient: optional string Recipient email address. Link to this property status: optional string Operation status. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.move%20%3E%20(model)%20move_bulk_response%20%3E%20(schema)>) #### Email SecurityInvestigateReclassify ##### [Change email classification](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/reclassify/methods/create) Deprecated POST/accounts/{account\_id}/email-security/investigate/{investigate\_id}/reclassify ##### ModelsExpand Collapse ReclassifyCreateResponse = unknown [Link to this property](<#(resource)%20email_security.investigate.reclassify%20%3E%20(model)%20reclassify_create_response%20%3E%20(schema)>) #### Email SecurityInvestigateRelease ##### [Release messages from quarantine](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/release/methods/bulk) POST/accounts/{account\_id}/email-security/investigate/release ##### ModelsExpand Collapse
ReleaseBulkResponse object {id, delivered, failed, 2 more } id: string Unique identifier for a message retrieved from investigation. Link to this property delivered: optional array of string Link to this property failed: optional array of string Link to this property Deprecatedpostfix\_id: optional string Use id instead. Deprecated, use id instead. End of life: November 1, 2026. Link to this property undelivered: optional array of string Link to this property
[Link to this property](<#(resource)%20email_security.investigate.release%20%3E%20(model)%20release_bulk_response%20%3E%20(schema)>) #### Email SecurityInvestigateBulk ##### [List bulk action jobs](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/bulk/methods/list) GET/accounts/{account\_id}/email-security/investigate/bulk ##### [Create a bulk action job](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/bulk/methods/create) POST/accounts/{account\_id}/email-security/investigate/bulk ##### [Get bulk action job details](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/bulk/methods/get) GET/accounts/{account\_id}/email-security/investigate/bulk/{job\_id} ##### [Delete a bulk action job](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/bulk/methods/delete) DELETE/accounts/{account\_id}/email-security/investigate/bulk/{job\_id} ##### ModelsExpand Collapse
BulkListResponse object {action\_params, action\_type, created\_at, 13 more }
action\_params: object {destination, type, expected\_disposition } or object {type } One of the following:
Move object {destination, type, expected\_disposition }
destination: "Inbox"or "JunkEmail"or "DeletedItems"or 2 more The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: "MOVE" Link to this property
Deprecatedexpected\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
Release object {type } type: "RELEASE" Link to this property
Link to this property
Link to this property
action\_type: "MOVE"or "RELEASE" One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: string formatdate-time Link to this property job\_id: string formatuuid Link to this property messages\_cancelled: number Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: number Link to this property messages\_pending: number Link to this property messages\_skipped: number Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: number Link to this property
search\_params: object {action\_log, alert\_id, delivery\_status, 15 more } Deprecatedaction\_log: optional boolean Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id: optional string Alert ID of the detection to filter by. Link to this property
delivery\_status: optional "delivered"or "moved"or "quarantined"or 5 more Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only: optional boolean Whether to include only detections in search results. Link to this property domain: optional string Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end: optional string End of search date range. formatdate-time Link to this property exact\_subject: optional string Match messages whose subject line equals this value exactly. Link to this property
final\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action: optional "PREVIEW"or "QUARANTINE\_RELEASED"or "MOVED" Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id: optional string Message-ID header value to filter by. Link to this property metric: optional string Metric name to filter the search by. Link to this property query: optional string Space-delimited search term. Case-insensitive. Link to this property recipient: optional string Match messages whose recipient is this email address or domain. Link to this property sender: optional string Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip: optional string Matches messages whose SMTP HELO server IP address equals this value. Link to this property start: optional string Beginning of search date range. formatdate-time Link to this property subject: optional string Match messages whose subject contains these keywords, in any order. Link to this property submissions: optional boolean Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: "PENDING"or "DISCOVERING"or "PROCESSING"or 3 more Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: number Link to this property comment: optional string Link to this property completed\_at: optional string formatdate-time Link to this property started\_at: optional string formatdate-time Link to this property status\_message: optional string Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_list_response%20%3E%20(schema)>)
BulkCreateResponse object {action\_params, action\_type, created\_at, 13 more }
action\_params: object {destination, type, expected\_disposition } or object {type } One of the following:
Move object {destination, type, expected\_disposition }
destination: "Inbox"or "JunkEmail"or "DeletedItems"or 2 more The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: "MOVE" Link to this property
Deprecatedexpected\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
Release object {type } type: "RELEASE" Link to this property
Link to this property
Link to this property
action\_type: "MOVE"or "RELEASE" One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: string formatdate-time Link to this property job\_id: string formatuuid Link to this property messages\_cancelled: number Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: number Link to this property messages\_pending: number Link to this property messages\_skipped: number Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: number Link to this property
search\_params: object {action\_log, alert\_id, delivery\_status, 15 more } Deprecatedaction\_log: optional boolean Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id: optional string Alert ID of the detection to filter by. Link to this property
delivery\_status: optional "delivered"or "moved"or "quarantined"or 5 more Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only: optional boolean Whether to include only detections in search results. Link to this property domain: optional string Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end: optional string End of search date range. formatdate-time Link to this property exact\_subject: optional string Match messages whose subject line equals this value exactly. Link to this property
final\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action: optional "PREVIEW"or "QUARANTINE\_RELEASED"or "MOVED" Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id: optional string Message-ID header value to filter by. Link to this property metric: optional string Metric name to filter the search by. Link to this property query: optional string Space-delimited search term. Case-insensitive. Link to this property recipient: optional string Match messages whose recipient is this email address or domain. Link to this property sender: optional string Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip: optional string Matches messages whose SMTP HELO server IP address equals this value. Link to this property start: optional string Beginning of search date range. formatdate-time Link to this property subject: optional string Match messages whose subject contains these keywords, in any order. Link to this property submissions: optional boolean Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: "PENDING"or "DISCOVERING"or "PROCESSING"or 3 more Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: number Link to this property comment: optional string Link to this property completed\_at: optional string formatdate-time Link to this property started\_at: optional string formatdate-time Link to this property status\_message: optional string Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_create_response%20%3E%20(schema)>)
BulkGetResponse object {action\_params, action\_type, created\_at, 13 more }
action\_params: object {destination, type, expected\_disposition } or object {type } One of the following:
Move object {destination, type, expected\_disposition }
destination: "Inbox"or "JunkEmail"or "DeletedItems"or 2 more The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: "MOVE" Link to this property
Deprecatedexpected\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
Release object {type } type: "RELEASE" Link to this property
Link to this property
Link to this property
action\_type: "MOVE"or "RELEASE" One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: string formatdate-time Link to this property job\_id: string formatuuid Link to this property messages\_cancelled: number Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: number Link to this property messages\_pending: number Link to this property messages\_skipped: number Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: number Link to this property
search\_params: object {action\_log, alert\_id, delivery\_status, 15 more } Deprecatedaction\_log: optional boolean Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id: optional string Alert ID of the detection to filter by. Link to this property
delivery\_status: optional "delivered"or "moved"or "quarantined"or 5 more Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only: optional boolean Whether to include only detections in search results. Link to this property domain: optional string Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end: optional string End of search date range. formatdate-time Link to this property exact\_subject: optional string Match messages whose subject line equals this value exactly. Link to this property
final\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action: optional "PREVIEW"or "QUARANTINE\_RELEASED"or "MOVED" Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id: optional string Message-ID header value to filter by. Link to this property metric: optional string Metric name to filter the search by. Link to this property query: optional string Space-delimited search term. Case-insensitive. Link to this property recipient: optional string Match messages whose recipient is this email address or domain. Link to this property sender: optional string Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip: optional string Matches messages whose SMTP HELO server IP address equals this value. Link to this property start: optional string Beginning of search date range. formatdate-time Link to this property subject: optional string Match messages whose subject contains these keywords, in any order. Link to this property submissions: optional boolean Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: "PENDING"or "DISCOVERING"or "PROCESSING"or 3 more Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: number Link to this property comment: optional string Link to this property completed\_at: optional string formatdate-time Link to this property started\_at: optional string formatdate-time Link to this property status\_message: optional string Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_get_response%20%3E%20(schema)>)
BulkDeleteResponse object {id } id: string formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_delete_response%20%3E%20(schema)>) #### Email SecurityInvestigateBulkCancel ##### [Cancel a bulk action job](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/bulk/subresources/cancel/methods/create) POST/accounts/{account\_id}/email-security/investigate/bulk/{job\_id}/cancel ##### ModelsExpand Collapse
CancelCreateResponse object {action\_params, action\_type, created\_at, 13 more }
action\_params: object {destination, type, expected\_disposition } or object {type } One of the following:
Move object {destination, type, expected\_disposition }
destination: "Inbox"or "JunkEmail"or "DeletedItems"or 2 more The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: "MOVE" Link to this property
Deprecatedexpected\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
Release object {type } type: "RELEASE" Link to this property
Link to this property
Link to this property
action\_type: "MOVE"or "RELEASE" One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: string formatdate-time Link to this property job\_id: string formatuuid Link to this property messages\_cancelled: number Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: number Link to this property messages\_pending: number Link to this property messages\_skipped: number Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: number Link to this property
search\_params: object {action\_log, alert\_id, delivery\_status, 15 more } Deprecatedaction\_log: optional boolean Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id: optional string Alert ID of the detection to filter by. Link to this property
delivery\_status: optional "delivered"or "moved"or "quarantined"or 5 more Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only: optional boolean Whether to include only detections in search results. Link to this property domain: optional string Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end: optional string End of search date range. formatdate-time Link to this property exact\_subject: optional string Match messages whose subject line equals this value exactly. Link to this property
final\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action: optional "PREVIEW"or "QUARANTINE\_RELEASED"or "MOVED" Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id: optional string Message-ID header value to filter by. Link to this property metric: optional string Metric name to filter the search by. Link to this property query: optional string Space-delimited search term. Case-insensitive. Link to this property recipient: optional string Match messages whose recipient is this email address or domain. Link to this property sender: optional string Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip: optional string Matches messages whose SMTP HELO server IP address equals this value. Link to this property start: optional string Beginning of search date range. formatdate-time Link to this property subject: optional string Match messages whose subject contains these keywords, in any order. Link to this property submissions: optional boolean Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: "PENDING"or "DISCOVERING"or "PROCESSING"or 3 more Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: number Link to this property comment: optional string Link to this property completed\_at: optional string formatdate-time Link to this property started\_at: optional string formatdate-time Link to this property status\_message: optional string Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk.cancel%20%3E%20(model)%20cancel_create_response%20%3E%20(schema)>) #### Email SecurityInvestigateBulkMessages ##### [List messages for a bulk action job](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/bulk/subresources/messages/methods/list) GET/accounts/{account\_id}/email-security/investigate/bulk/{job\_id}/messages ##### ModelsExpand Collapse
MessageListResponse object {action\_params, action\_type, created\_at, 10 more }
action\_params: object {client\_recipient, destination, type, expected\_disposition } or object {client\_recipient, type } One of the following:
Move object {client\_recipient, destination, type, expected\_disposition } client\_recipient: string Link to this property
destination: "Inbox"or "JunkEmail"or "DeletedItems"or 2 more The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: "MOVE" Link to this property
Deprecatedexpected\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
Release object {client\_recipient, type } client\_recipient: string Link to this property type: "RELEASE" Link to this property
Link to this property
Link to this property
action\_type: "MOVE"or "RELEASE" One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: string formatdate-time Link to this property message\_id: string formatuuid Link to this property postfix\_id: string Link to this property retry\_count: number Link to this property
status: "PENDING"or "PROCESSING"or "COMPLETED"or 3 more Status of a message within a bulk action job. One of the following: "PENDING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property "SKIPPED" Link to this property
Link to this property alert\_id: optional string Link to this property email\_message\_id: optional string Link to this property
message: optional object {id, action\_log, client\_recipients, 32 more } id: string Unique identifier for a message retrieved from investigation. Link to this property
Deprecatedaction\_log: array of object {completed\_at, operation, completed\_timestamp, 2 more } Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. completed\_at: string Timestamp when action completed. formatdate-time Link to this property
operation: "MOVE"or "RELEASE"or "RECLASSIFY"or 3 more Type of action performed. One of the following: "MOVE" Link to this property "RELEASE" Link to this property "RECLASSIFY" Link to this property "SUBMISSION" Link to this property "QUARANTINE\_RELEASE" Link to this property "PREVIEW" Link to this property
Link to this property Deprecatedcompleted\_timestamp: optional string Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. Link to this property
properties: optional object {folder, requested\_by } Additional properties for the action. folder: optional string Target folder for move operations. Link to this property requested\_by: optional string User who requested the action. Link to this property
Link to this property status: optional string Status of the action. Link to this property
Link to this property client\_recipients: array of string Link to this property detection\_reasons: array of string Link to this property is\_phish\_submission: boolean Link to this property is\_quarantined: boolean Link to this property postfix\_id: string The identifier of the message. Link to this property
properties: object {allowlisted\_pattern, allowlisted\_pattern\_type, blocklisted\_message, 2 more } Message processing properties. allowlisted\_pattern: optional string Pattern that allowlisted this message. Link to this property
allowlisted\_pattern\_type: optional "quarantine\_release"or "acceptable\_sender"or "allowed\_sender"or 5 more Type of allowlist pattern. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property blocklisted\_message: optional boolean Whether message was blocklisted. Link to this property blocklisted\_pattern: optional string Pattern that blocklisted this message. Link to this property
whitelisted\_pattern\_type: optional "quarantine\_release"or "acceptable\_sender"or "allowed\_sender"or 5 more Legacy field for allowlist pattern type. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property
Link to this property Deprecatedts: string Use scanned_at instead. Deprecated, use scanned_at instead. End of life: November 1, 2026. Link to this property alert\_id: optional string Link to this property
delivery\_mode: optional "DIRECT"or "BCC"or "JOURNAL"or 8 more One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "REVIEW\_SUBMISSION" Link to this property "DMARC\_UNVERIFIED" Link to this property "DMARC\_FAILURE\_REPORT" Link to this property "DMARC\_AGGREGATE\_REPORT" Link to this property "THREAT\_INTEL\_SUBMISSION" Link to this property "SIMULATION\_SUBMISSION" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
delivery\_status: optional array of "delivered"or "moved"or "quarantined"or 5 more One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property edf\_hash: optional string Link to this property envelope\_from: optional string Link to this property envelope\_to: optional array of string Link to this property
final\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Deprecatedfindings: optional array of object {attachment, detail, detection, 6 more } Use the findings field from GET /investigate/{investigate\_id}/detections instead. Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message. attachment: optional string Link to this property detail: optional string Link to this property
detection: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field: optional string Link to this property name: optional string Link to this property portion: optional string Link to this property reason: optional string Link to this property score: optional number formatdouble Link to this property value: optional string Link to this property
Link to this property from: optional string Link to this property from\_name: optional string Link to this property htmltext\_structure\_hash: optional string Link to this property message\_id: optional string Link to this property
post\_delivery\_operations: optional array of "PREVIEW"or "QUARANTINE\_RELEASE"or "SUBMISSION"or "MOVE" Post-delivery operations performed on this message. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASE" Link to this property "SUBMISSION" Link to this property "MOVE" Link to this property
Link to this property postfix\_id\_outbound: optional string Link to this property replyto: optional string Link to this property scanned\_at: optional string When the message was scanned (UTC). formatdate-time Link to this property sent\_at: optional string When the message was sent (UTC). formatdate-time Link to this property sent\_date: optional string Link to this property smtp\_helo\_server\_ip: optional string Link to this property smtp\_previous\_hop\_ip: optional string Link to this property subject: optional string Link to this property threat\_categories: optional array of string Link to this property to: optional array of string Link to this property to\_name: optional array of string Link to this property
validation: optional object {comment, dkim, dmarc, spf } comment: optional string Link to this property
dkim: optional "pass"or "neutral"or "fail"or 2 more One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc: optional "pass"or "neutral"or "fail"or 2 more One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf: optional "pass"or "neutral"or "fail"or 2 more One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property x\_originating\_ip: optional string Link to this property
Link to this property processed\_at: optional string formatdate-time Link to this property retry\_after: optional string When to retry the action if it failed. formatdate-time Link to this property status\_message: optional string Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk.messages%20%3E%20(model)%20message_list_response%20%3E%20(schema)>) #### Email SecurityPhishguard #### Email SecurityPhishguardReports ##### [List PhishGuard reports](https://developers.cloudflare.com/api/resources/email_security/subresources/phishguard/subresources/reports/methods/list) GET/accounts/{account\_id}/email-security/phishguard/reports ##### ModelsExpand Collapse
ReportListResponse object {id, content, disposition, 7 more } id: number Link to this property content: string Link to this property
disposition: "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
fields: object {to, from, occurred\_at, 2 more } to: array of string Link to this property from: optional string Link to this property occurred\_at: optional string formatdate-time Link to this property postfix\_id: optional string Link to this property Deprecatedts: optional string Use occurred_at instead. Deprecated, use occurred_at instead. formatdate-time Link to this property
Link to this property priority: string Link to this property title: string Link to this property created\_at: optional string formatdate-time Link to this property
tags: optional array of object {category, value } category: string Link to this property value: string Link to this property
Link to this property Deprecatedts: optional string Use created_at instead. Deprecated, use created_at instead. formatdate-time Link to this property updated\_at: optional string formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.phishguard.reports%20%3E%20(model)%20report_list_response%20%3E%20(schema)>) #### Email SecuritySettings #### Email SecuritySettingsAllow Policies ##### [List email allow policies](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/allow_policies/methods/list) GET/accounts/{account\_id}/email-security/settings/allow\_policies ##### [Get an email allow policy](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/allow_policies/methods/get) GET/accounts/{account\_id}/email-security/settings/allow\_policies/{policy\_id} ##### [Create email allow policy](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/allow_policies/methods/create) POST/accounts/{account\_id}/email-security/settings/allow\_policies ##### [Update an email allow policy](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/allow_policies/methods/edit) PATCH/accounts/{account\_id}/email-security/settings/allow\_policies/{policy\_id} ##### [Delete an email allow policy](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/allow_policies/methods/delete) DELETE/accounts/{account\_id}/email-security/settings/allow\_policies/{policy\_id} ##### [Batch allow policy operations](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/allow_policies/methods/batch) POST/accounts/{account\_id}/email-security/settings/allow\_policies/batch ##### ModelsExpand Collapse
AllowPolicyListResponse object {id, created\_at, last\_modified, 12 more } An email allow policy. id: string Allow policy identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property Deprecatedlast\_modified: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments: optional string maxLength1024 Link to this property is\_acceptable\_sender: optional boolean Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient: optional boolean Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient: optional boolean Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex: optional boolean Link to this property Deprecatedis\_sender: optional boolean Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof: optional boolean Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender: optional boolean Bypasses all detections and link following for messages from this sender. Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: optional "EMAIL"or "DOMAIN"or "IP"or "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender: optional boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_list_response%20%3E%20(schema)>)
AllowPolicyGetResponse object {id, created\_at, last\_modified, 12 more } An email allow policy. id: string Allow policy identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property Deprecatedlast\_modified: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments: optional string maxLength1024 Link to this property is\_acceptable\_sender: optional boolean Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient: optional boolean Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient: optional boolean Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex: optional boolean Link to this property Deprecatedis\_sender: optional boolean Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof: optional boolean Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender: optional boolean Bypasses all detections and link following for messages from this sender. Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: optional "EMAIL"or "DOMAIN"or "IP"or "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender: optional boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_get_response%20%3E%20(schema)>)
AllowPolicyCreateResponse object {id, created\_at, last\_modified, 12 more } An email allow policy. id: string Allow policy identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property Deprecatedlast\_modified: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments: optional string maxLength1024 Link to this property is\_acceptable\_sender: optional boolean Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient: optional boolean Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient: optional boolean Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex: optional boolean Link to this property Deprecatedis\_sender: optional boolean Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof: optional boolean Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender: optional boolean Bypasses all detections and link following for messages from this sender. Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: optional "EMAIL"or "DOMAIN"or "IP"or "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender: optional boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_create_response%20%3E%20(schema)>)
AllowPolicyEditResponse object {id, created\_at, last\_modified, 12 more } An email allow policy. id: string Allow policy identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property Deprecatedlast\_modified: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments: optional string maxLength1024 Link to this property is\_acceptable\_sender: optional boolean Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient: optional boolean Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient: optional boolean Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex: optional boolean Link to this property Deprecatedis\_sender: optional boolean Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof: optional boolean Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender: optional boolean Bypasses all detections and link following for messages from this sender. Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: optional "EMAIL"or "DOMAIN"or "IP"or "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender: optional boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_edit_response%20%3E%20(schema)>)
AllowPolicyDeleteResponse object {id } id: string Allow policy identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_delete_response%20%3E%20(schema)>)
AllowPolicyBatchResponse object {deletes, patches, posts, puts }
deletes: optional array of object {id } id: string Allow policy identifier. formatuuid Link to this property
Link to this property
patches: optional array of object {id, created\_at, last\_modified, 12 more } id: string Allow policy identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property Deprecatedlast\_modified: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments: optional string maxLength1024 Link to this property is\_acceptable\_sender: optional boolean Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient: optional boolean Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient: optional boolean Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex: optional boolean Link to this property Deprecatedis\_sender: optional boolean Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof: optional boolean Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender: optional boolean Bypasses all detections and link following for messages from this sender. Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: optional "EMAIL"or "DOMAIN"or "IP"or "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender: optional boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
Link to this property
posts: optional array of object {id, created\_at, last\_modified, 12 more } id: string Allow policy identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property Deprecatedlast\_modified: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments: optional string maxLength1024 Link to this property is\_acceptable\_sender: optional boolean Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient: optional boolean Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient: optional boolean Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex: optional boolean Link to this property Deprecatedis\_sender: optional boolean Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof: optional boolean Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender: optional boolean Bypasses all detections and link following for messages from this sender. Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: optional "EMAIL"or "DOMAIN"or "IP"or "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender: optional boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
Link to this property
puts: optional array of object {id, created\_at, last\_modified, 12 more } id: string Allow policy identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property Deprecatedlast\_modified: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments: optional string maxLength1024 Link to this property is\_acceptable\_sender: optional boolean Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient: optional boolean Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient: optional boolean Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex: optional boolean Link to this property Deprecatedis\_sender: optional boolean Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof: optional boolean Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender: optional boolean Bypasses all detections and link following for messages from this sender. Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: optional "EMAIL"or "DOMAIN"or "IP"or "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender: optional boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_batch_response%20%3E%20(schema)>) #### Email SecuritySettingsBlock Senders ##### [List blocked email senders](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/block_senders/methods/list) GET/accounts/{account\_id}/email-security/settings/block\_senders ##### [Get a blocked email sender](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/block_senders/methods/get) GET/accounts/{account\_id}/email-security/settings/block\_senders/{pattern\_id} ##### [Create blocked email sender](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/block_senders/methods/create) POST/accounts/{account\_id}/email-security/settings/block\_senders ##### [Update a blocked email sender](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/block_senders/methods/edit) PATCH/accounts/{account\_id}/email-security/settings/block\_senders/{pattern\_id} ##### [Delete a blocked email sender](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/block_senders/methods/delete) DELETE/accounts/{account\_id}/email-security/settings/block\_senders/{pattern\_id} ##### [Batch blocked sender operations](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/block_senders/methods/batch) POST/accounts/{account\_id}/email-security/settings/block\_senders/batch ##### ModelsExpand Collapse
BlockSenderListResponse object {id, comments, created\_at, 5 more } A blocked sender pattern. id: optional string Blocked sender pattern identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property is\_regex: optional boolean Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: optional "EMAIL"or "DOMAIN"or "IP"or "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_list_response%20%3E%20(schema)>)
BlockSenderGetResponse object {id, comments, created\_at, 5 more } A blocked sender pattern. id: optional string Blocked sender pattern identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property is\_regex: optional boolean Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: optional "EMAIL"or "DOMAIN"or "IP"or "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_get_response%20%3E%20(schema)>)
BlockSenderCreateResponse object {id, comments, created\_at, 5 more } A blocked sender pattern. id: optional string Blocked sender pattern identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property is\_regex: optional boolean Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: optional "EMAIL"or "DOMAIN"or "IP"or "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_create_response%20%3E%20(schema)>)
BlockSenderEditResponse object {id, comments, created\_at, 5 more } A blocked sender pattern. id: optional string Blocked sender pattern identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property is\_regex: optional boolean Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: optional "EMAIL"or "DOMAIN"or "IP"or "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_edit_response%20%3E%20(schema)>)
BlockSenderDeleteResponse object {id } id: string Blocked sender pattern identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_delete_response%20%3E%20(schema)>)
BlockSenderBatchResponse object {deletes, patches, posts, puts }
deletes: optional array of object {id } id: string Blocked sender pattern identifier. formatuuid Link to this property
Link to this property
patches: optional array of object {id, comments, created\_at, 5 more } id: optional string Blocked sender pattern identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property is\_regex: optional boolean Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: optional "EMAIL"or "DOMAIN"or "IP"or "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
Link to this property
posts: optional array of object {id, comments, created\_at, 5 more } id: optional string Blocked sender pattern identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property is\_regex: optional boolean Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: optional "EMAIL"or "DOMAIN"or "IP"or "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
Link to this property
puts: optional array of object {id, comments, created\_at, 5 more } id: optional string Blocked sender pattern identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property is\_regex: optional boolean Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type: optional "EMAIL"or "DOMAIN"or "IP"or "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_batch_response%20%3E%20(schema)>) #### Email SecuritySettingsContent Policies ##### [List content policies](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/content_policies/methods/list) GET/accounts/{account\_id}/email-security/settings/content\_policies ##### [Get a content policy](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/content_policies/methods/get) GET/accounts/{account\_id}/email-security/settings/content\_policies/{policy\_id} ##### [Create a content policy](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/content_policies/methods/create) POST/accounts/{account\_id}/email-security/settings/content\_policies ##### [Update a content policy](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/content_policies/methods/edit) PATCH/accounts/{account\_id}/email-security/settings/content\_policies/{policy\_id} ##### [Delete a content policy](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/content_policies/methods/delete) DELETE/accounts/{account\_id}/email-security/settings/content\_policies/{policy\_id} ##### [Batch content policy operations](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/content_policies/methods/batch) POST/accounts/{account\_id}/email-security/settings/content\_policies/batch ##### ModelsExpand Collapse
ContentPolicyListResponse object {id, created\_at, enabled, 5 more } A content policy pattern that matches against the subject or body of an email. id: optional string Content policy identifier. formatuuid Link to this property created\_at: optional string formatdate-time Link to this property enabled: optional boolean Whether the policy is active. Link to this property modified\_at: optional string formatdate-time Link to this property name: optional string Human-readable name of the policy. maxLength256 minLength1 Link to this property notes: optional string Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern: optional string Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets: optional array of "SUBJECT"or "BODY" Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_list_response%20%3E%20(schema)>)
ContentPolicyGetResponse object {id, created\_at, enabled, 5 more } A content policy pattern that matches against the subject or body of an email. id: optional string Content policy identifier. formatuuid Link to this property created\_at: optional string formatdate-time Link to this property enabled: optional boolean Whether the policy is active. Link to this property modified\_at: optional string formatdate-time Link to this property name: optional string Human-readable name of the policy. maxLength256 minLength1 Link to this property notes: optional string Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern: optional string Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets: optional array of "SUBJECT"or "BODY" Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_get_response%20%3E%20(schema)>)
ContentPolicyCreateResponse object {id, created\_at, enabled, 5 more } A content policy pattern that matches against the subject or body of an email. id: optional string Content policy identifier. formatuuid Link to this property created\_at: optional string formatdate-time Link to this property enabled: optional boolean Whether the policy is active. Link to this property modified\_at: optional string formatdate-time Link to this property name: optional string Human-readable name of the policy. maxLength256 minLength1 Link to this property notes: optional string Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern: optional string Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets: optional array of "SUBJECT"or "BODY" Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_create_response%20%3E%20(schema)>)
ContentPolicyEditResponse object {id, created\_at, enabled, 5 more } A content policy pattern that matches against the subject or body of an email. id: optional string Content policy identifier. formatuuid Link to this property created\_at: optional string formatdate-time Link to this property enabled: optional boolean Whether the policy is active. Link to this property modified\_at: optional string formatdate-time Link to this property name: optional string Human-readable name of the policy. maxLength256 minLength1 Link to this property notes: optional string Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern: optional string Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets: optional array of "SUBJECT"or "BODY" Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_edit_response%20%3E%20(schema)>)
ContentPolicyDeleteResponse object {id } id: string Content policy identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_delete_response%20%3E%20(schema)>)
ContentPolicyBatchResponse object {deletes, patches, posts, puts }
deletes: optional array of object {id } id: string Content policy identifier. formatuuid Link to this property
Link to this property
patches: optional array of object {id, created\_at, enabled, 5 more } id: optional string Content policy identifier. formatuuid Link to this property created\_at: optional string formatdate-time Link to this property enabled: optional boolean Whether the policy is active. Link to this property modified\_at: optional string formatdate-time Link to this property name: optional string Human-readable name of the policy. maxLength256 minLength1 Link to this property notes: optional string Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern: optional string Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets: optional array of "SUBJECT"or "BODY" Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
Link to this property
posts: optional array of object {id, created\_at, enabled, 5 more } id: optional string Content policy identifier. formatuuid Link to this property created\_at: optional string formatdate-time Link to this property enabled: optional boolean Whether the policy is active. Link to this property modified\_at: optional string formatdate-time Link to this property name: optional string Human-readable name of the policy. maxLength256 minLength1 Link to this property notes: optional string Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern: optional string Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets: optional array of "SUBJECT"or "BODY" Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
Link to this property
puts: optional array of object {id, created\_at, enabled, 5 more } id: optional string Content policy identifier. formatuuid Link to this property created\_at: optional string formatdate-time Link to this property enabled: optional boolean Whether the policy is active. Link to this property modified\_at: optional string formatdate-time Link to this property name: optional string Human-readable name of the policy. maxLength256 minLength1 Link to this property notes: optional string Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern: optional string Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets: optional array of "SUBJECT"or "BODY" Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_batch_response%20%3E%20(schema)>) #### Email SecuritySettingsDomains ##### [List protected email domains](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/domains/methods/list) GET/accounts/{account\_id}/email-security/settings/domains ##### [Get an email domain](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/domains/methods/get) GET/accounts/{account\_id}/email-security/settings/domains/{domain\_id} ##### [Replace an email domain](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/domains/methods/update) PUT/accounts/{account\_id}/email-security/settings/domains/{domain\_id} ##### [Update an email domain](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/domains/methods/edit) PATCH/accounts/{account\_id}/email-security/settings/domains/{domain\_id} ##### [Add a new email domain](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/domains/methods/create) POST/accounts/{account\_id}/email-security/settings/domains ##### [Unprotect an email domain](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/domains/methods/delete) DELETE/accounts/{account\_id}/email-security/settings/domains/{domain\_id} ##### [Batch domain operations](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/domains/methods/batch) POST/accounts/{account\_id}/email-security/settings/domains/batch ##### [Unprotect multiple email domains](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/domains/methods/bulk_delete) Deprecated DELETE/accounts/{account\_id}/email-security/settings/domains ##### ModelsExpand Collapse
DomainListResponse object {id, allowed\_delivery\_modes, authorization, 19 more } id: optional string Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes: optional array of "DIRECT"or "BCC"or "JOURNAL"or 2 more One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization: optional object {authorized, timestamp, status\_message } authorized: boolean Link to this property timestamp: string formatdate-time Link to this property status\_message: optional string Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property
dmarc\_status: optional "none"or "good"or "invalid" One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain: optional string Link to this property
drop\_dispositions: optional array of "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed: optional object {timestamp, total\_emails\_processed, total\_emails\_processed\_previous } timestamp: string formatdate-time Link to this property total\_emails\_processed: number minimum0 Link to this property total\_emails\_processed\_previous: number minimum0 Link to this property
Link to this property
folder: optional "AllItems"or "Inbox" The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider: optional "Microsoft"or "Google" One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id: optional string formatuuid Link to this property ip\_restrictions: optional array of string Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops: optional number Link to this property modified\_at: optional string formatdate-time Link to this property o365\_tenant\_id: optional string Link to this property
regions: optional array of "GLOBAL"or "AU"or "DE"or 2 more One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound: optional boolean Link to this property require\_tls\_outbound: optional boolean Link to this property
spf\_status: optional "none"or "good"or "neutral"or 2 more One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status: optional "PENDING"or "ACTIVE"or "FAILED"or "TIMEOUT" One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport: optional string Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_list_response%20%3E%20(schema)>)
DomainGetResponse object {id, allowed\_delivery\_modes, authorization, 19 more } id: optional string Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes: optional array of "DIRECT"or "BCC"or "JOURNAL"or 2 more One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization: optional object {authorized, timestamp, status\_message } authorized: boolean Link to this property timestamp: string formatdate-time Link to this property status\_message: optional string Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property
dmarc\_status: optional "none"or "good"or "invalid" One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain: optional string Link to this property
drop\_dispositions: optional array of "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed: optional object {timestamp, total\_emails\_processed, total\_emails\_processed\_previous } timestamp: string formatdate-time Link to this property total\_emails\_processed: number minimum0 Link to this property total\_emails\_processed\_previous: number minimum0 Link to this property
Link to this property
folder: optional "AllItems"or "Inbox" The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider: optional "Microsoft"or "Google" One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id: optional string formatuuid Link to this property ip\_restrictions: optional array of string Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops: optional number Link to this property modified\_at: optional string formatdate-time Link to this property o365\_tenant\_id: optional string Link to this property
regions: optional array of "GLOBAL"or "AU"or "DE"or 2 more One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound: optional boolean Link to this property require\_tls\_outbound: optional boolean Link to this property
spf\_status: optional "none"or "good"or "neutral"or 2 more One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status: optional "PENDING"or "ACTIVE"or "FAILED"or "TIMEOUT" One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport: optional string Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_get_response%20%3E%20(schema)>)
DomainUpdateResponse object {id, allowed\_delivery\_modes, authorization, 19 more } id: optional string Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes: optional array of "DIRECT"or "BCC"or "JOURNAL"or 2 more One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization: optional object {authorized, timestamp, status\_message } authorized: boolean Link to this property timestamp: string formatdate-time Link to this property status\_message: optional string Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property
dmarc\_status: optional "none"or "good"or "invalid" One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain: optional string Link to this property
drop\_dispositions: optional array of "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed: optional object {timestamp, total\_emails\_processed, total\_emails\_processed\_previous } timestamp: string formatdate-time Link to this property total\_emails\_processed: number minimum0 Link to this property total\_emails\_processed\_previous: number minimum0 Link to this property
Link to this property
folder: optional "AllItems"or "Inbox" The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider: optional "Microsoft"or "Google" One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id: optional string formatuuid Link to this property ip\_restrictions: optional array of string Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops: optional number Link to this property modified\_at: optional string formatdate-time Link to this property o365\_tenant\_id: optional string Link to this property
regions: optional array of "GLOBAL"or "AU"or "DE"or 2 more One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound: optional boolean Link to this property require\_tls\_outbound: optional boolean Link to this property
spf\_status: optional "none"or "good"or "neutral"or 2 more One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status: optional "PENDING"or "ACTIVE"or "FAILED"or "TIMEOUT" One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport: optional string Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_update_response%20%3E%20(schema)>)
DomainEditResponse object {id, allowed\_delivery\_modes, authorization, 19 more } id: optional string Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes: optional array of "DIRECT"or "BCC"or "JOURNAL"or 2 more One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization: optional object {authorized, timestamp, status\_message } authorized: boolean Link to this property timestamp: string formatdate-time Link to this property status\_message: optional string Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property
dmarc\_status: optional "none"or "good"or "invalid" One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain: optional string Link to this property
drop\_dispositions: optional array of "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed: optional object {timestamp, total\_emails\_processed, total\_emails\_processed\_previous } timestamp: string formatdate-time Link to this property total\_emails\_processed: number minimum0 Link to this property total\_emails\_processed\_previous: number minimum0 Link to this property
Link to this property
folder: optional "AllItems"or "Inbox" The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider: optional "Microsoft"or "Google" One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id: optional string formatuuid Link to this property ip\_restrictions: optional array of string Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops: optional number Link to this property modified\_at: optional string formatdate-time Link to this property o365\_tenant\_id: optional string Link to this property
regions: optional array of "GLOBAL"or "AU"or "DE"or 2 more One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound: optional boolean Link to this property require\_tls\_outbound: optional boolean Link to this property
spf\_status: optional "none"or "good"or "neutral"or 2 more One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status: optional "PENDING"or "ACTIVE"or "FAILED"or "TIMEOUT" One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport: optional string Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_edit_response%20%3E%20(schema)>)
DomainCreateResponse object {id, allowed\_delivery\_modes, authorization, 19 more } id: optional string Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes: optional array of "DIRECT"or "BCC"or "JOURNAL"or 2 more One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization: optional object {authorized, timestamp, status\_message } authorized: boolean Link to this property timestamp: string formatdate-time Link to this property status\_message: optional string Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property
dmarc\_status: optional "none"or "good"or "invalid" One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain: optional string Link to this property
drop\_dispositions: optional array of "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed: optional object {timestamp, total\_emails\_processed, total\_emails\_processed\_previous } timestamp: string formatdate-time Link to this property total\_emails\_processed: number minimum0 Link to this property total\_emails\_processed\_previous: number minimum0 Link to this property
Link to this property
folder: optional "AllItems"or "Inbox" The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider: optional "Microsoft"or "Google" One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id: optional string formatuuid Link to this property ip\_restrictions: optional array of string Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops: optional number Link to this property modified\_at: optional string formatdate-time Link to this property o365\_tenant\_id: optional string Link to this property
regions: optional array of "GLOBAL"or "AU"or "DE"or 2 more One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound: optional boolean Link to this property require\_tls\_outbound: optional boolean Link to this property
spf\_status: optional "none"or "good"or "neutral"or 2 more One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status: optional "PENDING"or "ACTIVE"or "FAILED"or "TIMEOUT" One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport: optional string Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_create_response%20%3E%20(schema)>)
DomainDeleteResponse object {id } id: string Domain identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_delete_response%20%3E%20(schema)>)
DomainBatchResponse object {deletes, patches, posts, puts }
deletes: array of object {id } id: string Domain identifier. formatuuid Link to this property
Link to this property
patches: array of object {id, allowed\_delivery\_modes, authorization, 19 more } id: optional string Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes: optional array of "DIRECT"or "BCC"or "JOURNAL"or 2 more One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization: optional object {authorized, timestamp, status\_message } authorized: boolean Link to this property timestamp: string formatdate-time Link to this property status\_message: optional string Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property
dmarc\_status: optional "none"or "good"or "invalid" One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain: optional string Link to this property
drop\_dispositions: optional array of "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed: optional object {timestamp, total\_emails\_processed, total\_emails\_processed\_previous } timestamp: string formatdate-time Link to this property total\_emails\_processed: number minimum0 Link to this property total\_emails\_processed\_previous: number minimum0 Link to this property
Link to this property
folder: optional "AllItems"or "Inbox" The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider: optional "Microsoft"or "Google" One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id: optional string formatuuid Link to this property ip\_restrictions: optional array of string Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops: optional number Link to this property modified\_at: optional string formatdate-time Link to this property o365\_tenant\_id: optional string Link to this property
regions: optional array of "GLOBAL"or "AU"or "DE"or 2 more One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound: optional boolean Link to this property require\_tls\_outbound: optional boolean Link to this property
spf\_status: optional "none"or "good"or "neutral"or 2 more One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status: optional "PENDING"or "ACTIVE"or "FAILED"or "TIMEOUT" One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport: optional string Link to this property
Link to this property
posts: array of object {id, allowed\_delivery\_modes, authorization, 19 more } id: optional string Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes: optional array of "DIRECT"or "BCC"or "JOURNAL"or 2 more One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization: optional object {authorized, timestamp, status\_message } authorized: boolean Link to this property timestamp: string formatdate-time Link to this property status\_message: optional string Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property
dmarc\_status: optional "none"or "good"or "invalid" One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain: optional string Link to this property
drop\_dispositions: optional array of "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed: optional object {timestamp, total\_emails\_processed, total\_emails\_processed\_previous } timestamp: string formatdate-time Link to this property total\_emails\_processed: number minimum0 Link to this property total\_emails\_processed\_previous: number minimum0 Link to this property
Link to this property
folder: optional "AllItems"or "Inbox" The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider: optional "Microsoft"or "Google" One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id: optional string formatuuid Link to this property ip\_restrictions: optional array of string Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops: optional number Link to this property modified\_at: optional string formatdate-time Link to this property o365\_tenant\_id: optional string Link to this property
regions: optional array of "GLOBAL"or "AU"or "DE"or 2 more One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound: optional boolean Link to this property require\_tls\_outbound: optional boolean Link to this property
spf\_status: optional "none"or "good"or "neutral"or 2 more One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status: optional "PENDING"or "ACTIVE"or "FAILED"or "TIMEOUT" One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport: optional string Link to this property
Link to this property
puts: array of object {id, allowed\_delivery\_modes, authorization, 19 more } id: optional string Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes: optional array of "DIRECT"or "BCC"or "JOURNAL"or 2 more One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization: optional object {authorized, timestamp, status\_message } authorized: boolean Link to this property timestamp: string formatdate-time Link to this property status\_message: optional string Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property
dmarc\_status: optional "none"or "good"or "invalid" One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain: optional string Link to this property
drop\_dispositions: optional array of "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed: optional object {timestamp, total\_emails\_processed, total\_emails\_processed\_previous } timestamp: string formatdate-time Link to this property total\_emails\_processed: number minimum0 Link to this property total\_emails\_processed\_previous: number minimum0 Link to this property
Link to this property
folder: optional "AllItems"or "Inbox" The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider: optional "Microsoft"or "Google" One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id: optional string formatuuid Link to this property ip\_restrictions: optional array of string Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops: optional number Link to this property modified\_at: optional string formatdate-time Link to this property o365\_tenant\_id: optional string Link to this property
regions: optional array of "GLOBAL"or "AU"or "DE"or 2 more One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound: optional boolean Link to this property require\_tls\_outbound: optional boolean Link to this property
spf\_status: optional "none"or "good"or "neutral"or 2 more One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status: optional "PENDING"or "ACTIVE"or "FAILED"or "TIMEOUT" One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport: optional string Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_batch_response%20%3E%20(schema)>)
DomainBulkDeleteResponse object {id } id: string Domain identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_bulk_delete_response%20%3E%20(schema)>) #### Email SecuritySettingsImpersonation Registry ##### [List impersonation registry entries](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/impersonation_registry/methods/list) GET/accounts/{account\_id}/email-security/settings/impersonation\_registry ##### [Get an impersonation registry entry](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/impersonation_registry/methods/get) GET/accounts/{account\_id}/email-security/settings/impersonation\_registry/{impersonation\_registry\_id} ##### [Create impersonation registry entry](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/impersonation_registry/methods/create) POST/accounts/{account\_id}/email-security/settings/impersonation\_registry ##### [Update an impersonation registry entry](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/impersonation_registry/methods/edit) PATCH/accounts/{account\_id}/email-security/settings/impersonation\_registry/{impersonation\_registry\_id} ##### [Delete an impersonation registry entry](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/impersonation_registry/methods/delete) DELETE/accounts/{account\_id}/email-security/settings/impersonation\_registry/{impersonation\_registry\_id} ##### ModelsExpand Collapse
ImpersonationRegistryListResponse object {id, comments, created\_at, 9 more } An impersonation registry entry. id: optional string Impersonation registry entry identifier. formatuuid Link to this property comments: optional string Optional note describing the entry. Link to this property created\_at: optional string formatdate-time Link to this property directory\_id: optional number Identifier of the directory the entry was synced from, when directory-synced. Link to this property directory\_node\_id: optional number Identifier of the directory node the entry was synced from, when directory-synced. Link to this property email: optional string Email address (or pattern) of the protected identity. Link to this property Deprecatedexternal\_directory\_node\_id: optional string This field is deprecated. Deprecated. External identifier of the directory node. Link to this property is\_email\_regex: optional boolean Whether email is a regular expression instead of a literal address. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property name: optional string Display name of the protected identity. maxLength1024 Link to this property
provenance: optional "A1S\_INTERNAL"or "SNOOPY-CASB\_OFFICE\_365"or "SNOOPY-OFFICE\_365"or "SNOOPY-GOOGLE\_DIRECTORY" Source the entry was created from. One of the following: "A1S\_INTERNAL" Link to this property "SNOOPY-CASB\_OFFICE\_365" Link to this property "SNOOPY-OFFICE\_365" Link to this property "SNOOPY-GOOGLE\_DIRECTORY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.impersonation_registry%20%3E%20(model)%20impersonation_registry_list_response%20%3E%20(schema)>)
ImpersonationRegistryGetResponse object {id, comments, created\_at, 9 more } An impersonation registry entry. id: optional string Impersonation registry entry identifier. formatuuid Link to this property comments: optional string Optional note describing the entry. Link to this property created\_at: optional string formatdate-time Link to this property directory\_id: optional number Identifier of the directory the entry was synced from, when directory-synced. Link to this property directory\_node\_id: optional number Identifier of the directory node the entry was synced from, when directory-synced. Link to this property email: optional string Email address (or pattern) of the protected identity. Link to this property Deprecatedexternal\_directory\_node\_id: optional string This field is deprecated. Deprecated. External identifier of the directory node. Link to this property is\_email\_regex: optional boolean Whether email is a regular expression instead of a literal address. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property name: optional string Display name of the protected identity. maxLength1024 Link to this property
provenance: optional "A1S\_INTERNAL"or "SNOOPY-CASB\_OFFICE\_365"or "SNOOPY-OFFICE\_365"or "SNOOPY-GOOGLE\_DIRECTORY" Source the entry was created from. One of the following: "A1S\_INTERNAL" Link to this property "SNOOPY-CASB\_OFFICE\_365" Link to this property "SNOOPY-OFFICE\_365" Link to this property "SNOOPY-GOOGLE\_DIRECTORY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.impersonation_registry%20%3E%20(model)%20impersonation_registry_get_response%20%3E%20(schema)>)
ImpersonationRegistryCreateResponse object {id, comments, created\_at, 9 more } An impersonation registry entry. id: optional string Impersonation registry entry identifier. formatuuid Link to this property comments: optional string Optional note describing the entry. Link to this property created\_at: optional string formatdate-time Link to this property directory\_id: optional number Identifier of the directory the entry was synced from, when directory-synced. Link to this property directory\_node\_id: optional number Identifier of the directory node the entry was synced from, when directory-synced. Link to this property email: optional string Email address (or pattern) of the protected identity. Link to this property Deprecatedexternal\_directory\_node\_id: optional string This field is deprecated. Deprecated. External identifier of the directory node. Link to this property is\_email\_regex: optional boolean Whether email is a regular expression instead of a literal address. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property name: optional string Display name of the protected identity. maxLength1024 Link to this property
provenance: optional "A1S\_INTERNAL"or "SNOOPY-CASB\_OFFICE\_365"or "SNOOPY-OFFICE\_365"or "SNOOPY-GOOGLE\_DIRECTORY" Source the entry was created from. One of the following: "A1S\_INTERNAL" Link to this property "SNOOPY-CASB\_OFFICE\_365" Link to this property "SNOOPY-OFFICE\_365" Link to this property "SNOOPY-GOOGLE\_DIRECTORY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.impersonation_registry%20%3E%20(model)%20impersonation_registry_create_response%20%3E%20(schema)>)
ImpersonationRegistryEditResponse object {id, comments, created\_at, 9 more } An impersonation registry entry. id: optional string Impersonation registry entry identifier. formatuuid Link to this property comments: optional string Optional note describing the entry. Link to this property created\_at: optional string formatdate-time Link to this property directory\_id: optional number Identifier of the directory the entry was synced from, when directory-synced. Link to this property directory\_node\_id: optional number Identifier of the directory node the entry was synced from, when directory-synced. Link to this property email: optional string Email address (or pattern) of the protected identity. Link to this property Deprecatedexternal\_directory\_node\_id: optional string This field is deprecated. Deprecated. External identifier of the directory node. Link to this property is\_email\_regex: optional boolean Whether email is a regular expression instead of a literal address. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property name: optional string Display name of the protected identity. maxLength1024 Link to this property
provenance: optional "A1S\_INTERNAL"or "SNOOPY-CASB\_OFFICE\_365"or "SNOOPY-OFFICE\_365"or "SNOOPY-GOOGLE\_DIRECTORY" Source the entry was created from. One of the following: "A1S\_INTERNAL" Link to this property "SNOOPY-CASB\_OFFICE\_365" Link to this property "SNOOPY-OFFICE\_365" Link to this property "SNOOPY-GOOGLE\_DIRECTORY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.impersonation_registry%20%3E%20(model)%20impersonation_registry_edit_response%20%3E%20(schema)>)
ImpersonationRegistryDeleteResponse object {id } id: string Impersonation registry entry identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.impersonation_registry%20%3E%20(model)%20impersonation_registry_delete_response%20%3E%20(schema)>) #### Email SecuritySettingsSending Domain Restrictions ##### [List sending domain restrictions](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/sending_domain_restrictions/methods/list) GET/accounts/{account\_id}/email-security/settings/sending\_domain\_restrictions ##### [Get a sending domain restriction](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/sending_domain_restrictions/methods/get) GET/accounts/{account\_id}/email-security/settings/sending\_domain\_restrictions/{sending\_domain\_restriction\_id} ##### [Create a sending domain restriction](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/sending_domain_restrictions/methods/create) POST/accounts/{account\_id}/email-security/settings/sending\_domain\_restrictions ##### [Update a sending domain restriction](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/sending_domain_restrictions/methods/edit) PATCH/accounts/{account\_id}/email-security/settings/sending\_domain\_restrictions/{sending\_domain\_restriction\_id} ##### [Delete a sending domain restriction](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/sending_domain_restrictions/methods/delete) DELETE/accounts/{account\_id}/email-security/settings/sending\_domain\_restrictions/{sending\_domain\_restriction\_id} ##### ModelsExpand Collapse
SendingDomainRestrictionListResponse object {id, comments, created\_at, 4 more } A sending domain restriction that enforces TLS (Transport Layer Security) requirements for emails from specific domains. If TLS is required, the system drops mail without TLS from the specified domain. id: optional string Sending domain restriction identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property domain: optional string Domain that requires TLS enforcement. Link to this property exclude: optional array of string Subdomains to exempt from TLS requirements. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.sending_domain_restrictions%20%3E%20(model)%20sending_domain_restriction_list_response%20%3E%20(schema)>)
SendingDomainRestrictionGetResponse object {id, comments, created\_at, 4 more } A sending domain restriction that enforces TLS (Transport Layer Security) requirements for emails from specific domains. If TLS is required, the system drops mail without TLS from the specified domain. id: optional string Sending domain restriction identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property domain: optional string Domain that requires TLS enforcement. Link to this property exclude: optional array of string Subdomains to exempt from TLS requirements. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.sending_domain_restrictions%20%3E%20(model)%20sending_domain_restriction_get_response%20%3E%20(schema)>)
SendingDomainRestrictionCreateResponse object {id, comments, created\_at, 4 more } A sending domain restriction that enforces TLS (Transport Layer Security) requirements for emails from specific domains. If TLS is required, the system drops mail without TLS from the specified domain. id: optional string Sending domain restriction identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property domain: optional string Domain that requires TLS enforcement. Link to this property exclude: optional array of string Subdomains to exempt from TLS requirements. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.sending_domain_restrictions%20%3E%20(model)%20sending_domain_restriction_create_response%20%3E%20(schema)>)
SendingDomainRestrictionEditResponse object {id, comments, created\_at, 4 more } A sending domain restriction that enforces TLS (Transport Layer Security) requirements for emails from specific domains. If TLS is required, the system drops mail without TLS from the specified domain. id: optional string Sending domain restriction identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property domain: optional string Domain that requires TLS enforcement. Link to this property exclude: optional array of string Subdomains to exempt from TLS requirements. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.sending_domain_restrictions%20%3E%20(model)%20sending_domain_restriction_edit_response%20%3E%20(schema)>)
SendingDomainRestrictionDeleteResponse object {id } id: string Sending domain restriction identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.sending_domain_restrictions%20%3E%20(model)%20sending_domain_restriction_delete_response%20%3E%20(schema)>) #### Email SecuritySettingsTrusted Domains ##### [List trusted email domains](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/trusted_domains/methods/list) GET/accounts/{account\_id}/email-security/settings/trusted\_domains ##### [Get a trusted email domain](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/trusted_domains/methods/get) GET/accounts/{account\_id}/email-security/settings/trusted\_domains/{trusted\_domain\_id} ##### [Create trusted email domain](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/trusted_domains/methods/create) POST/accounts/{account\_id}/email-security/settings/trusted\_domains ##### [Update a trusted email domain](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/trusted_domains/methods/edit) PATCH/accounts/{account\_id}/email-security/settings/trusted\_domains/{trusted\_domain\_id} ##### [Delete a trusted email domain](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/trusted_domains/methods/delete) DELETE/accounts/{account\_id}/email-security/settings/trusted\_domains/{trusted\_domain\_id} ##### [Batch trusted domain operations](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/trusted_domains/methods/batch) POST/accounts/{account\_id}/email-security/settings/trusted\_domains/batch ##### ModelsExpand Collapse
TrustedDomainListResponse object {id, comments, created\_at, 6 more } A trusted email domain. id: optional string Trusted domain identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property is\_recent: optional boolean Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex: optional boolean Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity: optional boolean Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_list_response%20%3E%20(schema)>)
TrustedDomainGetResponse object {id, comments, created\_at, 6 more } A trusted email domain. id: optional string Trusted domain identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property is\_recent: optional boolean Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex: optional boolean Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity: optional boolean Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_get_response%20%3E%20(schema)>)
TrustedDomainCreateResponse object {id, comments, created\_at, 6 more } A trusted email domain. id: optional string Trusted domain identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property is\_recent: optional boolean Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex: optional boolean Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity: optional boolean Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_create_response%20%3E%20(schema)>)
TrustedDomainEditResponse object {id, comments, created\_at, 6 more } A trusted email domain. id: optional string Trusted domain identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property is\_recent: optional boolean Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex: optional boolean Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity: optional boolean Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_edit_response%20%3E%20(schema)>)
TrustedDomainDeleteResponse object {id } id: string Trusted domain identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_delete_response%20%3E%20(schema)>)
TrustedDomainBatchResponse object {deletes, patches, posts, puts }
deletes: optional array of object {id } id: string Trusted domain identifier. formatuuid Link to this property
Link to this property
patches: optional array of object {id, comments, created\_at, 6 more } id: optional string Trusted domain identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property is\_recent: optional boolean Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex: optional boolean Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity: optional boolean Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
Link to this property
posts: optional array of object {id, comments, created\_at, 6 more } id: optional string Trusted domain identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property is\_recent: optional boolean Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex: optional boolean Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity: optional boolean Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
Link to this property
puts: optional array of object {id, comments, created\_at, 6 more } id: optional string Trusted domain identifier. formatuuid Link to this property comments: optional string maxLength1024 Link to this property created\_at: optional string formatdate-time Link to this property is\_recent: optional boolean Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex: optional boolean Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity: optional boolean Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property pattern: optional string The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_batch_response%20%3E%20(schema)>) #### Email SecuritySettingsURL Ignore Patterns ##### [List URL ignore patterns](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/url_ignore_patterns/methods/list) GET/accounts/{account\_id}/email-security/settings/url\_ignore\_patterns ##### [Get a URL ignore pattern](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/url_ignore_patterns/methods/get) GET/accounts/{account\_id}/email-security/settings/url\_ignore\_patterns/{pattern\_id} ##### [Create a URL ignore pattern](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/url_ignore_patterns/methods/create) POST/accounts/{account\_id}/email-security/settings/url\_ignore\_patterns ##### [Update a URL ignore pattern](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/url_ignore_patterns/methods/edit) PATCH/accounts/{account\_id}/email-security/settings/url\_ignore\_patterns/{pattern\_id} ##### [Delete a URL ignore pattern](https://developers.cloudflare.com/api/resources/email_security/subresources/settings/subresources/url_ignore_patterns/methods/delete) DELETE/accounts/{account\_id}/email-security/settings/url\_ignore\_patterns/{pattern\_id} ##### ModelsExpand Collapse
URLIgnorePatternListResponse object {id, created\_at, pattern, 3 more } A URL ignore pattern that exempts matching URLs from Email Security’s URL rewriting. id: string URL ignore pattern identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property pattern: string Regular expression identifying URLs to exempt from rewriting. maxLength1024 minLength1 Link to this property comments: optional string Optional note describing the reason for the ignore pattern. maxLength1024 Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.url_ignore_patterns%20%3E%20(model)%20url_ignore_pattern_list_response%20%3E%20(schema)>)
URLIgnorePatternGetResponse object {id, created\_at, pattern, 3 more } A URL ignore pattern that exempts matching URLs from Email Security’s URL rewriting. id: string URL ignore pattern identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property pattern: string Regular expression identifying URLs to exempt from rewriting. maxLength1024 minLength1 Link to this property comments: optional string Optional note describing the reason for the ignore pattern. maxLength1024 Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.url_ignore_patterns%20%3E%20(model)%20url_ignore_pattern_get_response%20%3E%20(schema)>)
URLIgnorePatternCreateResponse object {id, created\_at, pattern, 3 more } A URL ignore pattern that exempts matching URLs from Email Security’s URL rewriting. id: string URL ignore pattern identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property pattern: string Regular expression identifying URLs to exempt from rewriting. maxLength1024 minLength1 Link to this property comments: optional string Optional note describing the reason for the ignore pattern. maxLength1024 Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.url_ignore_patterns%20%3E%20(model)%20url_ignore_pattern_create_response%20%3E%20(schema)>)
URLIgnorePatternEditResponse object {id, created\_at, pattern, 3 more } A URL ignore pattern that exempts matching URLs from Email Security’s URL rewriting. id: string URL ignore pattern identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property pattern: string Regular expression identifying URLs to exempt from rewriting. maxLength1024 minLength1 Link to this property comments: optional string Optional note describing the reason for the ignore pattern. maxLength1024 Link to this property Deprecatedlast\_modified: optional string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.url_ignore_patterns%20%3E%20(model)%20url_ignore_pattern_edit_response%20%3E%20(schema)>)
URLIgnorePatternDeleteResponse object {id } id: string URL ignore pattern identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.url_ignore_patterns%20%3E%20(model)%20url_ignore_pattern_delete_response%20%3E%20(schema)>) #### Email SecuritySubmissions ##### [List reclassify submissions](https://developers.cloudflare.com/api/resources/email_security/subresources/submissions/methods/list) GET/accounts/{account\_id}/email-security/submissions ##### ModelsExpand Collapse
SubmissionListResponse object {requested\_at, submission\_id, customer\_status, 15 more } requested\_at: string When the submission was requested (UTC). formatdate-time Link to this property submission\_id: string Link to this property
customer\_status: optional "escalated"or "reviewed"or "unreviewed" One of the following: "escalated" Link to this property "reviewed" Link to this property "unreviewed" Link to this property
Link to this property
escalated\_as: optional "MALICIOUS"or "SUSPICIOUS"or "SPOOF"or 3 more The disposition a message is submitted to have. One of the following: "MALICIOUS" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "NONE" Link to this property
Link to this property escalated\_at: optional string When the submission was escalated to the security team. formatdate-time Link to this property escalated\_by: optional string Email address of the user who escalated the submission. Link to this property escalated\_submission\_id: optional string Submission ID of the escalated team submission, when this user submission was escalated. Link to this property
original\_disposition: optional "MALICIOUS"or "SUSPICIOUS"or "SPOOF"or 3 more The disposition a message is submitted to have. One of the following: "MALICIOUS" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "NONE" Link to this property
Link to this property original\_edf\_hash: optional string EDF hash of the original message. Link to this property original\_postfix\_id: optional string The postfix ID of the original message that was submitted. Link to this property outcome: optional string Processing outcome of the submission. Link to this property
outcome\_disposition: optional "MALICIOUS"or "SUSPICIOUS"or "SPOOF"or 3 more The disposition a message is submitted to have. One of the following: "MALICIOUS" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "NONE" Link to this property
Link to this property requested\_by: optional string Email address of the user who requested the submission. Link to this property
requested\_disposition: optional "MALICIOUS"or "SUSPICIOUS"or "SPOOF"or 3 more The disposition a message is submitted to have. One of the following: "MALICIOUS" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "NONE" Link to this property
Link to this property Deprecatedrequested\_ts: optional string Use requested_at instead. Deprecated, use requested_at instead. Link to this property status: optional string Processing status of the submission. Link to this property subject: optional string Subject line of the submitted message. Link to this property
type: optional "Team"or "User" Indicates whether a team member or an end user created the submission. One of the following: "Team" Link to this property "User" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.submissions%20%3E%20(model)%20submission_list_response%20%3E%20(schema)>)