---
title: Investigate
---
[Skip to content](#_top)
[API Reference](https://developers.cloudflare.com/api)
[Email Security](https://developers.cloudflare.com/api/resources/email_security)
Copy Markdown
Open in **Claude**Open in **ChatGPT**Open in **Cursor**
---
**Copy Markdown****View as Markdown**
# Investigate
##### [Search email messages](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/methods/list)
GET/accounts/{account\_id}/email-security/investigate
##### [Get message details](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/methods/get)
GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}
##### ModelsExpand Collapse
InvestigateListResponse object {id, action\_log, client\_recipients, 32 more }
id: string
Unique identifier for a message retrieved from investigation.
Link to this property
Deprecatedaction\_log: array of object {completed\_at, operation, completed\_timestamp, 2 more }
Use GET /investigate/{investigate\_id}/action\_log instead.
Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.
completed\_at: string
Timestamp when action completed.
formatdate-time
Link to this property
operation: "MOVE"or "RELEASE"or "RECLASSIFY"or 3 more
Type of action performed.
One of the following:
"MOVE"
Link to this property
"RELEASE"
Link to this property
"RECLASSIFY"
Link to this property
"SUBMISSION"
Link to this property
"QUARANTINE\_RELEASE"
Link to this property
"PREVIEW"
Link to this property
Link to this property
Deprecatedcompleted\_timestamp: optional string
Use completed_at instead.
Deprecated, use completed_at instead. End of life: November 1, 2026.
Link to this property
properties: optional object {folder, requested\_by }
Additional properties for the action.
folder: optional string
Target folder for move operations.
Link to this property
requested\_by: optional string
User who requested the action.
Link to this property
Link to this property
status: optional string
Status of the action.
Link to this property
Link to this property
client\_recipients: array of string
Link to this property
detection\_reasons: array of string
Link to this property
is\_phish\_submission: boolean
Link to this property
is\_quarantined: boolean
Link to this property
postfix\_id: string
The identifier of the message.
Link to this property
properties: object {allowlisted\_pattern, allowlisted\_pattern\_type, blocklisted\_message, 2 more }
Message processing properties.
allowlisted\_pattern: optional string
Pattern that allowlisted this message.
Link to this property
allowlisted\_pattern\_type: optional "quarantine\_release"or "acceptable\_sender"or "allowed\_sender"or 5 more
Type of allowlist pattern.
One of the following:
"quarantine\_release"
Link to this property
"acceptable\_sender"
Link to this property
"allowed\_sender"
Link to this property
"allowed\_recipient"
Link to this property
"domain\_similarity"
Link to this property
"domain\_recency"
Link to this property
"managed\_acceptable\_sender"
Link to this property
"outbound\_ndr"
Link to this property
Link to this property
blocklisted\_message: optional boolean
Whether message was blocklisted.
Link to this property
blocklisted\_pattern: optional string
Pattern that blocklisted this message.
Link to this property
whitelisted\_pattern\_type: optional "quarantine\_release"or "acceptable\_sender"or "allowed\_sender"or 5 more
Legacy field for allowlist pattern type.
One of the following:
"quarantine\_release"
Link to this property
"acceptable\_sender"
Link to this property
"allowed\_sender"
Link to this property
"allowed\_recipient"
Link to this property
"domain\_similarity"
Link to this property
"domain\_recency"
Link to this property
"managed\_acceptable\_sender"
Link to this property
"outbound\_ndr"
Link to this property
Link to this property
Link to this property
Deprecatedts: string
Use scanned_at instead.
Deprecated, use scanned_at instead. End of life: November 1, 2026.
Link to this property
alert\_id: optional string
Link to this property
delivery\_mode: optional "DIRECT"or "BCC"or "JOURNAL"or 8 more
One of the following:
"DIRECT"
Link to this property
"BCC"
Link to this property
"JOURNAL"
Link to this property
"REVIEW\_SUBMISSION"
Link to this property
"DMARC\_UNVERIFIED"
Link to this property
"DMARC\_FAILURE\_REPORT"
Link to this property
"DMARC\_AGGREGATE\_REPORT"
Link to this property
"THREAT\_INTEL\_SUBMISSION"
Link to this property
"SIMULATION\_SUBMISSION"
Link to this property
"API"
Link to this property
"RETRO\_SCAN"
Link to this property
Link to this property
delivery\_status: optional array of "delivered"or "moved"or "quarantined"or 5 more
One of the following:
"delivered"
Link to this property
"moved"
Link to this property
"quarantined"
Link to this property
"rejected"
Link to this property
"deferred"
Link to this property
"bounced"
Link to this property
"queued"
Link to this property
"move\_failed"
Link to this property
Link to this property
edf\_hash: optional string
Link to this property
envelope\_from: optional string
Link to this property
envelope\_to: optional array of string
Link to this property
final\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
The verdict Email Security assigns to a message.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
Deprecatedfindings: optional array of object {attachment, detail, detection, 6 more }
Use the findings field from GET /investigate/{investigate\_id}/detections instead.
Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message.
attachment: optional string
Link to this property
detail: optional string
Link to this property
detection: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
The verdict Email Security assigns to a message.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
field: optional string
Link to this property
name: optional string
Link to this property
portion: optional string
Link to this property
reason: optional string
Link to this property
score: optional number
formatdouble
Link to this property
value: optional string
Link to this property
Link to this property
from: optional string
Link to this property
from\_name: optional string
Link to this property
htmltext\_structure\_hash: optional string
Link to this property
message\_id: optional string
Link to this property
post\_delivery\_operations: optional array of "PREVIEW"or "QUARANTINE\_RELEASE"or "SUBMISSION"or "MOVE"
Post-delivery operations performed on this message.
One of the following:
"PREVIEW"
Link to this property
"QUARANTINE\_RELEASE"
Link to this property
"SUBMISSION"
Link to this property
"MOVE"
Link to this property
Link to this property
postfix\_id\_outbound: optional string
Link to this property
replyto: optional string
Link to this property
scanned\_at: optional string
When the message was scanned (UTC).
formatdate-time
Link to this property
sent\_at: optional string
When the message was sent (UTC).
formatdate-time
Link to this property
sent\_date: optional string
Link to this property
smtp\_helo\_server\_ip: optional string
Link to this property
smtp\_previous\_hop\_ip: optional string
Link to this property
subject: optional string
Link to this property
threat\_categories: optional array of string
Link to this property
to: optional array of string
Link to this property
to\_name: optional array of string
Link to this property
validation: optional object {comment, dkim, dmarc, spf }
comment: optional string
Link to this property
dkim: optional "pass"or "neutral"or "fail"or 2 more
One of the following:
"pass"
Link to this property
"neutral"
Link to this property
"fail"
Link to this property
"error"
Link to this property
"none"
Link to this property
Link to this property
dmarc: optional "pass"or "neutral"or "fail"or 2 more
One of the following:
"pass"
Link to this property
"neutral"
Link to this property
"fail"
Link to this property
"error"
Link to this property
"none"
Link to this property
Link to this property
spf: optional "pass"or "neutral"or "fail"or 2 more
One of the following:
"pass"
Link to this property
"neutral"
Link to this property
"fail"
Link to this property
"error"
Link to this property
"none"
Link to this property
Link to this property
Link to this property
x\_originating\_ip: optional string
Link to this property
[Link to this property](<#(resource)%20email_security.investigate%20%3E%20(model)%20investigate_list_response%20%3E%20(schema)>)
InvestigateGetResponse object {id, action\_log, client\_recipients, 32 more }
id: string
Unique identifier for a message retrieved from investigation.
Link to this property
Deprecatedaction\_log: array of object {completed\_at, operation, completed\_timestamp, 2 more }
Use GET /investigate/{investigate\_id}/action\_log instead.
Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.
completed\_at: string
Timestamp when action completed.
formatdate-time
Link to this property
operation: "MOVE"or "RELEASE"or "RECLASSIFY"or 3 more
Type of action performed.
One of the following:
"MOVE"
Link to this property
"RELEASE"
Link to this property
"RECLASSIFY"
Link to this property
"SUBMISSION"
Link to this property
"QUARANTINE\_RELEASE"
Link to this property
"PREVIEW"
Link to this property
Link to this property
Deprecatedcompleted\_timestamp: optional string
Use completed_at instead.
Deprecated, use completed_at instead. End of life: November 1, 2026.
Link to this property
properties: optional object {folder, requested\_by }
Additional properties for the action.
folder: optional string
Target folder for move operations.
Link to this property
requested\_by: optional string
User who requested the action.
Link to this property
Link to this property
status: optional string
Status of the action.
Link to this property
Link to this property
client\_recipients: array of string
Link to this property
detection\_reasons: array of string
Link to this property
is\_phish\_submission: boolean
Link to this property
is\_quarantined: boolean
Link to this property
postfix\_id: string
The identifier of the message.
Link to this property
properties: object {allowlisted\_pattern, allowlisted\_pattern\_type, blocklisted\_message, 2 more }
Message processing properties.
allowlisted\_pattern: optional string
Pattern that allowlisted this message.
Link to this property
allowlisted\_pattern\_type: optional "quarantine\_release"or "acceptable\_sender"or "allowed\_sender"or 5 more
Type of allowlist pattern.
One of the following:
"quarantine\_release"
Link to this property
"acceptable\_sender"
Link to this property
"allowed\_sender"
Link to this property
"allowed\_recipient"
Link to this property
"domain\_similarity"
Link to this property
"domain\_recency"
Link to this property
"managed\_acceptable\_sender"
Link to this property
"outbound\_ndr"
Link to this property
Link to this property
blocklisted\_message: optional boolean
Whether message was blocklisted.
Link to this property
blocklisted\_pattern: optional string
Pattern that blocklisted this message.
Link to this property
whitelisted\_pattern\_type: optional "quarantine\_release"or "acceptable\_sender"or "allowed\_sender"or 5 more
Legacy field for allowlist pattern type.
One of the following:
"quarantine\_release"
Link to this property
"acceptable\_sender"
Link to this property
"allowed\_sender"
Link to this property
"allowed\_recipient"
Link to this property
"domain\_similarity"
Link to this property
"domain\_recency"
Link to this property
"managed\_acceptable\_sender"
Link to this property
"outbound\_ndr"
Link to this property
Link to this property
Link to this property
Deprecatedts: string
Use scanned_at instead.
Deprecated, use scanned_at instead. End of life: November 1, 2026.
Link to this property
alert\_id: optional string
Link to this property
delivery\_mode: optional "DIRECT"or "BCC"or "JOURNAL"or 8 more
One of the following:
"DIRECT"
Link to this property
"BCC"
Link to this property
"JOURNAL"
Link to this property
"REVIEW\_SUBMISSION"
Link to this property
"DMARC\_UNVERIFIED"
Link to this property
"DMARC\_FAILURE\_REPORT"
Link to this property
"DMARC\_AGGREGATE\_REPORT"
Link to this property
"THREAT\_INTEL\_SUBMISSION"
Link to this property
"SIMULATION\_SUBMISSION"
Link to this property
"API"
Link to this property
"RETRO\_SCAN"
Link to this property
Link to this property
delivery\_status: optional array of "delivered"or "moved"or "quarantined"or 5 more
One of the following:
"delivered"
Link to this property
"moved"
Link to this property
"quarantined"
Link to this property
"rejected"
Link to this property
"deferred"
Link to this property
"bounced"
Link to this property
"queued"
Link to this property
"move\_failed"
Link to this property
Link to this property
edf\_hash: optional string
Link to this property
envelope\_from: optional string
Link to this property
envelope\_to: optional array of string
Link to this property
final\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
The verdict Email Security assigns to a message.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
Deprecatedfindings: optional array of object {attachment, detail, detection, 6 more }
Use the findings field from GET /investigate/{investigate\_id}/detections instead.
Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message.
attachment: optional string
Link to this property
detail: optional string
Link to this property
detection: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
The verdict Email Security assigns to a message.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
field: optional string
Link to this property
name: optional string
Link to this property
portion: optional string
Link to this property
reason: optional string
Link to this property
score: optional number
formatdouble
Link to this property
value: optional string
Link to this property
Link to this property
from: optional string
Link to this property
from\_name: optional string
Link to this property
htmltext\_structure\_hash: optional string
Link to this property
message\_id: optional string
Link to this property
post\_delivery\_operations: optional array of "PREVIEW"or "QUARANTINE\_RELEASE"or "SUBMISSION"or "MOVE"
Post-delivery operations performed on this message.
One of the following:
"PREVIEW"
Link to this property
"QUARANTINE\_RELEASE"
Link to this property
"SUBMISSION"
Link to this property
"MOVE"
Link to this property
Link to this property
postfix\_id\_outbound: optional string
Link to this property
replyto: optional string
Link to this property
scanned\_at: optional string
When the message was scanned (UTC).
formatdate-time
Link to this property
sent\_at: optional string
When the message was sent (UTC).
formatdate-time
Link to this property
sent\_date: optional string
Link to this property
smtp\_helo\_server\_ip: optional string
Link to this property
smtp\_previous\_hop\_ip: optional string
Link to this property
subject: optional string
Link to this property
threat\_categories: optional array of string
Link to this property
to: optional array of string
Link to this property
to\_name: optional array of string
Link to this property
validation: optional object {comment, dkim, dmarc, spf }
comment: optional string
Link to this property
dkim: optional "pass"or "neutral"or "fail"or 2 more
One of the following:
"pass"
Link to this property
"neutral"
Link to this property
"fail"
Link to this property
"error"
Link to this property
"none"
Link to this property
Link to this property
dmarc: optional "pass"or "neutral"or "fail"or 2 more
One of the following:
"pass"
Link to this property
"neutral"
Link to this property
"fail"
Link to this property
"error"
Link to this property
"none"
Link to this property
Link to this property
spf: optional "pass"or "neutral"or "fail"or 2 more
One of the following:
"pass"
Link to this property
"neutral"
Link to this property
"fail"
Link to this property
"error"
Link to this property
"none"
Link to this property
Link to this property
Link to this property
x\_originating\_ip: optional string
Link to this property
[Link to this property](<#(resource)%20email_security.investigate%20%3E%20(model)%20investigate_get_response%20%3E%20(schema)>)
#### InvestigateDetections
##### [Get message detection details](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/detections/methods/get)
GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/detections
##### ModelsExpand Collapse
DetectionGetResponse object {action, attachments, findings, 6 more }
action: string
Link to this property
attachments: array of object {size, content\_type, detection, 6 more }
size: number
Size of the attachment in bytes.
minimum0
Link to this property
content\_type: optional string
MIME type of the attachment.
Link to this property
detection: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
Detection result for this attachment.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
encrypted: optional boolean
Whether the attachment is encrypted.
Link to this property
filename: optional string
Name of the attached file.
Link to this property
md5: optional string
MD5 hash of the attachment.
Link to this property
name: optional string
Attachment name (alternative to filename).
Link to this property
sha1: optional string
SHA1 hash of the attachment.
Link to this property
sha256: optional string
SHA256 hash of the attachment.
Link to this property
Link to this property
findings: array of object {attachment, detail, detection, 6 more }
attachment: optional string
Link to this property
detail: optional string
Link to this property
detection: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
Detection result associated with this finding.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
field: optional string
Link to this property
name: optional string
Link to this property
portion: optional string
Link to this property
reason: optional string
Link to this property
score: optional number
formatdouble
Link to this property
value: optional string
Link to this property
Link to this property
headers: array of object {name, value }
name: string
Link to this property
value: string
Link to this property
Link to this property
links: array of object {href, text }
href: string
Link to this property
text: optional string
Link to this property
Link to this property
sender\_info: object {as\_name, as\_number, geo, 2 more }
as\_name: optional string
The name of the autonomous system.
Link to this property
as\_number: optional number
The number of the autonomous system.
Link to this property
geo: optional string
Link to this property
ip: optional string
Link to this property
pld: optional string
Link to this property
Link to this property
threat\_categories: array of object {id, description, name }
id: optional number
Link to this property
description: optional string
Link to this property
name: optional string
Link to this property
Link to this property
validation: object {comment, dkim, dmarc, spf }
comment: optional string
Link to this property
dkim: optional "pass"or "neutral"or "fail"or 2 more
One of the following:
"pass"
Link to this property
"neutral"
Link to this property
"fail"
Link to this property
"error"
Link to this property
"none"
Link to this property
Link to this property
dmarc: optional "pass"or "neutral"or "fail"or 2 more
One of the following:
"pass"
Link to this property
"neutral"
Link to this property
"fail"
Link to this property
"error"
Link to this property
"none"
Link to this property
Link to this property
spf: optional "pass"or "neutral"or "fail"or 2 more
One of the following:
"pass"
Link to this property
"neutral"
Link to this property
"fail"
Link to this property
"error"
Link to this property
"none"
Link to this property
Link to this property
Link to this property
final\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
The verdict Email Security assigns to a message.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.detections%20%3E%20(model)%20detection_get_response%20%3E%20(schema)>)
#### InvestigatePreview
##### [Get preview for a detection](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/preview/methods/get)
GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/preview
##### [Generate preview for a non-detection message](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/preview/methods/create)
POST/accounts/{account\_id}/email-security/investigate/preview
##### ModelsExpand Collapse
PreviewGetResponse object {screenshot }
screenshot: string
A base64 encoded PNG image of the email.
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.preview%20%3E%20(model)%20preview_get_response%20%3E%20(schema)>)
PreviewCreateResponse object {screenshot }
screenshot: string
A base64 encoded PNG image of the email.
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.preview%20%3E%20(model)%20preview_create_response%20%3E%20(schema)>)
#### InvestigateRaw
##### [Get raw email content](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/raw/methods/get)
GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/raw
##### ModelsExpand Collapse
RawGetResponse object {raw }
raw: string
A UTF-8 encoded eml file of the email.
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>)
#### InvestigateTrace
##### [Get email trace](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/trace/methods/get)
GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/trace
##### ModelsExpand Collapse
TraceGetResponse object {inbound, outbound }
inbound: object {lines, pending }
lines: optional array of object {lineno, logged\_at, message, ts }
lineno: optional number
Line number in the trace log.
Link to this property
logged\_at: optional string
formatdate-time
Link to this property
message: optional string
Link to this property
Deprecatedts: optional string
Use logged_at instead.
Deprecated, use logged_at instead. End of life: November 1, 2026.
Link to this property
Link to this property
pending: optional boolean
Link to this property
Link to this property
outbound: object {lines, pending }
lines: optional array of object {lineno, logged\_at, message, ts }
lineno: optional number
Line number in the trace log.
Link to this property
logged\_at: optional string
formatdate-time
Link to this property
message: optional string
Link to this property
Deprecatedts: optional string
Use logged_at instead.
Deprecated, use logged_at instead. End of life: November 1, 2026.
Link to this property
Link to this property
pending: optional boolean
Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.trace%20%3E%20(model)%20trace_get_response%20%3E%20(schema)>)
#### InvestigateMove
##### [Move a message](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/move/methods/create)
POST/accounts/{account\_id}/email-security/investigate/{investigate\_id}/move
##### [Move messages](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/move/methods/bulk)
POST/accounts/{account\_id}/email-security/investigate/move
##### ModelsExpand Collapse
MoveCreateResponse object {success, completed\_at, completed\_timestamp, 6 more }
success: boolean
Whether the operation succeeded.
Link to this property
completed\_at: optional string
When the move operation completed (UTC).
formatdate-time
Link to this property
Deprecatedcompleted\_timestamp: optional string
Use completed_at instead.
Deprecated, use completed_at instead. End of life: November 1, 2026.
formatdate-time
Link to this property
destination: optional string
Destination folder for the message.
Link to this property
Deprecateditem\_count: optional number
This field is deprecated.
Number of items moved. End of life: November 1, 2026.
Link to this property
message\_id: optional string
Message identifier.
Link to this property
operation: optional string
Type of operation performed.
Link to this property
recipient: optional string
Recipient email address.
Link to this property
status: optional string
Operation status.
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.move%20%3E%20(model)%20move_create_response%20%3E%20(schema)>)
MoveBulkResponse object {success, completed\_at, completed\_timestamp, 6 more }
success: boolean
Whether the operation succeeded.
Link to this property
completed\_at: optional string
When the move operation completed (UTC).
formatdate-time
Link to this property
Deprecatedcompleted\_timestamp: optional string
Use completed_at instead.
Deprecated, use completed_at instead. End of life: November 1, 2026.
formatdate-time
Link to this property
destination: optional string
Destination folder for the message.
Link to this property
Deprecateditem\_count: optional number
This field is deprecated.
Number of items moved. End of life: November 1, 2026.
Link to this property
message\_id: optional string
Message identifier.
Link to this property
operation: optional string
Type of operation performed.
Link to this property
recipient: optional string
Recipient email address.
Link to this property
status: optional string
Operation status.
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.move%20%3E%20(model)%20move_bulk_response%20%3E%20(schema)>)
#### InvestigateReclassify
##### [Change email classification](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/reclassify/methods/create)
Deprecated
POST/accounts/{account\_id}/email-security/investigate/{investigate\_id}/reclassify
##### ModelsExpand Collapse
ReclassifyCreateResponse = unknown
[Link to this property](<#(resource)%20email_security.investigate.reclassify%20%3E%20(model)%20reclassify_create_response%20%3E%20(schema)>)
#### InvestigateRelease
##### [Release messages from quarantine](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/release/methods/bulk)
POST/accounts/{account\_id}/email-security/investigate/release
##### ModelsExpand Collapse
ReleaseBulkResponse object {id, delivered, failed, 2 more }
id: string
Unique identifier for a message retrieved from investigation.
Link to this property
delivered: optional array of string
Link to this property
failed: optional array of string
Link to this property
Deprecatedpostfix\_id: optional string
Use id instead.
Deprecated, use id instead. End of life: November 1, 2026.
Link to this property
undelivered: optional array of string
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.release%20%3E%20(model)%20release_bulk_response%20%3E%20(schema)>)
#### InvestigateBulk
##### [List bulk action jobs](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/bulk/methods/list)
GET/accounts/{account\_id}/email-security/investigate/bulk
##### [Create a bulk action job](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/bulk/methods/create)
POST/accounts/{account\_id}/email-security/investigate/bulk
##### [Get bulk action job details](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/bulk/methods/get)
GET/accounts/{account\_id}/email-security/investigate/bulk/{job\_id}
##### [Delete a bulk action job](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/bulk/methods/delete)
DELETE/accounts/{account\_id}/email-security/investigate/bulk/{job\_id}
##### ModelsExpand Collapse
BulkListResponse object {action\_params, action\_type, created\_at, 13 more }
action\_params: object {destination, type, expected\_disposition } or object {type }
One of the following:
Move object {destination, type, expected\_disposition }
destination: "Inbox"or "JunkEmail"or "DeletedItems"or 2 more
The mailbox folder to move messages to.
One of the following:
"Inbox"
Link to this property
"JunkEmail"
Link to this property
"DeletedItems"
Link to this property
"RecoverableItemsDeletions"
Link to this property
"RecoverableItemsPurges"
Link to this property
Link to this property
type: "MOVE"
Link to this property
Deprecatedexpected\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
This field is nonfunctional.
Nonfunctional field. End of life: December 1, 2026.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
Link to this property
Release object {type }
type: "RELEASE"
Link to this property
Link to this property
Link to this property
action\_type: "MOVE"or "RELEASE"
One of the following:
"MOVE"
Link to this property
"RELEASE"
Link to this property
Link to this property
created\_at: string
formatdate-time
Link to this property
job\_id: string
formatuuid
Link to this property
messages\_cancelled: number
Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled.
Link to this property
messages\_failed: number
Link to this property
messages\_pending: number
Link to this property
messages\_skipped: number
Messages that discovery skipped (for example, phish submissions, which the job cannot action).
Link to this property
messages\_successful: number
Link to this property
search\_params: object {action\_log, alert\_id, delivery\_status, 15 more }
Deprecatedaction\_log: optional boolean
Use GET /investigate/{investigate\_id}/action\_log instead.
Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.
Link to this property
alert\_id: optional string
Alert ID of the detection to filter by.
Link to this property
delivery\_status: optional "delivered"or "moved"or "quarantined"or 5 more
Delivery status to filter by.
One of the following:
"delivered"
Link to this property
"moved"
Link to this property
"quarantined"
Link to this property
"rejected"
Link to this property
"deferred"
Link to this property
"bounced"
Link to this property
"queued"
Link to this property
"move\_failed"
Link to this property
Link to this property
detections\_only: optional boolean
Whether to include only detections in search results.
Link to this property
domain: optional string
Match messages that mention this domain — sender domain, recipient domain, or a domain in a link.
Link to this property
end: optional string
End of search date range.
formatdate-time
Link to this property
exact\_subject: optional string
Match messages whose subject line equals this value exactly.
Link to this property
final\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
Dispositions to filter by.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
message\_action: optional "PREVIEW"or "QUARANTINE\_RELEASED"or "MOVED"
Message actions to filter by.
One of the following:
"PREVIEW"
Link to this property
"QUARANTINE\_RELEASED"
Link to this property
"MOVED"
Link to this property
Link to this property
message\_id: optional string
Message-ID header value to filter by.
Link to this property
metric: optional string
Metric name to filter the search by.
Link to this property
query: optional string
Space-delimited search term. Case-insensitive.
Link to this property
recipient: optional string
Match messages whose recipient is this email address or domain.
Link to this property
sender: optional string
Match messages whose sender is this email address or domain.
Link to this property
smtp\_helo\_ip: optional string
Matches messages whose SMTP HELO server IP address equals this value.
Link to this property
start: optional string
Beginning of search date range.
formatdate-time
Link to this property
subject: optional string
Match messages whose subject contains these keywords, in any order.
Link to this property
submissions: optional boolean
Whether to search reclassification submissions instead of original messages.
Link to this property
Link to this property
status: "PENDING"or "DISCOVERING"or "PROCESSING"or 3 more
Status of a bulk action job.
One of the following:
"PENDING"
Link to this property
"DISCOVERING"
Link to this property
"PROCESSING"
Link to this property
"COMPLETED"
Link to this property
"FAILED"
Link to this property
"CANCELLED"
Link to this property
Link to this property
total\_messages\_discovered: number
Link to this property
comment: optional string
Link to this property
completed\_at: optional string
formatdate-time
Link to this property
started\_at: optional string
formatdate-time
Link to this property
status\_message: optional string
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_list_response%20%3E%20(schema)>)
BulkCreateResponse object {action\_params, action\_type, created\_at, 13 more }
action\_params: object {destination, type, expected\_disposition } or object {type }
One of the following:
Move object {destination, type, expected\_disposition }
destination: "Inbox"or "JunkEmail"or "DeletedItems"or 2 more
The mailbox folder to move messages to.
One of the following:
"Inbox"
Link to this property
"JunkEmail"
Link to this property
"DeletedItems"
Link to this property
"RecoverableItemsDeletions"
Link to this property
"RecoverableItemsPurges"
Link to this property
Link to this property
type: "MOVE"
Link to this property
Deprecatedexpected\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
This field is nonfunctional.
Nonfunctional field. End of life: December 1, 2026.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
Link to this property
Release object {type }
type: "RELEASE"
Link to this property
Link to this property
Link to this property
action\_type: "MOVE"or "RELEASE"
One of the following:
"MOVE"
Link to this property
"RELEASE"
Link to this property
Link to this property
created\_at: string
formatdate-time
Link to this property
job\_id: string
formatuuid
Link to this property
messages\_cancelled: number
Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled.
Link to this property
messages\_failed: number
Link to this property
messages\_pending: number
Link to this property
messages\_skipped: number
Messages that discovery skipped (for example, phish submissions, which the job cannot action).
Link to this property
messages\_successful: number
Link to this property
search\_params: object {action\_log, alert\_id, delivery\_status, 15 more }
Deprecatedaction\_log: optional boolean
Use GET /investigate/{investigate\_id}/action\_log instead.
Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.
Link to this property
alert\_id: optional string
Alert ID of the detection to filter by.
Link to this property
delivery\_status: optional "delivered"or "moved"or "quarantined"or 5 more
Delivery status to filter by.
One of the following:
"delivered"
Link to this property
"moved"
Link to this property
"quarantined"
Link to this property
"rejected"
Link to this property
"deferred"
Link to this property
"bounced"
Link to this property
"queued"
Link to this property
"move\_failed"
Link to this property
Link to this property
detections\_only: optional boolean
Whether to include only detections in search results.
Link to this property
domain: optional string
Match messages that mention this domain — sender domain, recipient domain, or a domain in a link.
Link to this property
end: optional string
End of search date range.
formatdate-time
Link to this property
exact\_subject: optional string
Match messages whose subject line equals this value exactly.
Link to this property
final\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
Dispositions to filter by.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
message\_action: optional "PREVIEW"or "QUARANTINE\_RELEASED"or "MOVED"
Message actions to filter by.
One of the following:
"PREVIEW"
Link to this property
"QUARANTINE\_RELEASED"
Link to this property
"MOVED"
Link to this property
Link to this property
message\_id: optional string
Message-ID header value to filter by.
Link to this property
metric: optional string
Metric name to filter the search by.
Link to this property
query: optional string
Space-delimited search term. Case-insensitive.
Link to this property
recipient: optional string
Match messages whose recipient is this email address or domain.
Link to this property
sender: optional string
Match messages whose sender is this email address or domain.
Link to this property
smtp\_helo\_ip: optional string
Matches messages whose SMTP HELO server IP address equals this value.
Link to this property
start: optional string
Beginning of search date range.
formatdate-time
Link to this property
subject: optional string
Match messages whose subject contains these keywords, in any order.
Link to this property
submissions: optional boolean
Whether to search reclassification submissions instead of original messages.
Link to this property
Link to this property
status: "PENDING"or "DISCOVERING"or "PROCESSING"or 3 more
Status of a bulk action job.
One of the following:
"PENDING"
Link to this property
"DISCOVERING"
Link to this property
"PROCESSING"
Link to this property
"COMPLETED"
Link to this property
"FAILED"
Link to this property
"CANCELLED"
Link to this property
Link to this property
total\_messages\_discovered: number
Link to this property
comment: optional string
Link to this property
completed\_at: optional string
formatdate-time
Link to this property
started\_at: optional string
formatdate-time
Link to this property
status\_message: optional string
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_create_response%20%3E%20(schema)>)
BulkGetResponse object {action\_params, action\_type, created\_at, 13 more }
action\_params: object {destination, type, expected\_disposition } or object {type }
One of the following:
Move object {destination, type, expected\_disposition }
destination: "Inbox"or "JunkEmail"or "DeletedItems"or 2 more
The mailbox folder to move messages to.
One of the following:
"Inbox"
Link to this property
"JunkEmail"
Link to this property
"DeletedItems"
Link to this property
"RecoverableItemsDeletions"
Link to this property
"RecoverableItemsPurges"
Link to this property
Link to this property
type: "MOVE"
Link to this property
Deprecatedexpected\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
This field is nonfunctional.
Nonfunctional field. End of life: December 1, 2026.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
Link to this property
Release object {type }
type: "RELEASE"
Link to this property
Link to this property
Link to this property
action\_type: "MOVE"or "RELEASE"
One of the following:
"MOVE"
Link to this property
"RELEASE"
Link to this property
Link to this property
created\_at: string
formatdate-time
Link to this property
job\_id: string
formatuuid
Link to this property
messages\_cancelled: number
Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled.
Link to this property
messages\_failed: number
Link to this property
messages\_pending: number
Link to this property
messages\_skipped: number
Messages that discovery skipped (for example, phish submissions, which the job cannot action).
Link to this property
messages\_successful: number
Link to this property
search\_params: object {action\_log, alert\_id, delivery\_status, 15 more }
Deprecatedaction\_log: optional boolean
Use GET /investigate/{investigate\_id}/action\_log instead.
Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.
Link to this property
alert\_id: optional string
Alert ID of the detection to filter by.
Link to this property
delivery\_status: optional "delivered"or "moved"or "quarantined"or 5 more
Delivery status to filter by.
One of the following:
"delivered"
Link to this property
"moved"
Link to this property
"quarantined"
Link to this property
"rejected"
Link to this property
"deferred"
Link to this property
"bounced"
Link to this property
"queued"
Link to this property
"move\_failed"
Link to this property
Link to this property
detections\_only: optional boolean
Whether to include only detections in search results.
Link to this property
domain: optional string
Match messages that mention this domain — sender domain, recipient domain, or a domain in a link.
Link to this property
end: optional string
End of search date range.
formatdate-time
Link to this property
exact\_subject: optional string
Match messages whose subject line equals this value exactly.
Link to this property
final\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
Dispositions to filter by.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
message\_action: optional "PREVIEW"or "QUARANTINE\_RELEASED"or "MOVED"
Message actions to filter by.
One of the following:
"PREVIEW"
Link to this property
"QUARANTINE\_RELEASED"
Link to this property
"MOVED"
Link to this property
Link to this property
message\_id: optional string
Message-ID header value to filter by.
Link to this property
metric: optional string
Metric name to filter the search by.
Link to this property
query: optional string
Space-delimited search term. Case-insensitive.
Link to this property
recipient: optional string
Match messages whose recipient is this email address or domain.
Link to this property
sender: optional string
Match messages whose sender is this email address or domain.
Link to this property
smtp\_helo\_ip: optional string
Matches messages whose SMTP HELO server IP address equals this value.
Link to this property
start: optional string
Beginning of search date range.
formatdate-time
Link to this property
subject: optional string
Match messages whose subject contains these keywords, in any order.
Link to this property
submissions: optional boolean
Whether to search reclassification submissions instead of original messages.
Link to this property
Link to this property
status: "PENDING"or "DISCOVERING"or "PROCESSING"or 3 more
Status of a bulk action job.
One of the following:
"PENDING"
Link to this property
"DISCOVERING"
Link to this property
"PROCESSING"
Link to this property
"COMPLETED"
Link to this property
"FAILED"
Link to this property
"CANCELLED"
Link to this property
Link to this property
total\_messages\_discovered: number
Link to this property
comment: optional string
Link to this property
completed\_at: optional string
formatdate-time
Link to this property
started\_at: optional string
formatdate-time
Link to this property
status\_message: optional string
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_get_response%20%3E%20(schema)>)
BulkDeleteResponse object {id }
id: string
formatuuid
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_delete_response%20%3E%20(schema)>)
#### InvestigateBulkCancel
##### [Cancel a bulk action job](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/bulk/subresources/cancel/methods/create)
POST/accounts/{account\_id}/email-security/investigate/bulk/{job\_id}/cancel
##### ModelsExpand Collapse
CancelCreateResponse object {action\_params, action\_type, created\_at, 13 more }
action\_params: object {destination, type, expected\_disposition } or object {type }
One of the following:
Move object {destination, type, expected\_disposition }
destination: "Inbox"or "JunkEmail"or "DeletedItems"or 2 more
The mailbox folder to move messages to.
One of the following:
"Inbox"
Link to this property
"JunkEmail"
Link to this property
"DeletedItems"
Link to this property
"RecoverableItemsDeletions"
Link to this property
"RecoverableItemsPurges"
Link to this property
Link to this property
type: "MOVE"
Link to this property
Deprecatedexpected\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
This field is nonfunctional.
Nonfunctional field. End of life: December 1, 2026.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
Link to this property
Release object {type }
type: "RELEASE"
Link to this property
Link to this property
Link to this property
action\_type: "MOVE"or "RELEASE"
One of the following:
"MOVE"
Link to this property
"RELEASE"
Link to this property
Link to this property
created\_at: string
formatdate-time
Link to this property
job\_id: string
formatuuid
Link to this property
messages\_cancelled: number
Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled.
Link to this property
messages\_failed: number
Link to this property
messages\_pending: number
Link to this property
messages\_skipped: number
Messages that discovery skipped (for example, phish submissions, which the job cannot action).
Link to this property
messages\_successful: number
Link to this property
search\_params: object {action\_log, alert\_id, delivery\_status, 15 more }
Deprecatedaction\_log: optional boolean
Use GET /investigate/{investigate\_id}/action\_log instead.
Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.
Link to this property
alert\_id: optional string
Alert ID of the detection to filter by.
Link to this property
delivery\_status: optional "delivered"or "moved"or "quarantined"or 5 more
Delivery status to filter by.
One of the following:
"delivered"
Link to this property
"moved"
Link to this property
"quarantined"
Link to this property
"rejected"
Link to this property
"deferred"
Link to this property
"bounced"
Link to this property
"queued"
Link to this property
"move\_failed"
Link to this property
Link to this property
detections\_only: optional boolean
Whether to include only detections in search results.
Link to this property
domain: optional string
Match messages that mention this domain — sender domain, recipient domain, or a domain in a link.
Link to this property
end: optional string
End of search date range.
formatdate-time
Link to this property
exact\_subject: optional string
Match messages whose subject line equals this value exactly.
Link to this property
final\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
Dispositions to filter by.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
message\_action: optional "PREVIEW"or "QUARANTINE\_RELEASED"or "MOVED"
Message actions to filter by.
One of the following:
"PREVIEW"
Link to this property
"QUARANTINE\_RELEASED"
Link to this property
"MOVED"
Link to this property
Link to this property
message\_id: optional string
Message-ID header value to filter by.
Link to this property
metric: optional string
Metric name to filter the search by.
Link to this property
query: optional string
Space-delimited search term. Case-insensitive.
Link to this property
recipient: optional string
Match messages whose recipient is this email address or domain.
Link to this property
sender: optional string
Match messages whose sender is this email address or domain.
Link to this property
smtp\_helo\_ip: optional string
Matches messages whose SMTP HELO server IP address equals this value.
Link to this property
start: optional string
Beginning of search date range.
formatdate-time
Link to this property
subject: optional string
Match messages whose subject contains these keywords, in any order.
Link to this property
submissions: optional boolean
Whether to search reclassification submissions instead of original messages.
Link to this property
Link to this property
status: "PENDING"or "DISCOVERING"or "PROCESSING"or 3 more
Status of a bulk action job.
One of the following:
"PENDING"
Link to this property
"DISCOVERING"
Link to this property
"PROCESSING"
Link to this property
"COMPLETED"
Link to this property
"FAILED"
Link to this property
"CANCELLED"
Link to this property
Link to this property
total\_messages\_discovered: number
Link to this property
comment: optional string
Link to this property
completed\_at: optional string
formatdate-time
Link to this property
started\_at: optional string
formatdate-time
Link to this property
status\_message: optional string
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk.cancel%20%3E%20(model)%20cancel_create_response%20%3E%20(schema)>)
#### InvestigateBulkMessages
##### [List messages for a bulk action job](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/subresources/bulk/subresources/messages/methods/list)
GET/accounts/{account\_id}/email-security/investigate/bulk/{job\_id}/messages
##### ModelsExpand Collapse
MessageListResponse object {action\_params, action\_type, created\_at, 10 more }
action\_params: object {client\_recipient, destination, type, expected\_disposition } or object {client\_recipient, type }
One of the following:
Move object {client\_recipient, destination, type, expected\_disposition }
client\_recipient: string
Link to this property
destination: "Inbox"or "JunkEmail"or "DeletedItems"or 2 more
The mailbox folder to move messages to.
One of the following:
"Inbox"
Link to this property
"JunkEmail"
Link to this property
"DeletedItems"
Link to this property
"RecoverableItemsDeletions"
Link to this property
"RecoverableItemsPurges"
Link to this property
Link to this property
type: "MOVE"
Link to this property
Deprecatedexpected\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
This field is nonfunctional.
Nonfunctional field. End of life: December 1, 2026.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
Link to this property
Release object {client\_recipient, type }
client\_recipient: string
Link to this property
type: "RELEASE"
Link to this property
Link to this property
Link to this property
action\_type: "MOVE"or "RELEASE"
One of the following:
"MOVE"
Link to this property
"RELEASE"
Link to this property
Link to this property
created\_at: string
formatdate-time
Link to this property
message\_id: string
formatuuid
Link to this property
postfix\_id: string
Link to this property
retry\_count: number
Link to this property
status: "PENDING"or "PROCESSING"or "COMPLETED"or 3 more
Status of a message within a bulk action job.
One of the following:
"PENDING"
Link to this property
"PROCESSING"
Link to this property
"COMPLETED"
Link to this property
"FAILED"
Link to this property
"CANCELLED"
Link to this property
"SKIPPED"
Link to this property
Link to this property
alert\_id: optional string
Link to this property
email\_message\_id: optional string
Link to this property
message: optional object {id, action\_log, client\_recipients, 32 more }
id: string
Unique identifier for a message retrieved from investigation.
Link to this property
Deprecatedaction\_log: array of object {completed\_at, operation, completed\_timestamp, 2 more }
Use GET /investigate/{investigate\_id}/action\_log instead.
Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.
completed\_at: string
Timestamp when action completed.
formatdate-time
Link to this property
operation: "MOVE"or "RELEASE"or "RECLASSIFY"or 3 more
Type of action performed.
One of the following:
"MOVE"
Link to this property
"RELEASE"
Link to this property
"RECLASSIFY"
Link to this property
"SUBMISSION"
Link to this property
"QUARANTINE\_RELEASE"
Link to this property
"PREVIEW"
Link to this property
Link to this property
Deprecatedcompleted\_timestamp: optional string
Use completed_at instead.
Deprecated, use completed_at instead. End of life: November 1, 2026.
Link to this property
properties: optional object {folder, requested\_by }
Additional properties for the action.
folder: optional string
Target folder for move operations.
Link to this property
requested\_by: optional string
User who requested the action.
Link to this property
Link to this property
status: optional string
Status of the action.
Link to this property
Link to this property
client\_recipients: array of string
Link to this property
detection\_reasons: array of string
Link to this property
is\_phish\_submission: boolean
Link to this property
is\_quarantined: boolean
Link to this property
postfix\_id: string
The identifier of the message.
Link to this property
properties: object {allowlisted\_pattern, allowlisted\_pattern\_type, blocklisted\_message, 2 more }
Message processing properties.
allowlisted\_pattern: optional string
Pattern that allowlisted this message.
Link to this property
allowlisted\_pattern\_type: optional "quarantine\_release"or "acceptable\_sender"or "allowed\_sender"or 5 more
Type of allowlist pattern.
One of the following:
"quarantine\_release"
Link to this property
"acceptable\_sender"
Link to this property
"allowed\_sender"
Link to this property
"allowed\_recipient"
Link to this property
"domain\_similarity"
Link to this property
"domain\_recency"
Link to this property
"managed\_acceptable\_sender"
Link to this property
"outbound\_ndr"
Link to this property
Link to this property
blocklisted\_message: optional boolean
Whether message was blocklisted.
Link to this property
blocklisted\_pattern: optional string
Pattern that blocklisted this message.
Link to this property
whitelisted\_pattern\_type: optional "quarantine\_release"or "acceptable\_sender"or "allowed\_sender"or 5 more
Legacy field for allowlist pattern type.
One of the following:
"quarantine\_release"
Link to this property
"acceptable\_sender"
Link to this property
"allowed\_sender"
Link to this property
"allowed\_recipient"
Link to this property
"domain\_similarity"
Link to this property
"domain\_recency"
Link to this property
"managed\_acceptable\_sender"
Link to this property
"outbound\_ndr"
Link to this property
Link to this property
Link to this property
Deprecatedts: string
Use scanned_at instead.
Deprecated, use scanned_at instead. End of life: November 1, 2026.
Link to this property
alert\_id: optional string
Link to this property
delivery\_mode: optional "DIRECT"or "BCC"or "JOURNAL"or 8 more
One of the following:
"DIRECT"
Link to this property
"BCC"
Link to this property
"JOURNAL"
Link to this property
"REVIEW\_SUBMISSION"
Link to this property
"DMARC\_UNVERIFIED"
Link to this property
"DMARC\_FAILURE\_REPORT"
Link to this property
"DMARC\_AGGREGATE\_REPORT"
Link to this property
"THREAT\_INTEL\_SUBMISSION"
Link to this property
"SIMULATION\_SUBMISSION"
Link to this property
"API"
Link to this property
"RETRO\_SCAN"
Link to this property
Link to this property
delivery\_status: optional array of "delivered"or "moved"or "quarantined"or 5 more
One of the following:
"delivered"
Link to this property
"moved"
Link to this property
"quarantined"
Link to this property
"rejected"
Link to this property
"deferred"
Link to this property
"bounced"
Link to this property
"queued"
Link to this property
"move\_failed"
Link to this property
Link to this property
edf\_hash: optional string
Link to this property
envelope\_from: optional string
Link to this property
envelope\_to: optional array of string
Link to this property
final\_disposition: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
The verdict Email Security assigns to a message.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
Deprecatedfindings: optional array of object {attachment, detail, detection, 6 more }
Use the findings field from GET /investigate/{investigate\_id}/detections instead.
Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message.
attachment: optional string
Link to this property
detail: optional string
Link to this property
detection: optional "MALICIOUS"or "MALICIOUS-BEC"or "SUSPICIOUS"or 7 more
The verdict Email Security assigns to a message.
One of the following:
"MALICIOUS"
Link to this property
"MALICIOUS-BEC"
Link to this property
"SUSPICIOUS"
Link to this property
"SPOOF"
Link to this property
"SPAM"
Link to this property
"BULK"
Link to this property
"ENCRYPTED"
Link to this property
"EXTERNAL"
Link to this property
"UNKNOWN"
Link to this property
"NONE"
Link to this property
Link to this property
field: optional string
Link to this property
name: optional string
Link to this property
portion: optional string
Link to this property
reason: optional string
Link to this property
score: optional number
formatdouble
Link to this property
value: optional string
Link to this property
Link to this property
from: optional string
Link to this property
from\_name: optional string
Link to this property
htmltext\_structure\_hash: optional string
Link to this property
message\_id: optional string
Link to this property
post\_delivery\_operations: optional array of "PREVIEW"or "QUARANTINE\_RELEASE"or "SUBMISSION"or "MOVE"
Post-delivery operations performed on this message.
One of the following:
"PREVIEW"
Link to this property
"QUARANTINE\_RELEASE"
Link to this property
"SUBMISSION"
Link to this property
"MOVE"
Link to this property
Link to this property
postfix\_id\_outbound: optional string
Link to this property
replyto: optional string
Link to this property
scanned\_at: optional string
When the message was scanned (UTC).
formatdate-time
Link to this property
sent\_at: optional string
When the message was sent (UTC).
formatdate-time
Link to this property
sent\_date: optional string
Link to this property
smtp\_helo\_server\_ip: optional string
Link to this property
smtp\_previous\_hop\_ip: optional string
Link to this property
subject: optional string
Link to this property
threat\_categories: optional array of string
Link to this property
to: optional array of string
Link to this property
to\_name: optional array of string
Link to this property
validation: optional object {comment, dkim, dmarc, spf }
comment: optional string
Link to this property
dkim: optional "pass"or "neutral"or "fail"or 2 more
One of the following:
"pass"
Link to this property
"neutral"
Link to this property
"fail"
Link to this property
"error"
Link to this property
"none"
Link to this property
Link to this property
dmarc: optional "pass"or "neutral"or "fail"or 2 more
One of the following:
"pass"
Link to this property
"neutral"
Link to this property
"fail"
Link to this property
"error"
Link to this property
"none"
Link to this property
Link to this property
spf: optional "pass"or "neutral"or "fail"or 2 more
One of the following:
"pass"
Link to this property
"neutral"
Link to this property
"fail"
Link to this property
"error"
Link to this property
"none"
Link to this property
Link to this property
Link to this property
x\_originating\_ip: optional string
Link to this property
Link to this property
processed\_at: optional string
formatdate-time
Link to this property
retry\_after: optional string
When to retry the action if it failed.
formatdate-time
Link to this property
status\_message: optional string
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk.messages%20%3E%20(model)%20message_list_response%20%3E%20(schema)>)