--- title: Email Security --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/typescript) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Email Security #### Email SecurityInvestigate ##### [Search email messages](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/methods/list) client.emailSecurity.investigate.list(InvestigateListParams {account\_id, alert\_id, cursor, 16 more } params, RequestOptionsoptions?): V4PagePaginationArray< [InvestigateListResponse]() {id, action\_log, client\_recipients, 32 more } > GET/accounts/{account\_id}/email-security/investigate ##### [Get message details](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/methods/get) client.emailSecurity.investigate.get(stringinvestigateID, InvestigateGetParams {account\_id, submission } params, RequestOptionsoptions?): [InvestigateGetResponse]() {id, action\_log, client\_recipients, 32 more } GET/accounts/{account\_id}/email-security/investigate/{investigate\_id} ##### ModelsExpand Collapse
InvestigateListResponse {id, action\_log, client\_recipients, 32 more } id: string Unique identifier for a message retrieved from investigation. Link to this property
Deprecatedaction\_log: Array<ActionLog> Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. completed\_at: string Timestamp when action completed. formatdate-time Link to this property
operation: "MOVE"| "RELEASE"| "RECLASSIFY"| 3 more Type of action performed. One of the following: "MOVE" Link to this property "RELEASE" Link to this property "RECLASSIFY" Link to this property "SUBMISSION" Link to this property "QUARANTINE\_RELEASE" Link to this property "PREVIEW" Link to this property
Link to this property Deprecatedcompleted\_timestamp?: string Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. Link to this property
properties?: Properties {folder, requested\_by } Additional properties for the action. folder?: string Target folder for move operations. Link to this property requested\_by?: string User who requested the action. Link to this property
Link to this property status?: string| null Status of the action. Link to this property
Link to this property client\_recipients: Array<string> Link to this property detection\_reasons: Array<string> Link to this property is\_phish\_submission: boolean Link to this property is\_quarantined: boolean Link to this property postfix\_id: string The identifier of the message. Link to this property
properties: Properties {allowlisted\_pattern, allowlisted\_pattern\_type, blocklisted\_message, 2 more } Message processing properties. allowlisted\_pattern?: string| null Pattern that allowlisted this message. Link to this property
allowlisted\_pattern\_type?: "quarantine\_release"| "acceptable\_sender"| "allowed\_sender"| 5 more| null Type of allowlist pattern. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property blocklisted\_message?: boolean| null Whether message was blocklisted. Link to this property blocklisted\_pattern?: string| null Pattern that blocklisted this message. Link to this property
whitelisted\_pattern\_type?: "quarantine\_release"| "acceptable\_sender"| "allowed\_sender"| 5 more| null Legacy field for allowlist pattern type. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property
Link to this property Deprecatedts: string Use scanned_at instead. Deprecated, use scanned_at instead. End of life: November 1, 2026. Link to this property alert\_id?: string| null Link to this property
delivery\_mode?: "DIRECT"| "BCC"| "JOURNAL"| 8 more| null One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "REVIEW\_SUBMISSION" Link to this property "DMARC\_UNVERIFIED" Link to this property "DMARC\_FAILURE\_REPORT" Link to this property "DMARC\_AGGREGATE\_REPORT" Link to this property "THREAT\_INTEL\_SUBMISSION" Link to this property "SIMULATION\_SUBMISSION" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
delivery\_status?: Array<"delivered"| "moved"| "quarantined"| 5 more>| null One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property edf\_hash?: string| null Link to this property envelope\_from?: string| null Link to this property envelope\_to?: Array<string>| null Link to this property
final\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Deprecatedfindings?: Array<Finding>| null Use the findings field from GET /investigate/{investigate\_id}/detections instead. Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message. attachment?: string| null Link to this property detail?: string| null Link to this property
detection?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field?: string| null Link to this property name?: string| null Link to this property portion?: string| null Link to this property reason?: string| null Link to this property score?: number| null formatdouble Link to this property value?: string| null Link to this property
Link to this property from?: string| null Link to this property from\_name?: string| null Link to this property htmltext\_structure\_hash?: string| null Link to this property message\_id?: string| null Link to this property
post\_delivery\_operations?: Array<"PREVIEW"| "QUARANTINE\_RELEASE"| "SUBMISSION"| "MOVE">| null Post-delivery operations performed on this message. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASE" Link to this property "SUBMISSION" Link to this property "MOVE" Link to this property
Link to this property postfix\_id\_outbound?: string| null Link to this property replyto?: string| null Link to this property scanned\_at?: string| null When the message was scanned (UTC). formatdate-time Link to this property sent\_at?: string| null When the message was sent (UTC). formatdate-time Link to this property sent\_date?: string| null Link to this property smtp\_helo\_server\_ip?: string| null Link to this property smtp\_previous\_hop\_ip?: string| null Link to this property subject?: string| null Link to this property threat\_categories?: Array<string>| null Link to this property to?: Array<string>| null Link to this property to\_name?: Array<string>| null Link to this property
validation?: Validation| null comment?: string| null Link to this property
dkim?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property x\_originating\_ip?: string| null Link to this property
[Link to this property](<#(resource)%20email_security.investigate%20%3E%20(model)%20investigate_list_response%20%3E%20(schema)>)
InvestigateGetResponse {id, action\_log, client\_recipients, 32 more } id: string Unique identifier for a message retrieved from investigation. Link to this property
Deprecatedaction\_log: Array<ActionLog> Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. completed\_at: string Timestamp when action completed. formatdate-time Link to this property
operation: "MOVE"| "RELEASE"| "RECLASSIFY"| 3 more Type of action performed. One of the following: "MOVE" Link to this property "RELEASE" Link to this property "RECLASSIFY" Link to this property "SUBMISSION" Link to this property "QUARANTINE\_RELEASE" Link to this property "PREVIEW" Link to this property
Link to this property Deprecatedcompleted\_timestamp?: string Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. Link to this property
properties?: Properties {folder, requested\_by } Additional properties for the action. folder?: string Target folder for move operations. Link to this property requested\_by?: string User who requested the action. Link to this property
Link to this property status?: string| null Status of the action. Link to this property
Link to this property client\_recipients: Array<string> Link to this property detection\_reasons: Array<string> Link to this property is\_phish\_submission: boolean Link to this property is\_quarantined: boolean Link to this property postfix\_id: string The identifier of the message. Link to this property
properties: Properties {allowlisted\_pattern, allowlisted\_pattern\_type, blocklisted\_message, 2 more } Message processing properties. allowlisted\_pattern?: string| null Pattern that allowlisted this message. Link to this property
allowlisted\_pattern\_type?: "quarantine\_release"| "acceptable\_sender"| "allowed\_sender"| 5 more| null Type of allowlist pattern. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property blocklisted\_message?: boolean| null Whether message was blocklisted. Link to this property blocklisted\_pattern?: string| null Pattern that blocklisted this message. Link to this property
whitelisted\_pattern\_type?: "quarantine\_release"| "acceptable\_sender"| "allowed\_sender"| 5 more| null Legacy field for allowlist pattern type. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property
Link to this property Deprecatedts: string Use scanned_at instead. Deprecated, use scanned_at instead. End of life: November 1, 2026. Link to this property alert\_id?: string| null Link to this property
delivery\_mode?: "DIRECT"| "BCC"| "JOURNAL"| 8 more| null One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "REVIEW\_SUBMISSION" Link to this property "DMARC\_UNVERIFIED" Link to this property "DMARC\_FAILURE\_REPORT" Link to this property "DMARC\_AGGREGATE\_REPORT" Link to this property "THREAT\_INTEL\_SUBMISSION" Link to this property "SIMULATION\_SUBMISSION" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
delivery\_status?: Array<"delivered"| "moved"| "quarantined"| 5 more>| null One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property edf\_hash?: string| null Link to this property envelope\_from?: string| null Link to this property envelope\_to?: Array<string>| null Link to this property
final\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Deprecatedfindings?: Array<Finding>| null Use the findings field from GET /investigate/{investigate\_id}/detections instead. Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message. attachment?: string| null Link to this property detail?: string| null Link to this property
detection?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field?: string| null Link to this property name?: string| null Link to this property portion?: string| null Link to this property reason?: string| null Link to this property score?: number| null formatdouble Link to this property value?: string| null Link to this property
Link to this property from?: string| null Link to this property from\_name?: string| null Link to this property htmltext\_structure\_hash?: string| null Link to this property message\_id?: string| null Link to this property
post\_delivery\_operations?: Array<"PREVIEW"| "QUARANTINE\_RELEASE"| "SUBMISSION"| "MOVE">| null Post-delivery operations performed on this message. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASE" Link to this property "SUBMISSION" Link to this property "MOVE" Link to this property
Link to this property postfix\_id\_outbound?: string| null Link to this property replyto?: string| null Link to this property scanned\_at?: string| null When the message was scanned (UTC). formatdate-time Link to this property sent\_at?: string| null When the message was sent (UTC). formatdate-time Link to this property sent\_date?: string| null Link to this property smtp\_helo\_server\_ip?: string| null Link to this property smtp\_previous\_hop\_ip?: string| null Link to this property subject?: string| null Link to this property threat\_categories?: Array<string>| null Link to this property to?: Array<string>| null Link to this property to\_name?: Array<string>| null Link to this property
validation?: Validation| null comment?: string| null Link to this property
dkim?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property x\_originating\_ip?: string| null Link to this property
[Link to this property](<#(resource)%20email_security.investigate%20%3E%20(model)%20investigate_get_response%20%3E%20(schema)>) #### Email SecurityInvestigateDetections ##### [Get message detection details](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/detections/methods/get) client.emailSecurity.investigate.detections.get(stringinvestigateID, DetectionGetParams {account\_id } params, RequestOptionsoptions?): [DetectionGetResponse]() {action, attachments, findings, 6 more } GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/detections ##### ModelsExpand Collapse
DetectionGetResponse {action, attachments, findings, 6 more } action: string Link to this property
attachments: Array<Attachment> size: number Size of the attachment in bytes. minimum0 Link to this property content\_type?: string| null MIME type of the attachment. Link to this property
detection?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null Detection result for this attachment. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property encrypted?: boolean| null Whether the attachment is encrypted. Link to this property filename?: string| null Name of the attached file. Link to this property md5?: string| null MD5 hash of the attachment. Link to this property name?: string| null Attachment name (alternative to filename). Link to this property sha1?: string| null SHA1 hash of the attachment. Link to this property sha256?: string| null SHA256 hash of the attachment. Link to this property
Link to this property
findings: Array<Finding>| null attachment?: string| null Link to this property detail?: string| null Link to this property
detection?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null Detection result associated with this finding. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field?: string| null Link to this property name?: string| null Link to this property portion?: string| null Link to this property reason?: string| null Link to this property score?: number| null formatdouble Link to this property value?: string| null Link to this property
Link to this property
headers: Array<Header> name: string Link to this property value: string Link to this property
Link to this property
links: Array<Link> href: string Link to this property text?: string| null Link to this property
Link to this property
sender\_info: SenderInfo {as\_name, as\_number, geo, 2 more } as\_name?: string| null The name of the autonomous system. Link to this property as\_number?: number| null The number of the autonomous system. Link to this property geo?: string| null Link to this property ip?: string| null Link to this property pld?: string| null Link to this property
Link to this property
threat\_categories: Array<ThreatCategory> id?: number Link to this property description?: string| null Link to this property name?: string| null Link to this property
Link to this property
validation: Validation {comment, dkim, dmarc, spf } comment?: string| null Link to this property
dkim?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property
final\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.detections%20%3E%20(model)%20detection_get_response%20%3E%20(schema)>) #### Email SecurityInvestigatePreview ##### [Get preview for a detection](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/preview/methods/get) client.emailSecurity.investigate.preview.get(stringinvestigateID, PreviewGetParams {account\_id } params, RequestOptionsoptions?): [PreviewGetResponse]() {screenshot } GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/preview ##### [Generate preview for a non-detection message](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/preview/methods/create) client.emailSecurity.investigate.preview.create(PreviewCreateParams {account\_id, id } params, RequestOptionsoptions?): [PreviewCreateResponse]() {screenshot } POST/accounts/{account\_id}/email-security/investigate/preview ##### ModelsExpand Collapse
PreviewGetResponse {screenshot } screenshot: string A base64 encoded PNG image of the email. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.preview%20%3E%20(model)%20preview_get_response%20%3E%20(schema)>)
PreviewCreateResponse {screenshot } screenshot: string A base64 encoded PNG image of the email. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.preview%20%3E%20(model)%20preview_create_response%20%3E%20(schema)>) #### Email SecurityInvestigateRaw ##### [Get raw email content](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/raw/methods/get) client.emailSecurity.investigate.raw.get(stringinvestigateID, RawGetParams {account\_id } params, RequestOptionsoptions?): [RawGetResponse]() {raw } GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/raw ##### ModelsExpand Collapse
RawGetResponse {raw } raw: string A UTF-8 encoded eml file of the email. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>) #### Email SecurityInvestigateTrace ##### [Get email trace](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/trace/methods/get) client.emailSecurity.investigate.trace.get(stringinvestigateID, TraceGetParams {account\_id } params, RequestOptionsoptions?): [TraceGetResponse]() {inbound, outbound } GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/trace ##### ModelsExpand Collapse
TraceGetResponse {inbound, outbound }
inbound: Inbound {lines, pending }
lines?: Array<Line>| null lineno?: number Line number in the trace log. Link to this property logged\_at?: string| null formatdate-time Link to this property message?: string Link to this property Deprecatedts?: string Use logged_at instead. Deprecated, use logged_at instead. End of life: November 1, 2026. Link to this property
Link to this property pending?: boolean| null Link to this property
Link to this property
outbound: Outbound {lines, pending }
lines?: Array<Line>| null lineno?: number Line number in the trace log. Link to this property logged\_at?: string| null formatdate-time Link to this property message?: string Link to this property Deprecatedts?: string Use logged_at instead. Deprecated, use logged_at instead. End of life: November 1, 2026. Link to this property
Link to this property pending?: boolean| null Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.trace%20%3E%20(model)%20trace_get_response%20%3E%20(schema)>) #### Email SecurityInvestigateMove ##### [Move a message](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/move/methods/create) client.emailSecurity.investigate.move.create(stringinvestigateID, MoveCreateParams {account\_id, destination, expected\_disposition } params, RequestOptionsoptions?): SinglePage< [MoveCreateResponse]() {success, completed\_at, completed\_timestamp, 6 more } > POST/accounts/{account\_id}/email-security/investigate/{investigate\_id}/move ##### [Move messages](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/move/methods/bulk) client.emailSecurity.investigate.move.bulk(MoveBulkParams {account\_id, destination, ids, 2 more } params, RequestOptionsoptions?): SinglePage< [MoveBulkResponse]() {success, completed\_at, completed\_timestamp, 6 more } > POST/accounts/{account\_id}/email-security/investigate/move ##### ModelsExpand Collapse
MoveCreateResponse {success, completed\_at, completed\_timestamp, 6 more } success: boolean Whether the operation succeeded. Link to this property completed\_at?: string| null When the move operation completed (UTC). formatdate-time Link to this property Deprecatedcompleted\_timestamp?: string Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. formatdate-time Link to this property destination?: string| null Destination folder for the message. Link to this property Deprecateditem\_count?: number This field is deprecated. Number of items moved. End of life: November 1, 2026. Link to this property message\_id?: string| null Message identifier. Link to this property operation?: string| null Type of operation performed. Link to this property recipient?: string| null Recipient email address. Link to this property status?: string| null Operation status. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.move%20%3E%20(model)%20move_create_response%20%3E%20(schema)>)
MoveBulkResponse {success, completed\_at, completed\_timestamp, 6 more } success: boolean Whether the operation succeeded. Link to this property completed\_at?: string| null When the move operation completed (UTC). formatdate-time Link to this property Deprecatedcompleted\_timestamp?: string Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. formatdate-time Link to this property destination?: string| null Destination folder for the message. Link to this property Deprecateditem\_count?: number This field is deprecated. Number of items moved. End of life: November 1, 2026. Link to this property message\_id?: string| null Message identifier. Link to this property operation?: string| null Type of operation performed. Link to this property recipient?: string| null Recipient email address. Link to this property status?: string| null Operation status. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.move%20%3E%20(model)%20move_bulk_response%20%3E%20(schema)>) #### Email SecurityInvestigateReclassify ##### [Change email classification](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/reclassify/methods/create) Deprecated client.emailSecurity.investigate.reclassify.create(stringinvestigateID, ReclassifyCreateParams {account\_id, expected\_disposition, eml\_content, escalated\_submission\_id } params, RequestOptionsoptions?): [ReclassifyCreateResponse]() POST/accounts/{account\_id}/email-security/investigate/{investigate\_id}/reclassify ##### ModelsExpand Collapse ReclassifyCreateResponse = unknown [Link to this property](<#(resource)%20email_security.investigate.reclassify%20%3E%20(model)%20reclassify_create_response%20%3E%20(schema)>) #### Email SecurityInvestigateRelease ##### [Release messages from quarantine](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/release/methods/bulk) client.emailSecurity.investigate.release.bulk(ReleaseBulkParams {account\_id, ids } params, RequestOptionsoptions?): SinglePage< [ReleaseBulkResponse]() {id, delivered, failed, 2 more } > POST/accounts/{account\_id}/email-security/investigate/release ##### ModelsExpand Collapse
ReleaseBulkResponse {id, delivered, failed, 2 more } id: string Unique identifier for a message retrieved from investigation. Link to this property delivered?: Array<string>| null Link to this property failed?: Array<string>| null Link to this property Deprecatedpostfix\_id?: string Use id instead. Deprecated, use id instead. End of life: November 1, 2026. Link to this property undelivered?: Array<string>| null Link to this property
[Link to this property](<#(resource)%20email_security.investigate.release%20%3E%20(model)%20release_bulk_response%20%3E%20(schema)>) #### Email SecurityInvestigateBulk ##### [List bulk action jobs](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/bulk/methods/list) client.emailSecurity.investigate.bulk.list(BulkListParams {account\_id, action\_type, page, 2 more } params, RequestOptionsoptions?): V4PagePaginationArray< [BulkListResponse]() {action\_params, action\_type, created\_at, 13 more } > GET/accounts/{account\_id}/email-security/investigate/bulk ##### [Create a bulk action job](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/bulk/methods/create) client.emailSecurity.investigate.bulk.create(BulkCreateParams {account\_id, action, search\_params, 3 more } params, RequestOptionsoptions?): [BulkCreateResponse]() {action\_params, action\_type, created\_at, 13 more } POST/accounts/{account\_id}/email-security/investigate/bulk ##### [Get bulk action job details](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/bulk/methods/get) client.emailSecurity.investigate.bulk.get(stringjobID, BulkGetParams {account\_id } params, RequestOptionsoptions?): [BulkGetResponse]() {action\_params, action\_type, created\_at, 13 more } GET/accounts/{account\_id}/email-security/investigate/bulk/{job\_id} ##### [Delete a bulk action job](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/bulk/methods/delete) client.emailSecurity.investigate.bulk.delete(stringjobID, BulkDeleteParams {account\_id } params, RequestOptionsoptions?): [BulkDeleteResponse]() {id } DELETE/accounts/{account\_id}/email-security/investigate/bulk/{job\_id} ##### ModelsExpand Collapse
BulkListResponse {action\_params, action\_type, created\_at, 13 more }
action\_params: Move {destination, type, expected\_disposition } | Release {type } One of the following:
Move {destination, type, expected\_disposition }
destination: "Inbox"| "JunkEmail"| "DeletedItems"| 2 more The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: "MOVE" Link to this property
Deprecatedexpected\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
Release {type } type: "RELEASE" Link to this property
Link to this property
Link to this property
action\_type: "MOVE"| "RELEASE" One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: string formatdate-time Link to this property job\_id: string formatuuid Link to this property messages\_cancelled: number Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: number Link to this property messages\_pending: number Link to this property messages\_skipped: number Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: number Link to this property
search\_params: SearchParams {action\_log, alert\_id, delivery\_status, 15 more } Deprecatedaction\_log?: boolean Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id?: string| null Alert ID of the detection to filter by. Link to this property
delivery\_status?: "delivered"| "moved"| "quarantined"| 5 more| null Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only?: boolean Whether to include only detections in search results. Link to this property domain?: string| null Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end?: string End of search date range. formatdate-time Link to this property exact\_subject?: string| null Match messages whose subject line equals this value exactly. Link to this property
final\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action?: "PREVIEW"| "QUARANTINE\_RELEASED"| "MOVED"| null Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id?: string| null Message-ID header value to filter by. Link to this property metric?: string| null Metric name to filter the search by. Link to this property query?: string| null Space-delimited search term. Case-insensitive. Link to this property recipient?: string| null Match messages whose recipient is this email address or domain. Link to this property sender?: string| null Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip?: string| null Matches messages whose SMTP HELO server IP address equals this value. Link to this property start?: string Beginning of search date range. formatdate-time Link to this property subject?: string| null Match messages whose subject contains these keywords, in any order. Link to this property submissions?: boolean Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: "PENDING"| "DISCOVERING"| "PROCESSING"| 3 more Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: number Link to this property comment?: string| null Link to this property completed\_at?: string| null formatdate-time Link to this property started\_at?: string| null formatdate-time Link to this property status\_message?: string| null Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_list_response%20%3E%20(schema)>)
BulkCreateResponse {action\_params, action\_type, created\_at, 13 more }
action\_params: Move {destination, type, expected\_disposition } | Release {type } One of the following:
Move {destination, type, expected\_disposition }
destination: "Inbox"| "JunkEmail"| "DeletedItems"| 2 more The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: "MOVE" Link to this property
Deprecatedexpected\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
Release {type } type: "RELEASE" Link to this property
Link to this property
Link to this property
action\_type: "MOVE"| "RELEASE" One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: string formatdate-time Link to this property job\_id: string formatuuid Link to this property messages\_cancelled: number Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: number Link to this property messages\_pending: number Link to this property messages\_skipped: number Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: number Link to this property
search\_params: SearchParams {action\_log, alert\_id, delivery\_status, 15 more } Deprecatedaction\_log?: boolean Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id?: string| null Alert ID of the detection to filter by. Link to this property
delivery\_status?: "delivered"| "moved"| "quarantined"| 5 more| null Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only?: boolean Whether to include only detections in search results. Link to this property domain?: string| null Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end?: string End of search date range. formatdate-time Link to this property exact\_subject?: string| null Match messages whose subject line equals this value exactly. Link to this property
final\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action?: "PREVIEW"| "QUARANTINE\_RELEASED"| "MOVED"| null Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id?: string| null Message-ID header value to filter by. Link to this property metric?: string| null Metric name to filter the search by. Link to this property query?: string| null Space-delimited search term. Case-insensitive. Link to this property recipient?: string| null Match messages whose recipient is this email address or domain. Link to this property sender?: string| null Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip?: string| null Matches messages whose SMTP HELO server IP address equals this value. Link to this property start?: string Beginning of search date range. formatdate-time Link to this property subject?: string| null Match messages whose subject contains these keywords, in any order. Link to this property submissions?: boolean Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: "PENDING"| "DISCOVERING"| "PROCESSING"| 3 more Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: number Link to this property comment?: string| null Link to this property completed\_at?: string| null formatdate-time Link to this property started\_at?: string| null formatdate-time Link to this property status\_message?: string| null Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_create_response%20%3E%20(schema)>)
BulkGetResponse {action\_params, action\_type, created\_at, 13 more }
action\_params: Move {destination, type, expected\_disposition } | Release {type } One of the following:
Move {destination, type, expected\_disposition }
destination: "Inbox"| "JunkEmail"| "DeletedItems"| 2 more The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: "MOVE" Link to this property
Deprecatedexpected\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
Release {type } type: "RELEASE" Link to this property
Link to this property
Link to this property
action\_type: "MOVE"| "RELEASE" One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: string formatdate-time Link to this property job\_id: string formatuuid Link to this property messages\_cancelled: number Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: number Link to this property messages\_pending: number Link to this property messages\_skipped: number Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: number Link to this property
search\_params: SearchParams {action\_log, alert\_id, delivery\_status, 15 more } Deprecatedaction\_log?: boolean Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id?: string| null Alert ID of the detection to filter by. Link to this property
delivery\_status?: "delivered"| "moved"| "quarantined"| 5 more| null Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only?: boolean Whether to include only detections in search results. Link to this property domain?: string| null Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end?: string End of search date range. formatdate-time Link to this property exact\_subject?: string| null Match messages whose subject line equals this value exactly. Link to this property
final\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action?: "PREVIEW"| "QUARANTINE\_RELEASED"| "MOVED"| null Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id?: string| null Message-ID header value to filter by. Link to this property metric?: string| null Metric name to filter the search by. Link to this property query?: string| null Space-delimited search term. Case-insensitive. Link to this property recipient?: string| null Match messages whose recipient is this email address or domain. Link to this property sender?: string| null Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip?: string| null Matches messages whose SMTP HELO server IP address equals this value. Link to this property start?: string Beginning of search date range. formatdate-time Link to this property subject?: string| null Match messages whose subject contains these keywords, in any order. Link to this property submissions?: boolean Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: "PENDING"| "DISCOVERING"| "PROCESSING"| 3 more Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: number Link to this property comment?: string| null Link to this property completed\_at?: string| null formatdate-time Link to this property started\_at?: string| null formatdate-time Link to this property status\_message?: string| null Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_get_response%20%3E%20(schema)>)
BulkDeleteResponse {id } id: string formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_delete_response%20%3E%20(schema)>) #### Email SecurityInvestigateBulkCancel ##### [Cancel a bulk action job](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/bulk/subresources/cancel/methods/create) client.emailSecurity.investigate.bulk.cancel.create(stringjobID, CancelCreateParams {account\_id } params, RequestOptionsoptions?): [CancelCreateResponse]() {action\_params, action\_type, created\_at, 13 more } POST/accounts/{account\_id}/email-security/investigate/bulk/{job\_id}/cancel ##### ModelsExpand Collapse
CancelCreateResponse {action\_params, action\_type, created\_at, 13 more }
action\_params: Move {destination, type, expected\_disposition } | Release {type } One of the following:
Move {destination, type, expected\_disposition }
destination: "Inbox"| "JunkEmail"| "DeletedItems"| 2 more The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: "MOVE" Link to this property
Deprecatedexpected\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
Release {type } type: "RELEASE" Link to this property
Link to this property
Link to this property
action\_type: "MOVE"| "RELEASE" One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: string formatdate-time Link to this property job\_id: string formatuuid Link to this property messages\_cancelled: number Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: number Link to this property messages\_pending: number Link to this property messages\_skipped: number Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: number Link to this property
search\_params: SearchParams {action\_log, alert\_id, delivery\_status, 15 more } Deprecatedaction\_log?: boolean Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id?: string| null Alert ID of the detection to filter by. Link to this property
delivery\_status?: "delivered"| "moved"| "quarantined"| 5 more| null Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only?: boolean Whether to include only detections in search results. Link to this property domain?: string| null Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end?: string End of search date range. formatdate-time Link to this property exact\_subject?: string| null Match messages whose subject line equals this value exactly. Link to this property
final\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action?: "PREVIEW"| "QUARANTINE\_RELEASED"| "MOVED"| null Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id?: string| null Message-ID header value to filter by. Link to this property metric?: string| null Metric name to filter the search by. Link to this property query?: string| null Space-delimited search term. Case-insensitive. Link to this property recipient?: string| null Match messages whose recipient is this email address or domain. Link to this property sender?: string| null Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip?: string| null Matches messages whose SMTP HELO server IP address equals this value. Link to this property start?: string Beginning of search date range. formatdate-time Link to this property subject?: string| null Match messages whose subject contains these keywords, in any order. Link to this property submissions?: boolean Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: "PENDING"| "DISCOVERING"| "PROCESSING"| 3 more Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: number Link to this property comment?: string| null Link to this property completed\_at?: string| null formatdate-time Link to this property started\_at?: string| null formatdate-time Link to this property status\_message?: string| null Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk.cancel%20%3E%20(model)%20cancel_create_response%20%3E%20(schema)>) #### Email SecurityInvestigateBulkMessages ##### [List messages for a bulk action job](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/bulk/subresources/messages/methods/list) client.emailSecurity.investigate.bulk.messages.list(stringjobID, MessageListParams {account\_id, page, per\_page, status } params, RequestOptionsoptions?): V4PagePaginationArray< [MessageListResponse]() {action\_params, action\_type, created\_at, 10 more } > GET/accounts/{account\_id}/email-security/investigate/bulk/{job\_id}/messages ##### ModelsExpand Collapse
MessageListResponse {action\_params, action\_type, created\_at, 10 more }
action\_params: Move {client\_recipient, destination, type, expected\_disposition } | Release {client\_recipient, type } One of the following:
Move {client\_recipient, destination, type, expected\_disposition } client\_recipient: string Link to this property
destination: "Inbox"| "JunkEmail"| "DeletedItems"| 2 more The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: "MOVE" Link to this property
Deprecatedexpected\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
Release {client\_recipient, type } client\_recipient: string Link to this property type: "RELEASE" Link to this property
Link to this property
Link to this property
action\_type: "MOVE"| "RELEASE" One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: string formatdate-time Link to this property message\_id: string formatuuid Link to this property postfix\_id: string Link to this property retry\_count: number Link to this property
status: "PENDING"| "PROCESSING"| "COMPLETED"| 3 more Status of a message within a bulk action job. One of the following: "PENDING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property "SKIPPED" Link to this property
Link to this property alert\_id?: string| null Link to this property email\_message\_id?: string| null Link to this property
message?: Message {id, action\_log, client\_recipients, 32 more } id: string Unique identifier for a message retrieved from investigation. Link to this property
Deprecatedaction\_log: Array<ActionLog> Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. completed\_at: string Timestamp when action completed. formatdate-time Link to this property
operation: "MOVE"| "RELEASE"| "RECLASSIFY"| 3 more Type of action performed. One of the following: "MOVE" Link to this property "RELEASE" Link to this property "RECLASSIFY" Link to this property "SUBMISSION" Link to this property "QUARANTINE\_RELEASE" Link to this property "PREVIEW" Link to this property
Link to this property Deprecatedcompleted\_timestamp?: string Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. Link to this property
properties?: Properties {folder, requested\_by } Additional properties for the action. folder?: string Target folder for move operations. Link to this property requested\_by?: string User who requested the action. Link to this property
Link to this property status?: string| null Status of the action. Link to this property
Link to this property client\_recipients: Array<string> Link to this property detection\_reasons: Array<string> Link to this property is\_phish\_submission: boolean Link to this property is\_quarantined: boolean Link to this property postfix\_id: string The identifier of the message. Link to this property
properties: Properties {allowlisted\_pattern, allowlisted\_pattern\_type, blocklisted\_message, 2 more } Message processing properties. allowlisted\_pattern?: string| null Pattern that allowlisted this message. Link to this property
allowlisted\_pattern\_type?: "quarantine\_release"| "acceptable\_sender"| "allowed\_sender"| 5 more| null Type of allowlist pattern. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property blocklisted\_message?: boolean| null Whether message was blocklisted. Link to this property blocklisted\_pattern?: string| null Pattern that blocklisted this message. Link to this property
whitelisted\_pattern\_type?: "quarantine\_release"| "acceptable\_sender"| "allowed\_sender"| 5 more| null Legacy field for allowlist pattern type. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property
Link to this property Deprecatedts: string Use scanned_at instead. Deprecated, use scanned_at instead. End of life: November 1, 2026. Link to this property alert\_id?: string| null Link to this property
delivery\_mode?: "DIRECT"| "BCC"| "JOURNAL"| 8 more| null One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "REVIEW\_SUBMISSION" Link to this property "DMARC\_UNVERIFIED" Link to this property "DMARC\_FAILURE\_REPORT" Link to this property "DMARC\_AGGREGATE\_REPORT" Link to this property "THREAT\_INTEL\_SUBMISSION" Link to this property "SIMULATION\_SUBMISSION" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
delivery\_status?: Array<"delivered"| "moved"| "quarantined"| 5 more>| null One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property edf\_hash?: string| null Link to this property envelope\_from?: string| null Link to this property envelope\_to?: Array<string>| null Link to this property
final\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Deprecatedfindings?: Array<Finding>| null Use the findings field from GET /investigate/{investigate\_id}/detections instead. Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message. attachment?: string| null Link to this property detail?: string| null Link to this property
detection?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field?: string| null Link to this property name?: string| null Link to this property portion?: string| null Link to this property reason?: string| null Link to this property score?: number| null formatdouble Link to this property value?: string| null Link to this property
Link to this property from?: string| null Link to this property from\_name?: string| null Link to this property htmltext\_structure\_hash?: string| null Link to this property message\_id?: string| null Link to this property
post\_delivery\_operations?: Array<"PREVIEW"| "QUARANTINE\_RELEASE"| "SUBMISSION"| "MOVE">| null Post-delivery operations performed on this message. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASE" Link to this property "SUBMISSION" Link to this property "MOVE" Link to this property
Link to this property postfix\_id\_outbound?: string| null Link to this property replyto?: string| null Link to this property scanned\_at?: string| null When the message was scanned (UTC). formatdate-time Link to this property sent\_at?: string| null When the message was sent (UTC). formatdate-time Link to this property sent\_date?: string| null Link to this property smtp\_helo\_server\_ip?: string| null Link to this property smtp\_previous\_hop\_ip?: string| null Link to this property subject?: string| null Link to this property threat\_categories?: Array<string>| null Link to this property to?: Array<string>| null Link to this property to\_name?: Array<string>| null Link to this property
validation?: Validation| null comment?: string| null Link to this property
dkim?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property x\_originating\_ip?: string| null Link to this property
Link to this property processed\_at?: string| null formatdate-time Link to this property retry\_after?: string| null When to retry the action if it failed. formatdate-time Link to this property status\_message?: string| null Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk.messages%20%3E%20(model)%20message_list_response%20%3E%20(schema)>) #### Email SecurityPhishguard #### Email SecurityPhishguardReports ##### [List PhishGuard reports](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/phishguard/subresources/reports/methods/list) client.emailSecurity.phishguard.reports.list(ReportListParams {account\_id, end, from\_date, 4 more } params, RequestOptionsoptions?): V4PagePaginationArray< [ReportListResponse]() {id, content, disposition, 7 more } > GET/accounts/{account\_id}/email-security/phishguard/reports ##### ModelsExpand Collapse
ReportListResponse {id, content, disposition, 7 more } id: number Link to this property content: string Link to this property
disposition: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
fields: Fields {to, from, occurred\_at, 2 more } to: Array<string> Link to this property from?: string| null Link to this property occurred\_at?: string formatdate-time Link to this property postfix\_id?: string| null Link to this property Deprecatedts?: string Use occurred_at instead. Deprecated, use occurred_at instead. formatdate-time Link to this property
Link to this property priority: string Link to this property title: string Link to this property created\_at?: string| null formatdate-time Link to this property
tags?: Array<Tag>| null category: string Link to this property value: string Link to this property
Link to this property Deprecatedts?: string Use created_at instead. Deprecated, use created_at instead. formatdate-time Link to this property updated\_at?: string| null formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.phishguard.reports%20%3E%20(model)%20report_list_response%20%3E%20(schema)>) #### Email SecuritySettings #### Email SecuritySettingsAllow Policies ##### [List email allow policies](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/allow_policies/methods/list) client.emailSecurity.settings.allowPolicies.list(AllowPolicyListParams {account\_id, direction, is\_acceptable\_sender, 9 more } params, RequestOptionsoptions?): V4PagePaginationArray< [AllowPolicyListResponse]() {id, created\_at, last\_modified, 12 more } > GET/accounts/{account\_id}/email-security/settings/allow\_policies ##### [Get an email allow policy](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/allow_policies/methods/get) client.emailSecurity.settings.allowPolicies.get(stringpolicyID, AllowPolicyGetParams {account\_id } params, RequestOptionsoptions?): [AllowPolicyGetResponse]() {id, created\_at, last\_modified, 12 more } GET/accounts/{account\_id}/email-security/settings/allow\_policies/{policy\_id} ##### [Create email allow policy](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/allow_policies/methods/create) client.emailSecurity.settings.allowPolicies.create(AllowPolicyCreateParams {account\_id, is\_acceptable\_sender, is\_exempt\_recipient, 9 more } params, RequestOptionsoptions?): [AllowPolicyCreateResponse]() {id, created\_at, last\_modified, 12 more } POST/accounts/{account\_id}/email-security/settings/allow\_policies ##### [Update an email allow policy](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/allow_policies/methods/edit) client.emailSecurity.settings.allowPolicies.edit(stringpolicyID, AllowPolicyEditParams {account\_id, comments, is\_acceptable\_sender, 9 more } params, RequestOptionsoptions?): [AllowPolicyEditResponse]() {id, created\_at, last\_modified, 12 more } PATCH/accounts/{account\_id}/email-security/settings/allow\_policies/{policy\_id} ##### [Delete an email allow policy](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/allow_policies/methods/delete) client.emailSecurity.settings.allowPolicies.delete(stringpolicyID, AllowPolicyDeleteParams {account\_id } params, RequestOptionsoptions?): [AllowPolicyDeleteResponse]() {id } DELETE/accounts/{account\_id}/email-security/settings/allow\_policies/{policy\_id} ##### [Batch allow policy operations](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/allow_policies/methods/batch) client.emailSecurity.settings.allowPolicies.batch(AllowPolicyBatchParams {account\_id, deletes, patches, 2 more } params, RequestOptionsoptions?): [AllowPolicyBatchResponse]() {deletes, patches, posts, puts } POST/accounts/{account\_id}/email-security/settings/allow\_policies/batch ##### ModelsExpand Collapse
AllowPolicyListResponse {id, created\_at, last\_modified, 12 more } An email allow policy. id: string Allow policy identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property Deprecatedlast\_modified: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments?: string| null maxLength1024 Link to this property is\_acceptable\_sender?: boolean Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient?: boolean Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient?: boolean Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex?: boolean Link to this property Deprecatedis\_sender?: boolean Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof?: boolean Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender?: boolean Bypasses all detections and link following for messages from this sender. Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type?: "EMAIL"| "DOMAIN"| "IP"| "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender?: boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_list_response%20%3E%20(schema)>)
AllowPolicyGetResponse {id, created\_at, last\_modified, 12 more } An email allow policy. id: string Allow policy identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property Deprecatedlast\_modified: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments?: string| null maxLength1024 Link to this property is\_acceptable\_sender?: boolean Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient?: boolean Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient?: boolean Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex?: boolean Link to this property Deprecatedis\_sender?: boolean Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof?: boolean Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender?: boolean Bypasses all detections and link following for messages from this sender. Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type?: "EMAIL"| "DOMAIN"| "IP"| "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender?: boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_get_response%20%3E%20(schema)>)
AllowPolicyCreateResponse {id, created\_at, last\_modified, 12 more } An email allow policy. id: string Allow policy identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property Deprecatedlast\_modified: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments?: string| null maxLength1024 Link to this property is\_acceptable\_sender?: boolean Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient?: boolean Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient?: boolean Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex?: boolean Link to this property Deprecatedis\_sender?: boolean Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof?: boolean Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender?: boolean Bypasses all detections and link following for messages from this sender. Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type?: "EMAIL"| "DOMAIN"| "IP"| "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender?: boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_create_response%20%3E%20(schema)>)
AllowPolicyEditResponse {id, created\_at, last\_modified, 12 more } An email allow policy. id: string Allow policy identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property Deprecatedlast\_modified: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments?: string| null maxLength1024 Link to this property is\_acceptable\_sender?: boolean Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient?: boolean Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient?: boolean Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex?: boolean Link to this property Deprecatedis\_sender?: boolean Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof?: boolean Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender?: boolean Bypasses all detections and link following for messages from this sender. Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type?: "EMAIL"| "DOMAIN"| "IP"| "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender?: boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_edit_response%20%3E%20(schema)>)
AllowPolicyDeleteResponse {id } id: string Allow policy identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_delete_response%20%3E%20(schema)>)
AllowPolicyBatchResponse {deletes, patches, posts, puts }
deletes?: Array<Delete> id: string Allow policy identifier. formatuuid Link to this property
Link to this property
patches?: Array<Patch> id: string Allow policy identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property Deprecatedlast\_modified: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments?: string| null maxLength1024 Link to this property is\_acceptable\_sender?: boolean Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient?: boolean Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient?: boolean Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex?: boolean Link to this property Deprecatedis\_sender?: boolean Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof?: boolean Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender?: boolean Bypasses all detections and link following for messages from this sender. Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type?: "EMAIL"| "DOMAIN"| "IP"| "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender?: boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
Link to this property
posts?: Array<Post> id: string Allow policy identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property Deprecatedlast\_modified: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments?: string| null maxLength1024 Link to this property is\_acceptable\_sender?: boolean Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient?: boolean Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient?: boolean Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex?: boolean Link to this property Deprecatedis\_sender?: boolean Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof?: boolean Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender?: boolean Bypasses all detections and link following for messages from this sender. Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type?: "EMAIL"| "DOMAIN"| "IP"| "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender?: boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
Link to this property
puts?: Array<Put> id: string Allow policy identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property Deprecatedlast\_modified: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property comments?: string| null maxLength1024 Link to this property is\_acceptable\_sender?: boolean Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply. Link to this property is\_exempt\_recipient?: boolean Bypasses all detections for messages to this recipient. Link to this property Deprecatedis\_recipient?: boolean Use is_exempt_recipient instead. Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026. Link to this property is\_regex?: boolean Link to this property Deprecatedis\_sender?: boolean Use is_trusted_sender instead. Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026. Link to this property Deprecatedis\_spoof?: boolean Use is_acceptable_sender instead. Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026. Link to this property is\_trusted\_sender?: boolean Bypasses all detections and link following for messages from this sender. Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type?: "EMAIL"| "DOMAIN"| "IP"| "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property verify\_sender?: boolean Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication. Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.allow_policies%20%3E%20(model)%20allow_policy_batch_response%20%3E%20(schema)>) #### Email SecuritySettingsBlock Senders ##### [List blocked email senders](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/block_senders/methods/list) client.emailSecurity.settings.blockSenders.list(BlockSenderListParams {account\_id, direction, order, 5 more } params, RequestOptionsoptions?): V4PagePaginationArray< [BlockSenderListResponse]() {id, comments, created\_at, 5 more } > GET/accounts/{account\_id}/email-security/settings/block\_senders ##### [Get a blocked email sender](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/block_senders/methods/get) client.emailSecurity.settings.blockSenders.get(stringpatternID, BlockSenderGetParams {account\_id } params, RequestOptionsoptions?): [BlockSenderGetResponse]() {id, comments, created\_at, 5 more } GET/accounts/{account\_id}/email-security/settings/block\_senders/{pattern\_id} ##### [Create blocked email sender](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/block_senders/methods/create) client.emailSecurity.settings.blockSenders.create(BlockSenderCreateParams {account\_id, is\_regex, pattern, 2 more } params, RequestOptionsoptions?): [BlockSenderCreateResponse]() {id, comments, created\_at, 5 more } POST/accounts/{account\_id}/email-security/settings/block\_senders ##### [Update a blocked email sender](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/block_senders/methods/edit) client.emailSecurity.settings.blockSenders.edit(stringpatternID, BlockSenderEditParams {account\_id, comments, is\_regex, 2 more } params, RequestOptionsoptions?): [BlockSenderEditResponse]() {id, comments, created\_at, 5 more } PATCH/accounts/{account\_id}/email-security/settings/block\_senders/{pattern\_id} ##### [Delete a blocked email sender](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/block_senders/methods/delete) client.emailSecurity.settings.blockSenders.delete(stringpatternID, BlockSenderDeleteParams {account\_id } params, RequestOptionsoptions?): [BlockSenderDeleteResponse]() {id } DELETE/accounts/{account\_id}/email-security/settings/block\_senders/{pattern\_id} ##### [Batch blocked sender operations](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/block_senders/methods/batch) client.emailSecurity.settings.blockSenders.batch(BlockSenderBatchParams {account\_id, deletes, patches, 2 more } params, RequestOptionsoptions?): [BlockSenderBatchResponse]() {deletes, patches, posts, puts } POST/accounts/{account\_id}/email-security/settings/block\_senders/batch ##### ModelsExpand Collapse
BlockSenderListResponse {id, comments, created\_at, 5 more } A blocked sender pattern. id?: string Blocked sender pattern identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property is\_regex?: boolean Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type?: "EMAIL"| "DOMAIN"| "IP"| "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_list_response%20%3E%20(schema)>)
BlockSenderGetResponse {id, comments, created\_at, 5 more } A blocked sender pattern. id?: string Blocked sender pattern identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property is\_regex?: boolean Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type?: "EMAIL"| "DOMAIN"| "IP"| "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_get_response%20%3E%20(schema)>)
BlockSenderCreateResponse {id, comments, created\_at, 5 more } A blocked sender pattern. id?: string Blocked sender pattern identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property is\_regex?: boolean Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type?: "EMAIL"| "DOMAIN"| "IP"| "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_create_response%20%3E%20(schema)>)
BlockSenderEditResponse {id, comments, created\_at, 5 more } A blocked sender pattern. id?: string Blocked sender pattern identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property is\_regex?: boolean Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type?: "EMAIL"| "DOMAIN"| "IP"| "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_edit_response%20%3E%20(schema)>)
BlockSenderDeleteResponse {id } id: string Blocked sender pattern identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_delete_response%20%3E%20(schema)>)
BlockSenderBatchResponse {deletes, patches, posts, puts }
deletes?: Array<Delete> id: string Blocked sender pattern identifier. formatuuid Link to this property
Link to this property
patches?: Array<Patch> id?: string Blocked sender pattern identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property is\_regex?: boolean Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type?: "EMAIL"| "DOMAIN"| "IP"| "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
Link to this property
posts?: Array<Post> id?: string Blocked sender pattern identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property is\_regex?: boolean Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type?: "EMAIL"| "DOMAIN"| "IP"| "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
Link to this property
puts?: Array<Put> id?: string Blocked sender pattern identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property is\_regex?: boolean Whether pattern is a regular expression instead of a literal value. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. maxLength1024 minLength1 Link to this property
pattern\_type?: "EMAIL"| "DOMAIN"| "IP"| "UNKNOWN" Type of pattern matching. - EMAIL: matches a full email address (e.g. user@example.com) - DOMAIN: matches a domain name (e.g. example.com) - IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries. One of the following: "EMAIL" Link to this property "DOMAIN" Link to this property "IP" Link to this property "UNKNOWN" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.block_senders%20%3E%20(model)%20block_sender_batch_response%20%3E%20(schema)>) #### Email SecuritySettingsContent Policies ##### [List content policies](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/content_policies/methods/list) client.emailSecurity.settings.contentPolicies.list(ContentPolicyListParams {account\_id, direction, enabled, 5 more } params, RequestOptionsoptions?): V4PagePaginationArray< [ContentPolicyListResponse]() {id, created\_at, enabled, 5 more } > GET/accounts/{account\_id}/email-security/settings/content\_policies ##### [Get a content policy](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/content_policies/methods/get) client.emailSecurity.settings.contentPolicies.get(stringpolicyID, ContentPolicyGetParams {account\_id } params, RequestOptionsoptions?): [ContentPolicyGetResponse]() {id, created\_at, enabled, 5 more } GET/accounts/{account\_id}/email-security/settings/content\_policies/{policy\_id} ##### [Create a content policy](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/content_policies/methods/create) client.emailSecurity.settings.contentPolicies.create(ContentPolicyCreateParams {account\_id, enabled, name, 3 more } params, RequestOptionsoptions?): [ContentPolicyCreateResponse]() {id, created\_at, enabled, 5 more } POST/accounts/{account\_id}/email-security/settings/content\_policies ##### [Update a content policy](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/content_policies/methods/edit) client.emailSecurity.settings.contentPolicies.edit(stringpolicyID, ContentPolicyEditParams {account\_id, enabled, name, 3 more } params, RequestOptionsoptions?): [ContentPolicyEditResponse]() {id, created\_at, enabled, 5 more } PATCH/accounts/{account\_id}/email-security/settings/content\_policies/{policy\_id} ##### [Delete a content policy](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/content_policies/methods/delete) client.emailSecurity.settings.contentPolicies.delete(stringpolicyID, ContentPolicyDeleteParams {account\_id } params, RequestOptionsoptions?): [ContentPolicyDeleteResponse]() {id } DELETE/accounts/{account\_id}/email-security/settings/content\_policies/{policy\_id} ##### [Batch content policy operations](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/content_policies/methods/batch) client.emailSecurity.settings.contentPolicies.batch(ContentPolicyBatchParams {account\_id, deletes, patches, 2 more } params, RequestOptionsoptions?): [ContentPolicyBatchResponse]() {deletes, patches, posts, puts } POST/accounts/{account\_id}/email-security/settings/content\_policies/batch ##### ModelsExpand Collapse
ContentPolicyListResponse {id, created\_at, enabled, 5 more } A content policy pattern that matches against the subject or body of an email. id?: string Content policy identifier. formatuuid Link to this property created\_at?: string formatdate-time Link to this property enabled?: boolean Whether the policy is active. Link to this property modified\_at?: string formatdate-time Link to this property name?: string Human-readable name of the policy. maxLength256 minLength1 Link to this property notes?: string| null Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern?: string Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets?: Array<"SUBJECT"| "BODY"> Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_list_response%20%3E%20(schema)>)
ContentPolicyGetResponse {id, created\_at, enabled, 5 more } A content policy pattern that matches against the subject or body of an email. id?: string Content policy identifier. formatuuid Link to this property created\_at?: string formatdate-time Link to this property enabled?: boolean Whether the policy is active. Link to this property modified\_at?: string formatdate-time Link to this property name?: string Human-readable name of the policy. maxLength256 minLength1 Link to this property notes?: string| null Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern?: string Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets?: Array<"SUBJECT"| "BODY"> Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_get_response%20%3E%20(schema)>)
ContentPolicyCreateResponse {id, created\_at, enabled, 5 more } A content policy pattern that matches against the subject or body of an email. id?: string Content policy identifier. formatuuid Link to this property created\_at?: string formatdate-time Link to this property enabled?: boolean Whether the policy is active. Link to this property modified\_at?: string formatdate-time Link to this property name?: string Human-readable name of the policy. maxLength256 minLength1 Link to this property notes?: string| null Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern?: string Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets?: Array<"SUBJECT"| "BODY"> Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_create_response%20%3E%20(schema)>)
ContentPolicyEditResponse {id, created\_at, enabled, 5 more } A content policy pattern that matches against the subject or body of an email. id?: string Content policy identifier. formatuuid Link to this property created\_at?: string formatdate-time Link to this property enabled?: boolean Whether the policy is active. Link to this property modified\_at?: string formatdate-time Link to this property name?: string Human-readable name of the policy. maxLength256 minLength1 Link to this property notes?: string| null Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern?: string Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets?: Array<"SUBJECT"| "BODY"> Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_edit_response%20%3E%20(schema)>)
ContentPolicyDeleteResponse {id } id: string Content policy identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_delete_response%20%3E%20(schema)>)
ContentPolicyBatchResponse {deletes, patches, posts, puts }
deletes?: Array<Delete> id: string Content policy identifier. formatuuid Link to this property
Link to this property
patches?: Array<Patch> id?: string Content policy identifier. formatuuid Link to this property created\_at?: string formatdate-time Link to this property enabled?: boolean Whether the policy is active. Link to this property modified\_at?: string formatdate-time Link to this property name?: string Human-readable name of the policy. maxLength256 minLength1 Link to this property notes?: string| null Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern?: string Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets?: Array<"SUBJECT"| "BODY"> Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
Link to this property
posts?: Array<Post> id?: string Content policy identifier. formatuuid Link to this property created\_at?: string formatdate-time Link to this property enabled?: boolean Whether the policy is active. Link to this property modified\_at?: string formatdate-time Link to this property name?: string Human-readable name of the policy. maxLength256 minLength1 Link to this property notes?: string| null Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern?: string Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets?: Array<"SUBJECT"| "BODY"> Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
Link to this property
puts?: Array<Put> id?: string Content policy identifier. formatuuid Link to this property created\_at?: string formatdate-time Link to this property enabled?: boolean Whether the policy is active. Link to this property modified\_at?: string formatdate-time Link to this property name?: string Human-readable name of the policy. maxLength256 minLength1 Link to this property notes?: string| null Optional note describing the purpose of the policy. maxLength4096 Link to this property pattern?: string Regular expression the policy matches against. maxLength2048 minLength1 Link to this property
targets?: Array<"SUBJECT"| "BODY"> Parts of the email the pattern is matched against. One of the following: "SUBJECT" Link to this property "BODY" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.content_policies%20%3E%20(model)%20content_policy_batch_response%20%3E%20(schema)>) #### Email SecuritySettingsDomains ##### [List protected email domains](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/domains/methods/list) client.emailSecurity.settings.domains.list(DomainListParams {account\_id, active\_delivery\_mode, allowed\_delivery\_mode, 8 more } params, RequestOptionsoptions?): V4PagePaginationArray< [DomainListResponse]() {id, allowed\_delivery\_modes, authorization, 19 more } > GET/accounts/{account\_id}/email-security/settings/domains ##### [Get an email domain](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/domains/methods/get) client.emailSecurity.settings.domains.get(stringdomainID, DomainGetParams {account\_id } params, RequestOptionsoptions?): [DomainGetResponse]() {id, allowed\_delivery\_modes, authorization, 19 more } GET/accounts/{account\_id}/email-security/settings/domains/{domain\_id} ##### [Replace an email domain](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/domains/methods/update) client.emailSecurity.settings.domains.update(stringdomainID, DomainUpdateParams {account\_id, allowed\_delivery\_modes, drop\_dispositions, 8 more } params, RequestOptionsoptions?): [DomainUpdateResponse]() {id, allowed\_delivery\_modes, authorization, 19 more } PUT/accounts/{account\_id}/email-security/settings/domains/{domain\_id} ##### [Update an email domain](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/domains/methods/edit) client.emailSecurity.settings.domains.edit(stringdomainID, DomainEditParams {account\_id, allowed\_delivery\_modes, drop\_dispositions, 8 more } params, RequestOptionsoptions?): [DomainEditResponse]() {id, allowed\_delivery\_modes, authorization, 19 more } PATCH/accounts/{account\_id}/email-security/settings/domains/{domain\_id} ##### [Add a new email domain](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/domains/methods/create) client.emailSecurity.settings.domains.create(DomainCreateParams {account\_id, allowed\_delivery\_modes, domain, 9 more } params, RequestOptionsoptions?): [DomainCreateResponse]() {id, allowed\_delivery\_modes, authorization, 19 more } POST/accounts/{account\_id}/email-security/settings/domains ##### [Unprotect an email domain](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/domains/methods/delete) client.emailSecurity.settings.domains.delete(stringdomainID, DomainDeleteParams {account\_id } params, RequestOptionsoptions?): [DomainDeleteResponse]() {id } DELETE/accounts/{account\_id}/email-security/settings/domains/{domain\_id} ##### [Batch domain operations](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/domains/methods/batch) client.emailSecurity.settings.domains.batch(DomainBatchParams {account\_id, deletes, patches, 2 more } params, RequestOptionsoptions?): [DomainBatchResponse]() {deletes, patches, posts, puts } POST/accounts/{account\_id}/email-security/settings/domains/batch ##### [Unprotect multiple email domains](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/domains/methods/bulk_delete) Deprecated client.emailSecurity.settings.domains.bulkDelete(DomainBulkDeleteParams {account\_id } params, RequestOptionsoptions?): SinglePage< [DomainBulkDeleteResponse]() {id } > DELETE/accounts/{account\_id}/email-security/settings/domains ##### ModelsExpand Collapse
DomainListResponse {id, allowed\_delivery\_modes, authorization, 19 more } id?: string Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes?: Array<"DIRECT"| "BCC"| "JOURNAL"| 2 more> One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization?: Authorization| null authorized: boolean Link to this property timestamp: string formatdate-time Link to this property status\_message?: string| null Link to this property
Link to this property created\_at?: string formatdate-time Link to this property
dmarc\_status?: "none"| "good"| "invalid"| null One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain?: string Link to this property
drop\_dispositions?: Array<"MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more> One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed?: EmailsProcessed| null timestamp: string formatdate-time Link to this property total\_emails\_processed: number minimum0 Link to this property total\_emails\_processed\_previous: number minimum0 Link to this property
Link to this property
folder?: "AllItems"| "Inbox"| null The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider?: "Microsoft"| "Google"| null One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id?: string| null formatuuid Link to this property ip\_restrictions?: Array<string> Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops?: number Link to this property modified\_at?: string formatdate-time Link to this property o365\_tenant\_id?: string| null Link to this property
regions?: Array<"GLOBAL"| "AU"| "DE"| 2 more> One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound?: boolean| null Link to this property require\_tls\_outbound?: boolean| null Link to this property
spf\_status?: "none"| "good"| "neutral"| 2 more| null One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status?: "PENDING"| "ACTIVE"| "FAILED"| "TIMEOUT"| null One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport?: string Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_list_response%20%3E%20(schema)>)
DomainGetResponse {id, allowed\_delivery\_modes, authorization, 19 more } id?: string Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes?: Array<"DIRECT"| "BCC"| "JOURNAL"| 2 more> One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization?: Authorization| null authorized: boolean Link to this property timestamp: string formatdate-time Link to this property status\_message?: string| null Link to this property
Link to this property created\_at?: string formatdate-time Link to this property
dmarc\_status?: "none"| "good"| "invalid"| null One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain?: string Link to this property
drop\_dispositions?: Array<"MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more> One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed?: EmailsProcessed| null timestamp: string formatdate-time Link to this property total\_emails\_processed: number minimum0 Link to this property total\_emails\_processed\_previous: number minimum0 Link to this property
Link to this property
folder?: "AllItems"| "Inbox"| null The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider?: "Microsoft"| "Google"| null One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id?: string| null formatuuid Link to this property ip\_restrictions?: Array<string> Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops?: number Link to this property modified\_at?: string formatdate-time Link to this property o365\_tenant\_id?: string| null Link to this property
regions?: Array<"GLOBAL"| "AU"| "DE"| 2 more> One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound?: boolean| null Link to this property require\_tls\_outbound?: boolean| null Link to this property
spf\_status?: "none"| "good"| "neutral"| 2 more| null One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status?: "PENDING"| "ACTIVE"| "FAILED"| "TIMEOUT"| null One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport?: string Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_get_response%20%3E%20(schema)>)
DomainUpdateResponse {id, allowed\_delivery\_modes, authorization, 19 more } id?: string Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes?: Array<"DIRECT"| "BCC"| "JOURNAL"| 2 more> One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization?: Authorization| null authorized: boolean Link to this property timestamp: string formatdate-time Link to this property status\_message?: string| null Link to this property
Link to this property created\_at?: string formatdate-time Link to this property
dmarc\_status?: "none"| "good"| "invalid"| null One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain?: string Link to this property
drop\_dispositions?: Array<"MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more> One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed?: EmailsProcessed| null timestamp: string formatdate-time Link to this property total\_emails\_processed: number minimum0 Link to this property total\_emails\_processed\_previous: number minimum0 Link to this property
Link to this property
folder?: "AllItems"| "Inbox"| null The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider?: "Microsoft"| "Google"| null One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id?: string| null formatuuid Link to this property ip\_restrictions?: Array<string> Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops?: number Link to this property modified\_at?: string formatdate-time Link to this property o365\_tenant\_id?: string| null Link to this property
regions?: Array<"GLOBAL"| "AU"| "DE"| 2 more> One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound?: boolean| null Link to this property require\_tls\_outbound?: boolean| null Link to this property
spf\_status?: "none"| "good"| "neutral"| 2 more| null One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status?: "PENDING"| "ACTIVE"| "FAILED"| "TIMEOUT"| null One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport?: string Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_update_response%20%3E%20(schema)>)
DomainEditResponse {id, allowed\_delivery\_modes, authorization, 19 more } id?: string Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes?: Array<"DIRECT"| "BCC"| "JOURNAL"| 2 more> One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization?: Authorization| null authorized: boolean Link to this property timestamp: string formatdate-time Link to this property status\_message?: string| null Link to this property
Link to this property created\_at?: string formatdate-time Link to this property
dmarc\_status?: "none"| "good"| "invalid"| null One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain?: string Link to this property
drop\_dispositions?: Array<"MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more> One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed?: EmailsProcessed| null timestamp: string formatdate-time Link to this property total\_emails\_processed: number minimum0 Link to this property total\_emails\_processed\_previous: number minimum0 Link to this property
Link to this property
folder?: "AllItems"| "Inbox"| null The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider?: "Microsoft"| "Google"| null One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id?: string| null formatuuid Link to this property ip\_restrictions?: Array<string> Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops?: number Link to this property modified\_at?: string formatdate-time Link to this property o365\_tenant\_id?: string| null Link to this property
regions?: Array<"GLOBAL"| "AU"| "DE"| 2 more> One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound?: boolean| null Link to this property require\_tls\_outbound?: boolean| null Link to this property
spf\_status?: "none"| "good"| "neutral"| 2 more| null One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status?: "PENDING"| "ACTIVE"| "FAILED"| "TIMEOUT"| null One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport?: string Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_edit_response%20%3E%20(schema)>)
DomainCreateResponse {id, allowed\_delivery\_modes, authorization, 19 more } id?: string Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes?: Array<"DIRECT"| "BCC"| "JOURNAL"| 2 more> One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization?: Authorization| null authorized: boolean Link to this property timestamp: string formatdate-time Link to this property status\_message?: string| null Link to this property
Link to this property created\_at?: string formatdate-time Link to this property
dmarc\_status?: "none"| "good"| "invalid"| null One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain?: string Link to this property
drop\_dispositions?: Array<"MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more> One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed?: EmailsProcessed| null timestamp: string formatdate-time Link to this property total\_emails\_processed: number minimum0 Link to this property total\_emails\_processed\_previous: number minimum0 Link to this property
Link to this property
folder?: "AllItems"| "Inbox"| null The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider?: "Microsoft"| "Google"| null One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id?: string| null formatuuid Link to this property ip\_restrictions?: Array<string> Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops?: number Link to this property modified\_at?: string formatdate-time Link to this property o365\_tenant\_id?: string| null Link to this property
regions?: Array<"GLOBAL"| "AU"| "DE"| 2 more> One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound?: boolean| null Link to this property require\_tls\_outbound?: boolean| null Link to this property
spf\_status?: "none"| "good"| "neutral"| 2 more| null One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status?: "PENDING"| "ACTIVE"| "FAILED"| "TIMEOUT"| null One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport?: string Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_create_response%20%3E%20(schema)>)
DomainDeleteResponse {id } id: string Domain identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_delete_response%20%3E%20(schema)>)
DomainBatchResponse {deletes, patches, posts, puts }
deletes: Array<Delete> id: string Domain identifier. formatuuid Link to this property
Link to this property
patches: Array<Patch> id?: string Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes?: Array<"DIRECT"| "BCC"| "JOURNAL"| 2 more> One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization?: Authorization| null authorized: boolean Link to this property timestamp: string formatdate-time Link to this property status\_message?: string| null Link to this property
Link to this property created\_at?: string formatdate-time Link to this property
dmarc\_status?: "none"| "good"| "invalid"| null One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain?: string Link to this property
drop\_dispositions?: Array<"MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more> One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed?: EmailsProcessed| null timestamp: string formatdate-time Link to this property total\_emails\_processed: number minimum0 Link to this property total\_emails\_processed\_previous: number minimum0 Link to this property
Link to this property
folder?: "AllItems"| "Inbox"| null The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider?: "Microsoft"| "Google"| null One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id?: string| null formatuuid Link to this property ip\_restrictions?: Array<string> Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops?: number Link to this property modified\_at?: string formatdate-time Link to this property o365\_tenant\_id?: string| null Link to this property
regions?: Array<"GLOBAL"| "AU"| "DE"| 2 more> One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound?: boolean| null Link to this property require\_tls\_outbound?: boolean| null Link to this property
spf\_status?: "none"| "good"| "neutral"| 2 more| null One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status?: "PENDING"| "ACTIVE"| "FAILED"| "TIMEOUT"| null One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport?: string Link to this property
Link to this property
posts: Array<Post> id?: string Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes?: Array<"DIRECT"| "BCC"| "JOURNAL"| 2 more> One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization?: Authorization| null authorized: boolean Link to this property timestamp: string formatdate-time Link to this property status\_message?: string| null Link to this property
Link to this property created\_at?: string formatdate-time Link to this property
dmarc\_status?: "none"| "good"| "invalid"| null One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain?: string Link to this property
drop\_dispositions?: Array<"MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more> One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed?: EmailsProcessed| null timestamp: string formatdate-time Link to this property total\_emails\_processed: number minimum0 Link to this property total\_emails\_processed\_previous: number minimum0 Link to this property
Link to this property
folder?: "AllItems"| "Inbox"| null The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider?: "Microsoft"| "Google"| null One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id?: string| null formatuuid Link to this property ip\_restrictions?: Array<string> Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops?: number Link to this property modified\_at?: string formatdate-time Link to this property o365\_tenant\_id?: string| null Link to this property
regions?: Array<"GLOBAL"| "AU"| "DE"| 2 more> One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound?: boolean| null Link to this property require\_tls\_outbound?: boolean| null Link to this property
spf\_status?: "none"| "good"| "neutral"| 2 more| null One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status?: "PENDING"| "ACTIVE"| "FAILED"| "TIMEOUT"| null One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport?: string Link to this property
Link to this property
puts: Array<Put> id?: string Domain identifier. formatuuid Link to this property
allowed\_delivery\_modes?: Array<"DIRECT"| "BCC"| "JOURNAL"| 2 more> One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
authorization?: Authorization| null authorized: boolean Link to this property timestamp: string formatdate-time Link to this property status\_message?: string| null Link to this property
Link to this property created\_at?: string formatdate-time Link to this property
dmarc\_status?: "none"| "good"| "invalid"| null One of the following: "none" Link to this property "good" Link to this property "invalid" Link to this property
Link to this property domain?: string Link to this property
drop\_dispositions?: Array<"MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more> One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
emails\_processed?: EmailsProcessed| null timestamp: string formatdate-time Link to this property total\_emails\_processed: number minimum0 Link to this property total\_emails\_processed\_previous: number minimum0 Link to this property
Link to this property
folder?: "AllItems"| "Inbox"| null The mailbox folder to scan, for API-scanning domains. One of the following: "AllItems" Link to this property "Inbox" Link to this property
Link to this property
inbox\_provider?: "Microsoft"| "Google"| null One of the following: "Microsoft" Link to this property "Google" Link to this property
Link to this property integration\_id?: string| null formatuuid Link to this property ip\_restrictions?: Array<string> Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property lookback\_hops?: number Link to this property modified\_at?: string formatdate-time Link to this property o365\_tenant\_id?: string| null Link to this property
regions?: Array<"GLOBAL"| "AU"| "DE"| 2 more> One of the following: "GLOBAL" Link to this property "AU" Link to this property "DE" Link to this property "IN" Link to this property "US" Link to this property
Link to this property require\_tls\_inbound?: boolean| null Link to this property require\_tls\_outbound?: boolean| null Link to this property
spf\_status?: "none"| "good"| "neutral"| 2 more| null One of the following: "none" Link to this property "good" Link to this property "neutral" Link to this property "open" Link to this property "invalid" Link to this property
Link to this property
status?: "PENDING"| "ACTIVE"| "FAILED"| "TIMEOUT"| null One of the following: "PENDING" Link to this property "ACTIVE" Link to this property "FAILED" Link to this property "TIMEOUT" Link to this property
Link to this property transport?: string Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_batch_response%20%3E%20(schema)>)
DomainBulkDeleteResponse {id } id: string Domain identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.domains%20%3E%20(model)%20domain_bulk_delete_response%20%3E%20(schema)>) #### Email SecuritySettingsImpersonation Registry ##### [List impersonation registry entries](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/impersonation_registry/methods/list) client.emailSecurity.settings.impersonationRegistry.list(ImpersonationRegistryListParams {account\_id, direction, order, 4 more } params, RequestOptionsoptions?): V4PagePaginationArray< [ImpersonationRegistryListResponse]() {id, comments, created\_at, 9 more } > GET/accounts/{account\_id}/email-security/settings/impersonation\_registry ##### [Get an impersonation registry entry](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/impersonation_registry/methods/get) client.emailSecurity.settings.impersonationRegistry.get(stringimpersonationRegistryID, ImpersonationRegistryGetParams {account\_id } params, RequestOptionsoptions?): [ImpersonationRegistryGetResponse]() {id, comments, created\_at, 9 more } GET/accounts/{account\_id}/email-security/settings/impersonation\_registry/{impersonation\_registry\_id} ##### [Create impersonation registry entry](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/impersonation_registry/methods/create) client.emailSecurity.settings.impersonationRegistry.create(ImpersonationRegistryCreateParams {account\_id, email, is\_email\_regex, 6 more } params, RequestOptionsoptions?): [ImpersonationRegistryCreateResponse]() {id, comments, created\_at, 9 more } POST/accounts/{account\_id}/email-security/settings/impersonation\_registry ##### [Update an impersonation registry entry](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/impersonation_registry/methods/edit) client.emailSecurity.settings.impersonationRegistry.edit(stringimpersonationRegistryID, ImpersonationRegistryEditParams {account\_id, comments, directory\_id, 6 more } params, RequestOptionsoptions?): [ImpersonationRegistryEditResponse]() {id, comments, created\_at, 9 more } PATCH/accounts/{account\_id}/email-security/settings/impersonation\_registry/{impersonation\_registry\_id} ##### [Delete an impersonation registry entry](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/impersonation_registry/methods/delete) client.emailSecurity.settings.impersonationRegistry.delete(stringimpersonationRegistryID, ImpersonationRegistryDeleteParams {account\_id } params, RequestOptionsoptions?): [ImpersonationRegistryDeleteResponse]() {id } DELETE/accounts/{account\_id}/email-security/settings/impersonation\_registry/{impersonation\_registry\_id} ##### ModelsExpand Collapse
ImpersonationRegistryListResponse {id, comments, created\_at, 9 more } An impersonation registry entry. id?: string Impersonation registry entry identifier. formatuuid Link to this property comments?: string| null Optional note describing the entry. Link to this property created\_at?: string formatdate-time Link to this property directory\_id?: number| null Identifier of the directory the entry was synced from, when directory-synced. Link to this property directory\_node\_id?: number| null Identifier of the directory node the entry was synced from, when directory-synced. Link to this property email?: string Email address (or pattern) of the protected identity. Link to this property Deprecatedexternal\_directory\_node\_id?: string| null This field is deprecated. Deprecated. External identifier of the directory node. Link to this property is\_email\_regex?: boolean Whether email is a regular expression instead of a literal address. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property name?: string Display name of the protected identity. maxLength1024 Link to this property
provenance?: "A1S\_INTERNAL"| "SNOOPY-CASB\_OFFICE\_365"| "SNOOPY-OFFICE\_365"| "SNOOPY-GOOGLE\_DIRECTORY"| null Source the entry was created from. One of the following: "A1S\_INTERNAL" Link to this property "SNOOPY-CASB\_OFFICE\_365" Link to this property "SNOOPY-OFFICE\_365" Link to this property "SNOOPY-GOOGLE\_DIRECTORY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.impersonation_registry%20%3E%20(model)%20impersonation_registry_list_response%20%3E%20(schema)>)
ImpersonationRegistryGetResponse {id, comments, created\_at, 9 more } An impersonation registry entry. id?: string Impersonation registry entry identifier. formatuuid Link to this property comments?: string| null Optional note describing the entry. Link to this property created\_at?: string formatdate-time Link to this property directory\_id?: number| null Identifier of the directory the entry was synced from, when directory-synced. Link to this property directory\_node\_id?: number| null Identifier of the directory node the entry was synced from, when directory-synced. Link to this property email?: string Email address (or pattern) of the protected identity. Link to this property Deprecatedexternal\_directory\_node\_id?: string| null This field is deprecated. Deprecated. External identifier of the directory node. Link to this property is\_email\_regex?: boolean Whether email is a regular expression instead of a literal address. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property name?: string Display name of the protected identity. maxLength1024 Link to this property
provenance?: "A1S\_INTERNAL"| "SNOOPY-CASB\_OFFICE\_365"| "SNOOPY-OFFICE\_365"| "SNOOPY-GOOGLE\_DIRECTORY"| null Source the entry was created from. One of the following: "A1S\_INTERNAL" Link to this property "SNOOPY-CASB\_OFFICE\_365" Link to this property "SNOOPY-OFFICE\_365" Link to this property "SNOOPY-GOOGLE\_DIRECTORY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.impersonation_registry%20%3E%20(model)%20impersonation_registry_get_response%20%3E%20(schema)>)
ImpersonationRegistryCreateResponse {id, comments, created\_at, 9 more } An impersonation registry entry. id?: string Impersonation registry entry identifier. formatuuid Link to this property comments?: string| null Optional note describing the entry. Link to this property created\_at?: string formatdate-time Link to this property directory\_id?: number| null Identifier of the directory the entry was synced from, when directory-synced. Link to this property directory\_node\_id?: number| null Identifier of the directory node the entry was synced from, when directory-synced. Link to this property email?: string Email address (or pattern) of the protected identity. Link to this property Deprecatedexternal\_directory\_node\_id?: string| null This field is deprecated. Deprecated. External identifier of the directory node. Link to this property is\_email\_regex?: boolean Whether email is a regular expression instead of a literal address. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property name?: string Display name of the protected identity. maxLength1024 Link to this property
provenance?: "A1S\_INTERNAL"| "SNOOPY-CASB\_OFFICE\_365"| "SNOOPY-OFFICE\_365"| "SNOOPY-GOOGLE\_DIRECTORY"| null Source the entry was created from. One of the following: "A1S\_INTERNAL" Link to this property "SNOOPY-CASB\_OFFICE\_365" Link to this property "SNOOPY-OFFICE\_365" Link to this property "SNOOPY-GOOGLE\_DIRECTORY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.impersonation_registry%20%3E%20(model)%20impersonation_registry_create_response%20%3E%20(schema)>)
ImpersonationRegistryEditResponse {id, comments, created\_at, 9 more } An impersonation registry entry. id?: string Impersonation registry entry identifier. formatuuid Link to this property comments?: string| null Optional note describing the entry. Link to this property created\_at?: string formatdate-time Link to this property directory\_id?: number| null Identifier of the directory the entry was synced from, when directory-synced. Link to this property directory\_node\_id?: number| null Identifier of the directory node the entry was synced from, when directory-synced. Link to this property email?: string Email address (or pattern) of the protected identity. Link to this property Deprecatedexternal\_directory\_node\_id?: string| null This field is deprecated. Deprecated. External identifier of the directory node. Link to this property is\_email\_regex?: boolean Whether email is a regular expression instead of a literal address. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property name?: string Display name of the protected identity. maxLength1024 Link to this property
provenance?: "A1S\_INTERNAL"| "SNOOPY-CASB\_OFFICE\_365"| "SNOOPY-OFFICE\_365"| "SNOOPY-GOOGLE\_DIRECTORY"| null Source the entry was created from. One of the following: "A1S\_INTERNAL" Link to this property "SNOOPY-CASB\_OFFICE\_365" Link to this property "SNOOPY-OFFICE\_365" Link to this property "SNOOPY-GOOGLE\_DIRECTORY" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.impersonation_registry%20%3E%20(model)%20impersonation_registry_edit_response%20%3E%20(schema)>)
ImpersonationRegistryDeleteResponse {id } id: string Impersonation registry entry identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.impersonation_registry%20%3E%20(model)%20impersonation_registry_delete_response%20%3E%20(schema)>) #### Email SecuritySettingsSending Domain Restrictions ##### [List sending domain restrictions](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/sending_domain_restrictions/methods/list) client.emailSecurity.settings.sendingDomainRestrictions.list(SendingDomainRestrictionListParams {account\_id, direction, order, 3 more } params, RequestOptionsoptions?): V4PagePaginationArray< [SendingDomainRestrictionListResponse]() {id, comments, created\_at, 4 more } > GET/accounts/{account\_id}/email-security/settings/sending\_domain\_restrictions ##### [Get a sending domain restriction](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/sending_domain_restrictions/methods/get) client.emailSecurity.settings.sendingDomainRestrictions.get(stringsendingDomainRestrictionID, SendingDomainRestrictionGetParams {account\_id } params, RequestOptionsoptions?): [SendingDomainRestrictionGetResponse]() {id, comments, created\_at, 4 more } GET/accounts/{account\_id}/email-security/settings/sending\_domain\_restrictions/{sending\_domain\_restriction\_id} ##### [Create a sending domain restriction](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/sending_domain_restrictions/methods/create) client.emailSecurity.settings.sendingDomainRestrictions.create(SendingDomainRestrictionCreateParams {account\_id, domain, exclude, comments } params, RequestOptionsoptions?): [SendingDomainRestrictionCreateResponse]() {id, comments, created\_at, 4 more } POST/accounts/{account\_id}/email-security/settings/sending\_domain\_restrictions ##### [Update a sending domain restriction](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/sending_domain_restrictions/methods/edit) client.emailSecurity.settings.sendingDomainRestrictions.edit(stringsendingDomainRestrictionID, SendingDomainRestrictionEditParams {account\_id, comments, domain, exclude } params, RequestOptionsoptions?): [SendingDomainRestrictionEditResponse]() {id, comments, created\_at, 4 more } PATCH/accounts/{account\_id}/email-security/settings/sending\_domain\_restrictions/{sending\_domain\_restriction\_id} ##### [Delete a sending domain restriction](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/sending_domain_restrictions/methods/delete) client.emailSecurity.settings.sendingDomainRestrictions.delete(stringsendingDomainRestrictionID, SendingDomainRestrictionDeleteParams {account\_id } params, RequestOptionsoptions?): [SendingDomainRestrictionDeleteResponse]() {id } DELETE/accounts/{account\_id}/email-security/settings/sending\_domain\_restrictions/{sending\_domain\_restriction\_id} ##### ModelsExpand Collapse
SendingDomainRestrictionListResponse {id, comments, created\_at, 4 more } A sending domain restriction that enforces TLS (Transport Layer Security) requirements for emails from specific domains. If TLS is required, the system drops mail without TLS from the specified domain. id?: string Sending domain restriction identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property domain?: string Domain that requires TLS enforcement. Link to this property exclude?: Array<string> Subdomains to exempt from TLS requirements. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.sending_domain_restrictions%20%3E%20(model)%20sending_domain_restriction_list_response%20%3E%20(schema)>)
SendingDomainRestrictionGetResponse {id, comments, created\_at, 4 more } A sending domain restriction that enforces TLS (Transport Layer Security) requirements for emails from specific domains. If TLS is required, the system drops mail without TLS from the specified domain. id?: string Sending domain restriction identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property domain?: string Domain that requires TLS enforcement. Link to this property exclude?: Array<string> Subdomains to exempt from TLS requirements. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.sending_domain_restrictions%20%3E%20(model)%20sending_domain_restriction_get_response%20%3E%20(schema)>)
SendingDomainRestrictionCreateResponse {id, comments, created\_at, 4 more } A sending domain restriction that enforces TLS (Transport Layer Security) requirements for emails from specific domains. If TLS is required, the system drops mail without TLS from the specified domain. id?: string Sending domain restriction identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property domain?: string Domain that requires TLS enforcement. Link to this property exclude?: Array<string> Subdomains to exempt from TLS requirements. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.sending_domain_restrictions%20%3E%20(model)%20sending_domain_restriction_create_response%20%3E%20(schema)>)
SendingDomainRestrictionEditResponse {id, comments, created\_at, 4 more } A sending domain restriction that enforces TLS (Transport Layer Security) requirements for emails from specific domains. If TLS is required, the system drops mail without TLS from the specified domain. id?: string Sending domain restriction identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property domain?: string Domain that requires TLS enforcement. Link to this property exclude?: Array<string> Subdomains to exempt from TLS requirements. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.sending_domain_restrictions%20%3E%20(model)%20sending_domain_restriction_edit_response%20%3E%20(schema)>)
SendingDomainRestrictionDeleteResponse {id } id: string Sending domain restriction identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.sending_domain_restrictions%20%3E%20(model)%20sending_domain_restriction_delete_response%20%3E%20(schema)>) #### Email SecuritySettingsTrusted Domains ##### [List trusted email domains](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/trusted_domains/methods/list) client.emailSecurity.settings.trustedDomains.list(TrustedDomainListParams {account\_id, direction, is\_recent, 6 more } params, RequestOptionsoptions?): V4PagePaginationArray< [TrustedDomainListResponse]() {id, comments, created\_at, 6 more } > GET/accounts/{account\_id}/email-security/settings/trusted\_domains ##### [Get a trusted email domain](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/trusted_domains/methods/get) client.emailSecurity.settings.trustedDomains.get(stringtrustedDomainID, TrustedDomainGetParams {account\_id } params, RequestOptionsoptions?): [TrustedDomainGetResponse]() {id, comments, created\_at, 6 more } GET/accounts/{account\_id}/email-security/settings/trusted\_domains/{trusted\_domain\_id} ##### [Create trusted email domain](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/trusted_domains/methods/create) client.emailSecurity.settings.trustedDomains.create(TrustedDomainCreateParams {account\_id, is\_recent, is\_regex, 3 more } params, RequestOptionsoptions?): [TrustedDomainCreateResponse]() {id, comments, created\_at, 6 more } POST/accounts/{account\_id}/email-security/settings/trusted\_domains ##### [Update a trusted email domain](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/trusted_domains/methods/edit) client.emailSecurity.settings.trustedDomains.edit(stringtrustedDomainID, TrustedDomainEditParams {account\_id, comments, is\_recent, 3 more } params, RequestOptionsoptions?): [TrustedDomainEditResponse]() {id, comments, created\_at, 6 more } PATCH/accounts/{account\_id}/email-security/settings/trusted\_domains/{trusted\_domain\_id} ##### [Delete a trusted email domain](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/trusted_domains/methods/delete) client.emailSecurity.settings.trustedDomains.delete(stringtrustedDomainID, TrustedDomainDeleteParams {account\_id } params, RequestOptionsoptions?): [TrustedDomainDeleteResponse]() {id } DELETE/accounts/{account\_id}/email-security/settings/trusted\_domains/{trusted\_domain\_id} ##### [Batch trusted domain operations](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/trusted_domains/methods/batch) client.emailSecurity.settings.trustedDomains.batch(TrustedDomainBatchParams {account\_id, deletes, patches, 2 more } params, RequestOptionsoptions?): [TrustedDomainBatchResponse]() {deletes, patches, posts, puts } POST/accounts/{account\_id}/email-security/settings/trusted\_domains/batch ##### ModelsExpand Collapse
TrustedDomainListResponse {id, comments, created\_at, 6 more } A trusted email domain. id?: string Trusted domain identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property is\_recent?: boolean Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex?: boolean Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity?: boolean Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_list_response%20%3E%20(schema)>)
TrustedDomainGetResponse {id, comments, created\_at, 6 more } A trusted email domain. id?: string Trusted domain identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property is\_recent?: boolean Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex?: boolean Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity?: boolean Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_get_response%20%3E%20(schema)>)
TrustedDomainCreateResponse {id, comments, created\_at, 6 more } A trusted email domain. id?: string Trusted domain identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property is\_recent?: boolean Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex?: boolean Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity?: boolean Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_create_response%20%3E%20(schema)>)
TrustedDomainEditResponse {id, comments, created\_at, 6 more } A trusted email domain. id?: string Trusted domain identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property is\_recent?: boolean Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex?: boolean Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity?: boolean Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_edit_response%20%3E%20(schema)>)
TrustedDomainDeleteResponse {id } id: string Trusted domain identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_delete_response%20%3E%20(schema)>)
TrustedDomainBatchResponse {deletes, patches, posts, puts }
deletes?: Array<Delete> id: string Trusted domain identifier. formatuuid Link to this property
Link to this property
patches?: Array<Patch> id?: string Trusted domain identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property is\_recent?: boolean Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex?: boolean Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity?: boolean Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
Link to this property
posts?: Array<Post> id?: string Trusted domain identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property is\_recent?: boolean Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex?: boolean Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity?: boolean Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
Link to this property
puts?: Array<Put> id?: string Trusted domain identifier. formatuuid Link to this property comments?: string| null maxLength1024 Link to this property created\_at?: string formatdate-time Link to this property is\_recent?: boolean Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition. Link to this property is\_regex?: boolean Whether pattern is a regular expression instead of a literal domain. Link to this property is\_similarity?: boolean Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition. Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property pattern?: string The domain pattern to trust, e.g. example.com. maxLength1024 minLength1 Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.settings.trusted_domains%20%3E%20(model)%20trusted_domain_batch_response%20%3E%20(schema)>) #### Email SecuritySettingsURL Ignore Patterns ##### [List URL ignore patterns](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/url_ignore_patterns/methods/list) client.emailSecurity.settings.urlIgnorePatterns.list(URLIgnorePatternListParams {account\_id, page, per\_page } params, RequestOptionsoptions?): V4PagePaginationArray< [URLIgnorePatternListResponse]() {id, created\_at, pattern, 3 more } > GET/accounts/{account\_id}/email-security/settings/url\_ignore\_patterns ##### [Get a URL ignore pattern](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/url_ignore_patterns/methods/get) client.emailSecurity.settings.urlIgnorePatterns.get(stringpatternID, URLIgnorePatternGetParams {account\_id } params, RequestOptionsoptions?): [URLIgnorePatternGetResponse]() {id, created\_at, pattern, 3 more } GET/accounts/{account\_id}/email-security/settings/url\_ignore\_patterns/{pattern\_id} ##### [Create a URL ignore pattern](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/url_ignore_patterns/methods/create) client.emailSecurity.settings.urlIgnorePatterns.create(URLIgnorePatternCreateParams {account\_id, pattern, comments } params, RequestOptionsoptions?): [URLIgnorePatternCreateResponse]() {id, created\_at, pattern, 3 more } POST/accounts/{account\_id}/email-security/settings/url\_ignore\_patterns ##### [Update a URL ignore pattern](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/url_ignore_patterns/methods/edit) client.emailSecurity.settings.urlIgnorePatterns.edit(stringpatternID, URLIgnorePatternEditParams {account\_id, comments, pattern } params, RequestOptionsoptions?): [URLIgnorePatternEditResponse]() {id, created\_at, pattern, 3 more } PATCH/accounts/{account\_id}/email-security/settings/url\_ignore\_patterns/{pattern\_id} ##### [Delete a URL ignore pattern](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/settings/subresources/url_ignore_patterns/methods/delete) client.emailSecurity.settings.urlIgnorePatterns.delete(stringpatternID, URLIgnorePatternDeleteParams {account\_id } params, RequestOptionsoptions?): [URLIgnorePatternDeleteResponse]() {id } DELETE/accounts/{account\_id}/email-security/settings/url\_ignore\_patterns/{pattern\_id} ##### ModelsExpand Collapse
URLIgnorePatternListResponse {id, created\_at, pattern, 3 more } A URL ignore pattern that exempts matching URLs from Email Security’s URL rewriting. id: string URL ignore pattern identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property pattern: string Regular expression identifying URLs to exempt from rewriting. maxLength1024 minLength1 Link to this property comments?: string| null Optional note describing the reason for the ignore pattern. maxLength1024 Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.url_ignore_patterns%20%3E%20(model)%20url_ignore_pattern_list_response%20%3E%20(schema)>)
URLIgnorePatternGetResponse {id, created\_at, pattern, 3 more } A URL ignore pattern that exempts matching URLs from Email Security’s URL rewriting. id: string URL ignore pattern identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property pattern: string Regular expression identifying URLs to exempt from rewriting. maxLength1024 minLength1 Link to this property comments?: string| null Optional note describing the reason for the ignore pattern. maxLength1024 Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.url_ignore_patterns%20%3E%20(model)%20url_ignore_pattern_get_response%20%3E%20(schema)>)
URLIgnorePatternCreateResponse {id, created\_at, pattern, 3 more } A URL ignore pattern that exempts matching URLs from Email Security’s URL rewriting. id: string URL ignore pattern identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property pattern: string Regular expression identifying URLs to exempt from rewriting. maxLength1024 minLength1 Link to this property comments?: string| null Optional note describing the reason for the ignore pattern. maxLength1024 Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.url_ignore_patterns%20%3E%20(model)%20url_ignore_pattern_create_response%20%3E%20(schema)>)
URLIgnorePatternEditResponse {id, created\_at, pattern, 3 more } A URL ignore pattern that exempts matching URLs from Email Security’s URL rewriting. id: string URL ignore pattern identifier. formatuuid Link to this property created\_at: string formatdate-time Link to this property pattern: string Regular expression identifying URLs to exempt from rewriting. maxLength1024 minLength1 Link to this property comments?: string| null Optional note describing the reason for the ignore pattern. maxLength1024 Link to this property Deprecatedlast\_modified?: string Use modified_at instead. Deprecated, use modified_at instead. End of life: November 1, 2026. formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property
[Link to this property](<#(resource)%20email_security.settings.url_ignore_patterns%20%3E%20(model)%20url_ignore_pattern_edit_response%20%3E%20(schema)>)
URLIgnorePatternDeleteResponse {id } id: string URL ignore pattern identifier. formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.settings.url_ignore_patterns%20%3E%20(model)%20url_ignore_pattern_delete_response%20%3E%20(schema)>) #### Email SecuritySubmissions ##### [List reclassify submissions](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/submissions/methods/list) client.emailSecurity.submissions.list(SubmissionListParams {account\_id, direction, end, 12 more } params, RequestOptionsoptions?): V4PagePaginationArray< [SubmissionListResponse]() {requested\_at, submission\_id, customer\_status, 15 more } > GET/accounts/{account\_id}/email-security/submissions ##### ModelsExpand Collapse
SubmissionListResponse {requested\_at, submission\_id, customer\_status, 15 more } requested\_at: string When the submission was requested (UTC). formatdate-time Link to this property submission\_id: string Link to this property
customer\_status?: "escalated"| "reviewed"| "unreviewed"| null One of the following: "escalated" Link to this property "reviewed" Link to this property "unreviewed" Link to this property
Link to this property
escalated\_as?: "MALICIOUS"| "SUSPICIOUS"| "SPOOF"| 3 more| null The disposition a message is submitted to have. One of the following: "MALICIOUS" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "NONE" Link to this property
Link to this property escalated\_at?: string| null When the submission was escalated to the security team. formatdate-time Link to this property escalated\_by?: string| null Email address of the user who escalated the submission. Link to this property escalated\_submission\_id?: string| null Submission ID of the escalated team submission, when this user submission was escalated. Link to this property
original\_disposition?: "MALICIOUS"| "SUSPICIOUS"| "SPOOF"| 3 more| null The disposition a message is submitted to have. One of the following: "MALICIOUS" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "NONE" Link to this property
Link to this property original\_edf\_hash?: string| null EDF hash of the original message. Link to this property original\_postfix\_id?: string| null The postfix ID of the original message that was submitted. Link to this property outcome?: string| null Processing outcome of the submission. Link to this property
outcome\_disposition?: "MALICIOUS"| "SUSPICIOUS"| "SPOOF"| 3 more| null The disposition a message is submitted to have. One of the following: "MALICIOUS" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "NONE" Link to this property
Link to this property requested\_by?: string| null Email address of the user who requested the submission. Link to this property
requested\_disposition?: "MALICIOUS"| "SUSPICIOUS"| "SPOOF"| 3 more| null The disposition a message is submitted to have. One of the following: "MALICIOUS" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "NONE" Link to this property
Link to this property Deprecatedrequested\_ts?: string Use requested_at instead. Deprecated, use requested_at instead. Link to this property status?: string| null Processing status of the submission. Link to this property subject?: string| null Subject line of the submitted message. Link to this property
type?: "Team"| "User"| null Indicates whether a team member or an end user created the submission. One of the following: "Team" Link to this property "User" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.submissions%20%3E%20(model)%20submission_list_response%20%3E%20(schema)>)