--- title: Investigate --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/typescript) [Email Security](https://developers.cloudflare.com/api/typescript/resources/email_security) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Investigate ##### [Search email messages](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/methods/list) client.emailSecurity.investigate.list(InvestigateListParams {account\_id, alert\_id, cursor, 16 more } params, RequestOptionsoptions?): V4PagePaginationArray< [InvestigateListResponse]() {id, action\_log, client\_recipients, 32 more } > GET/accounts/{account\_id}/email-security/investigate ##### [Get message details](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/methods/get) client.emailSecurity.investigate.get(stringinvestigateID, InvestigateGetParams {account\_id, submission } params, RequestOptionsoptions?): [InvestigateGetResponse]() {id, action\_log, client\_recipients, 32 more } GET/accounts/{account\_id}/email-security/investigate/{investigate\_id} ##### ModelsExpand Collapse
InvestigateListResponse {id, action\_log, client\_recipients, 32 more } id: string Unique identifier for a message retrieved from investigation. Link to this property
Deprecatedaction\_log: Array<ActionLog> Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. completed\_at: string Timestamp when action completed. formatdate-time Link to this property
operation: "MOVE"| "RELEASE"| "RECLASSIFY"| 3 more Type of action performed. One of the following: "MOVE" Link to this property "RELEASE" Link to this property "RECLASSIFY" Link to this property "SUBMISSION" Link to this property "QUARANTINE\_RELEASE" Link to this property "PREVIEW" Link to this property
Link to this property Deprecatedcompleted\_timestamp?: string Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. Link to this property
properties?: Properties {folder, requested\_by } Additional properties for the action. folder?: string Target folder for move operations. Link to this property requested\_by?: string User who requested the action. Link to this property
Link to this property status?: string| null Status of the action. Link to this property
Link to this property client\_recipients: Array<string> Link to this property detection\_reasons: Array<string> Link to this property is\_phish\_submission: boolean Link to this property is\_quarantined: boolean Link to this property postfix\_id: string The identifier of the message. Link to this property
properties: Properties {allowlisted\_pattern, allowlisted\_pattern\_type, blocklisted\_message, 2 more } Message processing properties. allowlisted\_pattern?: string| null Pattern that allowlisted this message. Link to this property
allowlisted\_pattern\_type?: "quarantine\_release"| "acceptable\_sender"| "allowed\_sender"| 5 more| null Type of allowlist pattern. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property blocklisted\_message?: boolean| null Whether message was blocklisted. Link to this property blocklisted\_pattern?: string| null Pattern that blocklisted this message. Link to this property
whitelisted\_pattern\_type?: "quarantine\_release"| "acceptable\_sender"| "allowed\_sender"| 5 more| null Legacy field for allowlist pattern type. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property
Link to this property Deprecatedts: string Use scanned_at instead. Deprecated, use scanned_at instead. End of life: November 1, 2026. Link to this property alert\_id?: string| null Link to this property
delivery\_mode?: "DIRECT"| "BCC"| "JOURNAL"| 8 more| null One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "REVIEW\_SUBMISSION" Link to this property "DMARC\_UNVERIFIED" Link to this property "DMARC\_FAILURE\_REPORT" Link to this property "DMARC\_AGGREGATE\_REPORT" Link to this property "THREAT\_INTEL\_SUBMISSION" Link to this property "SIMULATION\_SUBMISSION" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
delivery\_status?: Array<"delivered"| "moved"| "quarantined"| 5 more>| null One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property edf\_hash?: string| null Link to this property envelope\_from?: string| null Link to this property envelope\_to?: Array<string>| null Link to this property
final\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Deprecatedfindings?: Array<Finding>| null Use the findings field from GET /investigate/{investigate\_id}/detections instead. Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message. attachment?: string| null Link to this property detail?: string| null Link to this property
detection?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field?: string| null Link to this property name?: string| null Link to this property portion?: string| null Link to this property reason?: string| null Link to this property score?: number| null formatdouble Link to this property value?: string| null Link to this property
Link to this property from?: string| null Link to this property from\_name?: string| null Link to this property htmltext\_structure\_hash?: string| null Link to this property message\_id?: string| null Link to this property
post\_delivery\_operations?: Array<"PREVIEW"| "QUARANTINE\_RELEASE"| "SUBMISSION"| "MOVE">| null Post-delivery operations performed on this message. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASE" Link to this property "SUBMISSION" Link to this property "MOVE" Link to this property
Link to this property postfix\_id\_outbound?: string| null Link to this property replyto?: string| null Link to this property scanned\_at?: string| null When the message was scanned (UTC). formatdate-time Link to this property sent\_at?: string| null When the message was sent (UTC). formatdate-time Link to this property sent\_date?: string| null Link to this property smtp\_helo\_server\_ip?: string| null Link to this property smtp\_previous\_hop\_ip?: string| null Link to this property subject?: string| null Link to this property threat\_categories?: Array<string>| null Link to this property to?: Array<string>| null Link to this property to\_name?: Array<string>| null Link to this property
validation?: Validation| null comment?: string| null Link to this property
dkim?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property x\_originating\_ip?: string| null Link to this property
[Link to this property](<#(resource)%20email_security.investigate%20%3E%20(model)%20investigate_list_response%20%3E%20(schema)>)
InvestigateGetResponse {id, action\_log, client\_recipients, 32 more } id: string Unique identifier for a message retrieved from investigation. Link to this property
Deprecatedaction\_log: Array<ActionLog> Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. completed\_at: string Timestamp when action completed. formatdate-time Link to this property
operation: "MOVE"| "RELEASE"| "RECLASSIFY"| 3 more Type of action performed. One of the following: "MOVE" Link to this property "RELEASE" Link to this property "RECLASSIFY" Link to this property "SUBMISSION" Link to this property "QUARANTINE\_RELEASE" Link to this property "PREVIEW" Link to this property
Link to this property Deprecatedcompleted\_timestamp?: string Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. Link to this property
properties?: Properties {folder, requested\_by } Additional properties for the action. folder?: string Target folder for move operations. Link to this property requested\_by?: string User who requested the action. Link to this property
Link to this property status?: string| null Status of the action. Link to this property
Link to this property client\_recipients: Array<string> Link to this property detection\_reasons: Array<string> Link to this property is\_phish\_submission: boolean Link to this property is\_quarantined: boolean Link to this property postfix\_id: string The identifier of the message. Link to this property
properties: Properties {allowlisted\_pattern, allowlisted\_pattern\_type, blocklisted\_message, 2 more } Message processing properties. allowlisted\_pattern?: string| null Pattern that allowlisted this message. Link to this property
allowlisted\_pattern\_type?: "quarantine\_release"| "acceptable\_sender"| "allowed\_sender"| 5 more| null Type of allowlist pattern. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property blocklisted\_message?: boolean| null Whether message was blocklisted. Link to this property blocklisted\_pattern?: string| null Pattern that blocklisted this message. Link to this property
whitelisted\_pattern\_type?: "quarantine\_release"| "acceptable\_sender"| "allowed\_sender"| 5 more| null Legacy field for allowlist pattern type. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property
Link to this property Deprecatedts: string Use scanned_at instead. Deprecated, use scanned_at instead. End of life: November 1, 2026. Link to this property alert\_id?: string| null Link to this property
delivery\_mode?: "DIRECT"| "BCC"| "JOURNAL"| 8 more| null One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "REVIEW\_SUBMISSION" Link to this property "DMARC\_UNVERIFIED" Link to this property "DMARC\_FAILURE\_REPORT" Link to this property "DMARC\_AGGREGATE\_REPORT" Link to this property "THREAT\_INTEL\_SUBMISSION" Link to this property "SIMULATION\_SUBMISSION" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
delivery\_status?: Array<"delivered"| "moved"| "quarantined"| 5 more>| null One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property edf\_hash?: string| null Link to this property envelope\_from?: string| null Link to this property envelope\_to?: Array<string>| null Link to this property
final\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Deprecatedfindings?: Array<Finding>| null Use the findings field from GET /investigate/{investigate\_id}/detections instead. Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message. attachment?: string| null Link to this property detail?: string| null Link to this property
detection?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field?: string| null Link to this property name?: string| null Link to this property portion?: string| null Link to this property reason?: string| null Link to this property score?: number| null formatdouble Link to this property value?: string| null Link to this property
Link to this property from?: string| null Link to this property from\_name?: string| null Link to this property htmltext\_structure\_hash?: string| null Link to this property message\_id?: string| null Link to this property
post\_delivery\_operations?: Array<"PREVIEW"| "QUARANTINE\_RELEASE"| "SUBMISSION"| "MOVE">| null Post-delivery operations performed on this message. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASE" Link to this property "SUBMISSION" Link to this property "MOVE" Link to this property
Link to this property postfix\_id\_outbound?: string| null Link to this property replyto?: string| null Link to this property scanned\_at?: string| null When the message was scanned (UTC). formatdate-time Link to this property sent\_at?: string| null When the message was sent (UTC). formatdate-time Link to this property sent\_date?: string| null Link to this property smtp\_helo\_server\_ip?: string| null Link to this property smtp\_previous\_hop\_ip?: string| null Link to this property subject?: string| null Link to this property threat\_categories?: Array<string>| null Link to this property to?: Array<string>| null Link to this property to\_name?: Array<string>| null Link to this property
validation?: Validation| null comment?: string| null Link to this property
dkim?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property x\_originating\_ip?: string| null Link to this property
[Link to this property](<#(resource)%20email_security.investigate%20%3E%20(model)%20investigate_get_response%20%3E%20(schema)>) #### InvestigateDetections ##### [Get message detection details](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/detections/methods/get) client.emailSecurity.investigate.detections.get(stringinvestigateID, DetectionGetParams {account\_id } params, RequestOptionsoptions?): [DetectionGetResponse]() {action, attachments, findings, 6 more } GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/detections ##### ModelsExpand Collapse
DetectionGetResponse {action, attachments, findings, 6 more } action: string Link to this property
attachments: Array<Attachment> size: number Size of the attachment in bytes. minimum0 Link to this property content\_type?: string| null MIME type of the attachment. Link to this property
detection?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null Detection result for this attachment. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property encrypted?: boolean| null Whether the attachment is encrypted. Link to this property filename?: string| null Name of the attached file. Link to this property md5?: string| null MD5 hash of the attachment. Link to this property name?: string| null Attachment name (alternative to filename). Link to this property sha1?: string| null SHA1 hash of the attachment. Link to this property sha256?: string| null SHA256 hash of the attachment. Link to this property
Link to this property
findings: Array<Finding>| null attachment?: string| null Link to this property detail?: string| null Link to this property
detection?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null Detection result associated with this finding. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field?: string| null Link to this property name?: string| null Link to this property portion?: string| null Link to this property reason?: string| null Link to this property score?: number| null formatdouble Link to this property value?: string| null Link to this property
Link to this property
headers: Array<Header> name: string Link to this property value: string Link to this property
Link to this property
links: Array<Link> href: string Link to this property text?: string| null Link to this property
Link to this property
sender\_info: SenderInfo {as\_name, as\_number, geo, 2 more } as\_name?: string| null The name of the autonomous system. Link to this property as\_number?: number| null The number of the autonomous system. Link to this property geo?: string| null Link to this property ip?: string| null Link to this property pld?: string| null Link to this property
Link to this property
threat\_categories: Array<ThreatCategory> id?: number Link to this property description?: string| null Link to this property name?: string| null Link to this property
Link to this property
validation: Validation {comment, dkim, dmarc, spf } comment?: string| null Link to this property
dkim?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property
final\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.detections%20%3E%20(model)%20detection_get_response%20%3E%20(schema)>) #### InvestigatePreview ##### [Get preview for a detection](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/preview/methods/get) client.emailSecurity.investigate.preview.get(stringinvestigateID, PreviewGetParams {account\_id } params, RequestOptionsoptions?): [PreviewGetResponse]() {screenshot } GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/preview ##### [Generate preview for a non-detection message](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/preview/methods/create) client.emailSecurity.investigate.preview.create(PreviewCreateParams {account\_id, id } params, RequestOptionsoptions?): [PreviewCreateResponse]() {screenshot } POST/accounts/{account\_id}/email-security/investigate/preview ##### ModelsExpand Collapse
PreviewGetResponse {screenshot } screenshot: string A base64 encoded PNG image of the email. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.preview%20%3E%20(model)%20preview_get_response%20%3E%20(schema)>)
PreviewCreateResponse {screenshot } screenshot: string A base64 encoded PNG image of the email. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.preview%20%3E%20(model)%20preview_create_response%20%3E%20(schema)>) #### InvestigateRaw ##### [Get raw email content](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/raw/methods/get) client.emailSecurity.investigate.raw.get(stringinvestigateID, RawGetParams {account\_id } params, RequestOptionsoptions?): [RawGetResponse]() {raw } GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/raw ##### ModelsExpand Collapse
RawGetResponse {raw } raw: string A UTF-8 encoded eml file of the email. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>) #### InvestigateTrace ##### [Get email trace](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/trace/methods/get) client.emailSecurity.investigate.trace.get(stringinvestigateID, TraceGetParams {account\_id } params, RequestOptionsoptions?): [TraceGetResponse]() {inbound, outbound } GET/accounts/{account\_id}/email-security/investigate/{investigate\_id}/trace ##### ModelsExpand Collapse
TraceGetResponse {inbound, outbound }
inbound: Inbound {lines, pending }
lines?: Array<Line>| null lineno?: number Line number in the trace log. Link to this property logged\_at?: string| null formatdate-time Link to this property message?: string Link to this property Deprecatedts?: string Use logged_at instead. Deprecated, use logged_at instead. End of life: November 1, 2026. Link to this property
Link to this property pending?: boolean| null Link to this property
Link to this property
outbound: Outbound {lines, pending }
lines?: Array<Line>| null lineno?: number Line number in the trace log. Link to this property logged\_at?: string| null formatdate-time Link to this property message?: string Link to this property Deprecatedts?: string Use logged_at instead. Deprecated, use logged_at instead. End of life: November 1, 2026. Link to this property
Link to this property pending?: boolean| null Link to this property
Link to this property
[Link to this property](<#(resource)%20email_security.investigate.trace%20%3E%20(model)%20trace_get_response%20%3E%20(schema)>) #### InvestigateMove ##### [Move a message](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/move/methods/create) client.emailSecurity.investigate.move.create(stringinvestigateID, MoveCreateParams {account\_id, destination, expected\_disposition } params, RequestOptionsoptions?): SinglePage< [MoveCreateResponse]() {success, completed\_at, completed\_timestamp, 6 more } > POST/accounts/{account\_id}/email-security/investigate/{investigate\_id}/move ##### [Move messages](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/move/methods/bulk) client.emailSecurity.investigate.move.bulk(MoveBulkParams {account\_id, destination, ids, 2 more } params, RequestOptionsoptions?): SinglePage< [MoveBulkResponse]() {success, completed\_at, completed\_timestamp, 6 more } > POST/accounts/{account\_id}/email-security/investigate/move ##### ModelsExpand Collapse
MoveCreateResponse {success, completed\_at, completed\_timestamp, 6 more } success: boolean Whether the operation succeeded. Link to this property completed\_at?: string| null When the move operation completed (UTC). formatdate-time Link to this property Deprecatedcompleted\_timestamp?: string Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. formatdate-time Link to this property destination?: string| null Destination folder for the message. Link to this property Deprecateditem\_count?: number This field is deprecated. Number of items moved. End of life: November 1, 2026. Link to this property message\_id?: string| null Message identifier. Link to this property operation?: string| null Type of operation performed. Link to this property recipient?: string| null Recipient email address. Link to this property status?: string| null Operation status. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.move%20%3E%20(model)%20move_create_response%20%3E%20(schema)>)
MoveBulkResponse {success, completed\_at, completed\_timestamp, 6 more } success: boolean Whether the operation succeeded. Link to this property completed\_at?: string| null When the move operation completed (UTC). formatdate-time Link to this property Deprecatedcompleted\_timestamp?: string Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. formatdate-time Link to this property destination?: string| null Destination folder for the message. Link to this property Deprecateditem\_count?: number This field is deprecated. Number of items moved. End of life: November 1, 2026. Link to this property message\_id?: string| null Message identifier. Link to this property operation?: string| null Type of operation performed. Link to this property recipient?: string| null Recipient email address. Link to this property status?: string| null Operation status. Link to this property
[Link to this property](<#(resource)%20email_security.investigate.move%20%3E%20(model)%20move_bulk_response%20%3E%20(schema)>) #### InvestigateReclassify ##### [Change email classification](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/reclassify/methods/create) Deprecated client.emailSecurity.investigate.reclassify.create(stringinvestigateID, ReclassifyCreateParams {account\_id, expected\_disposition, eml\_content, escalated\_submission\_id } params, RequestOptionsoptions?): [ReclassifyCreateResponse]() POST/accounts/{account\_id}/email-security/investigate/{investigate\_id}/reclassify ##### ModelsExpand Collapse ReclassifyCreateResponse = unknown [Link to this property](<#(resource)%20email_security.investigate.reclassify%20%3E%20(model)%20reclassify_create_response%20%3E%20(schema)>) #### InvestigateRelease ##### [Release messages from quarantine](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/release/methods/bulk) client.emailSecurity.investigate.release.bulk(ReleaseBulkParams {account\_id, ids } params, RequestOptionsoptions?): SinglePage< [ReleaseBulkResponse]() {id, delivered, failed, 2 more } > POST/accounts/{account\_id}/email-security/investigate/release ##### ModelsExpand Collapse
ReleaseBulkResponse {id, delivered, failed, 2 more } id: string Unique identifier for a message retrieved from investigation. Link to this property delivered?: Array<string>| null Link to this property failed?: Array<string>| null Link to this property Deprecatedpostfix\_id?: string Use id instead. Deprecated, use id instead. End of life: November 1, 2026. Link to this property undelivered?: Array<string>| null Link to this property
[Link to this property](<#(resource)%20email_security.investigate.release%20%3E%20(model)%20release_bulk_response%20%3E%20(schema)>) #### InvestigateBulk ##### [List bulk action jobs](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/bulk/methods/list) client.emailSecurity.investigate.bulk.list(BulkListParams {account\_id, action\_type, page, 2 more } params, RequestOptionsoptions?): V4PagePaginationArray< [BulkListResponse]() {action\_params, action\_type, created\_at, 13 more } > GET/accounts/{account\_id}/email-security/investigate/bulk ##### [Create a bulk action job](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/bulk/methods/create) client.emailSecurity.investigate.bulk.create(BulkCreateParams {account\_id, action, search\_params, 3 more } params, RequestOptionsoptions?): [BulkCreateResponse]() {action\_params, action\_type, created\_at, 13 more } POST/accounts/{account\_id}/email-security/investigate/bulk ##### [Get bulk action job details](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/bulk/methods/get) client.emailSecurity.investigate.bulk.get(stringjobID, BulkGetParams {account\_id } params, RequestOptionsoptions?): [BulkGetResponse]() {action\_params, action\_type, created\_at, 13 more } GET/accounts/{account\_id}/email-security/investigate/bulk/{job\_id} ##### [Delete a bulk action job](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/bulk/methods/delete) client.emailSecurity.investigate.bulk.delete(stringjobID, BulkDeleteParams {account\_id } params, RequestOptionsoptions?): [BulkDeleteResponse]() {id } DELETE/accounts/{account\_id}/email-security/investigate/bulk/{job\_id} ##### ModelsExpand Collapse
BulkListResponse {action\_params, action\_type, created\_at, 13 more }
action\_params: Move {destination, type, expected\_disposition } | Release {type } One of the following:
Move {destination, type, expected\_disposition }
destination: "Inbox"| "JunkEmail"| "DeletedItems"| 2 more The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: "MOVE" Link to this property
Deprecatedexpected\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
Release {type } type: "RELEASE" Link to this property
Link to this property
Link to this property
action\_type: "MOVE"| "RELEASE" One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: string formatdate-time Link to this property job\_id: string formatuuid Link to this property messages\_cancelled: number Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: number Link to this property messages\_pending: number Link to this property messages\_skipped: number Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: number Link to this property
search\_params: SearchParams {action\_log, alert\_id, delivery\_status, 15 more } Deprecatedaction\_log?: boolean Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id?: string| null Alert ID of the detection to filter by. Link to this property
delivery\_status?: "delivered"| "moved"| "quarantined"| 5 more| null Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only?: boolean Whether to include only detections in search results. Link to this property domain?: string| null Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end?: string End of search date range. formatdate-time Link to this property exact\_subject?: string| null Match messages whose subject line equals this value exactly. Link to this property
final\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action?: "PREVIEW"| "QUARANTINE\_RELEASED"| "MOVED"| null Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id?: string| null Message-ID header value to filter by. Link to this property metric?: string| null Metric name to filter the search by. Link to this property query?: string| null Space-delimited search term. Case-insensitive. Link to this property recipient?: string| null Match messages whose recipient is this email address or domain. Link to this property sender?: string| null Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip?: string| null Matches messages whose SMTP HELO server IP address equals this value. Link to this property start?: string Beginning of search date range. formatdate-time Link to this property subject?: string| null Match messages whose subject contains these keywords, in any order. Link to this property submissions?: boolean Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: "PENDING"| "DISCOVERING"| "PROCESSING"| 3 more Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: number Link to this property comment?: string| null Link to this property completed\_at?: string| null formatdate-time Link to this property started\_at?: string| null formatdate-time Link to this property status\_message?: string| null Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_list_response%20%3E%20(schema)>)
BulkCreateResponse {action\_params, action\_type, created\_at, 13 more }
action\_params: Move {destination, type, expected\_disposition } | Release {type } One of the following:
Move {destination, type, expected\_disposition }
destination: "Inbox"| "JunkEmail"| "DeletedItems"| 2 more The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: "MOVE" Link to this property
Deprecatedexpected\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
Release {type } type: "RELEASE" Link to this property
Link to this property
Link to this property
action\_type: "MOVE"| "RELEASE" One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: string formatdate-time Link to this property job\_id: string formatuuid Link to this property messages\_cancelled: number Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: number Link to this property messages\_pending: number Link to this property messages\_skipped: number Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: number Link to this property
search\_params: SearchParams {action\_log, alert\_id, delivery\_status, 15 more } Deprecatedaction\_log?: boolean Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id?: string| null Alert ID of the detection to filter by. Link to this property
delivery\_status?: "delivered"| "moved"| "quarantined"| 5 more| null Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only?: boolean Whether to include only detections in search results. Link to this property domain?: string| null Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end?: string End of search date range. formatdate-time Link to this property exact\_subject?: string| null Match messages whose subject line equals this value exactly. Link to this property
final\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action?: "PREVIEW"| "QUARANTINE\_RELEASED"| "MOVED"| null Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id?: string| null Message-ID header value to filter by. Link to this property metric?: string| null Metric name to filter the search by. Link to this property query?: string| null Space-delimited search term. Case-insensitive. Link to this property recipient?: string| null Match messages whose recipient is this email address or domain. Link to this property sender?: string| null Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip?: string| null Matches messages whose SMTP HELO server IP address equals this value. Link to this property start?: string Beginning of search date range. formatdate-time Link to this property subject?: string| null Match messages whose subject contains these keywords, in any order. Link to this property submissions?: boolean Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: "PENDING"| "DISCOVERING"| "PROCESSING"| 3 more Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: number Link to this property comment?: string| null Link to this property completed\_at?: string| null formatdate-time Link to this property started\_at?: string| null formatdate-time Link to this property status\_message?: string| null Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_create_response%20%3E%20(schema)>)
BulkGetResponse {action\_params, action\_type, created\_at, 13 more }
action\_params: Move {destination, type, expected\_disposition } | Release {type } One of the following:
Move {destination, type, expected\_disposition }
destination: "Inbox"| "JunkEmail"| "DeletedItems"| 2 more The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: "MOVE" Link to this property
Deprecatedexpected\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
Release {type } type: "RELEASE" Link to this property
Link to this property
Link to this property
action\_type: "MOVE"| "RELEASE" One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: string formatdate-time Link to this property job\_id: string formatuuid Link to this property messages\_cancelled: number Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: number Link to this property messages\_pending: number Link to this property messages\_skipped: number Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: number Link to this property
search\_params: SearchParams {action\_log, alert\_id, delivery\_status, 15 more } Deprecatedaction\_log?: boolean Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id?: string| null Alert ID of the detection to filter by. Link to this property
delivery\_status?: "delivered"| "moved"| "quarantined"| 5 more| null Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only?: boolean Whether to include only detections in search results. Link to this property domain?: string| null Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end?: string End of search date range. formatdate-time Link to this property exact\_subject?: string| null Match messages whose subject line equals this value exactly. Link to this property
final\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action?: "PREVIEW"| "QUARANTINE\_RELEASED"| "MOVED"| null Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id?: string| null Message-ID header value to filter by. Link to this property metric?: string| null Metric name to filter the search by. Link to this property query?: string| null Space-delimited search term. Case-insensitive. Link to this property recipient?: string| null Match messages whose recipient is this email address or domain. Link to this property sender?: string| null Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip?: string| null Matches messages whose SMTP HELO server IP address equals this value. Link to this property start?: string Beginning of search date range. formatdate-time Link to this property subject?: string| null Match messages whose subject contains these keywords, in any order. Link to this property submissions?: boolean Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: "PENDING"| "DISCOVERING"| "PROCESSING"| 3 more Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: number Link to this property comment?: string| null Link to this property completed\_at?: string| null formatdate-time Link to this property started\_at?: string| null formatdate-time Link to this property status\_message?: string| null Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_get_response%20%3E%20(schema)>)
BulkDeleteResponse {id } id: string formatuuid Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk%20%3E%20(model)%20bulk_delete_response%20%3E%20(schema)>) #### InvestigateBulkCancel ##### [Cancel a bulk action job](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/bulk/subresources/cancel/methods/create) client.emailSecurity.investigate.bulk.cancel.create(stringjobID, CancelCreateParams {account\_id } params, RequestOptionsoptions?): [CancelCreateResponse]() {action\_params, action\_type, created\_at, 13 more } POST/accounts/{account\_id}/email-security/investigate/bulk/{job\_id}/cancel ##### ModelsExpand Collapse
CancelCreateResponse {action\_params, action\_type, created\_at, 13 more }
action\_params: Move {destination, type, expected\_disposition } | Release {type } One of the following:
Move {destination, type, expected\_disposition }
destination: "Inbox"| "JunkEmail"| "DeletedItems"| 2 more The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: "MOVE" Link to this property
Deprecatedexpected\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
Release {type } type: "RELEASE" Link to this property
Link to this property
Link to this property
action\_type: "MOVE"| "RELEASE" One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: string formatdate-time Link to this property job\_id: string formatuuid Link to this property messages\_cancelled: number Messages that were cancelled: rows cancelled via the API before being claimed, and rows whose in-flight attempt ended when the job reached a terminal state. Together the counters satisfy total\_messages\_discovered = messages\_pending + messages\_successful + messages\_failed + messages\_skipped + messages\_cancelled. Link to this property messages\_failed: number Link to this property messages\_pending: number Link to this property messages\_skipped: number Messages that discovery skipped (for example, phish submissions, which the job cannot action). Link to this property messages\_successful: number Link to this property
search\_params: SearchParams {action\_log, alert\_id, delivery\_status, 15 more } Deprecatedaction\_log?: boolean Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. Link to this property alert\_id?: string| null Alert ID of the detection to filter by. Link to this property
delivery\_status?: "delivered"| "moved"| "quarantined"| 5 more| null Delivery status to filter by. One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property detections\_only?: boolean Whether to include only detections in search results. Link to this property domain?: string| null Match messages that mention this domain — sender domain, recipient domain, or a domain in a link. Link to this property end?: string End of search date range. formatdate-time Link to this property exact\_subject?: string| null Match messages whose subject line equals this value exactly. Link to this property
final\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null Dispositions to filter by. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
message\_action?: "PREVIEW"| "QUARANTINE\_RELEASED"| "MOVED"| null Message actions to filter by. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASED" Link to this property "MOVED" Link to this property
Link to this property message\_id?: string| null Message-ID header value to filter by. Link to this property metric?: string| null Metric name to filter the search by. Link to this property query?: string| null Space-delimited search term. Case-insensitive. Link to this property recipient?: string| null Match messages whose recipient is this email address or domain. Link to this property sender?: string| null Match messages whose sender is this email address or domain. Link to this property smtp\_helo\_ip?: string| null Matches messages whose SMTP HELO server IP address equals this value. Link to this property start?: string Beginning of search date range. formatdate-time Link to this property subject?: string| null Match messages whose subject contains these keywords, in any order. Link to this property submissions?: boolean Whether to search reclassification submissions instead of original messages. Link to this property
Link to this property
status: "PENDING"| "DISCOVERING"| "PROCESSING"| 3 more Status of a bulk action job. One of the following: "PENDING" Link to this property "DISCOVERING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property
Link to this property total\_messages\_discovered: number Link to this property comment?: string| null Link to this property completed\_at?: string| null formatdate-time Link to this property started\_at?: string| null formatdate-time Link to this property status\_message?: string| null Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk.cancel%20%3E%20(model)%20cancel_create_response%20%3E%20(schema)>) #### InvestigateBulkMessages ##### [List messages for a bulk action job](https://developers.cloudflare.com/api/typescript/resources/email_security/subresources/investigate/subresources/bulk/subresources/messages/methods/list) client.emailSecurity.investigate.bulk.messages.list(stringjobID, MessageListParams {account\_id, page, per\_page, status } params, RequestOptionsoptions?): V4PagePaginationArray< [MessageListResponse]() {action\_params, action\_type, created\_at, 10 more } > GET/accounts/{account\_id}/email-security/investigate/bulk/{job\_id}/messages ##### ModelsExpand Collapse
MessageListResponse {action\_params, action\_type, created\_at, 10 more }
action\_params: Move {client\_recipient, destination, type, expected\_disposition } | Release {client\_recipient, type } One of the following:
Move {client\_recipient, destination, type, expected\_disposition } client\_recipient: string Link to this property
destination: "Inbox"| "JunkEmail"| "DeletedItems"| 2 more The mailbox folder to move messages to. One of the following: "Inbox" Link to this property "JunkEmail" Link to this property "DeletedItems" Link to this property "RecoverableItemsDeletions" Link to this property "RecoverableItemsPurges" Link to this property
Link to this property type: "MOVE" Link to this property
Deprecatedexpected\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null This field is nonfunctional. Nonfunctional field. End of life: December 1, 2026. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Link to this property
Release {client\_recipient, type } client\_recipient: string Link to this property type: "RELEASE" Link to this property
Link to this property
Link to this property
action\_type: "MOVE"| "RELEASE" One of the following: "MOVE" Link to this property "RELEASE" Link to this property
Link to this property created\_at: string formatdate-time Link to this property message\_id: string formatuuid Link to this property postfix\_id: string Link to this property retry\_count: number Link to this property
status: "PENDING"| "PROCESSING"| "COMPLETED"| 3 more Status of a message within a bulk action job. One of the following: "PENDING" Link to this property "PROCESSING" Link to this property "COMPLETED" Link to this property "FAILED" Link to this property "CANCELLED" Link to this property "SKIPPED" Link to this property
Link to this property alert\_id?: string| null Link to this property email\_message\_id?: string| null Link to this property
message?: Message {id, action\_log, client\_recipients, 32 more } id: string Unique identifier for a message retrieved from investigation. Link to this property
Deprecatedaction\_log: Array<ActionLog> Use GET /investigate/{investigate\_id}/action\_log instead. Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026. completed\_at: string Timestamp when action completed. formatdate-time Link to this property
operation: "MOVE"| "RELEASE"| "RECLASSIFY"| 3 more Type of action performed. One of the following: "MOVE" Link to this property "RELEASE" Link to this property "RECLASSIFY" Link to this property "SUBMISSION" Link to this property "QUARANTINE\_RELEASE" Link to this property "PREVIEW" Link to this property
Link to this property Deprecatedcompleted\_timestamp?: string Use completed_at instead. Deprecated, use completed_at instead. End of life: November 1, 2026. Link to this property
properties?: Properties {folder, requested\_by } Additional properties for the action. folder?: string Target folder for move operations. Link to this property requested\_by?: string User who requested the action. Link to this property
Link to this property status?: string| null Status of the action. Link to this property
Link to this property client\_recipients: Array<string> Link to this property detection\_reasons: Array<string> Link to this property is\_phish\_submission: boolean Link to this property is\_quarantined: boolean Link to this property postfix\_id: string The identifier of the message. Link to this property
properties: Properties {allowlisted\_pattern, allowlisted\_pattern\_type, blocklisted\_message, 2 more } Message processing properties. allowlisted\_pattern?: string| null Pattern that allowlisted this message. Link to this property
allowlisted\_pattern\_type?: "quarantine\_release"| "acceptable\_sender"| "allowed\_sender"| 5 more| null Type of allowlist pattern. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property blocklisted\_message?: boolean| null Whether message was blocklisted. Link to this property blocklisted\_pattern?: string| null Pattern that blocklisted this message. Link to this property
whitelisted\_pattern\_type?: "quarantine\_release"| "acceptable\_sender"| "allowed\_sender"| 5 more| null Legacy field for allowlist pattern type. One of the following: "quarantine\_release" Link to this property "acceptable\_sender" Link to this property "allowed\_sender" Link to this property "allowed\_recipient" Link to this property "domain\_similarity" Link to this property "domain\_recency" Link to this property "managed\_acceptable\_sender" Link to this property "outbound\_ndr" Link to this property
Link to this property
Link to this property Deprecatedts: string Use scanned_at instead. Deprecated, use scanned_at instead. End of life: November 1, 2026. Link to this property alert\_id?: string| null Link to this property
delivery\_mode?: "DIRECT"| "BCC"| "JOURNAL"| 8 more| null One of the following: "DIRECT" Link to this property "BCC" Link to this property "JOURNAL" Link to this property "REVIEW\_SUBMISSION" Link to this property "DMARC\_UNVERIFIED" Link to this property "DMARC\_FAILURE\_REPORT" Link to this property "DMARC\_AGGREGATE\_REPORT" Link to this property "THREAT\_INTEL\_SUBMISSION" Link to this property "SIMULATION\_SUBMISSION" Link to this property "API" Link to this property "RETRO\_SCAN" Link to this property
Link to this property
delivery\_status?: Array<"delivered"| "moved"| "quarantined"| 5 more>| null One of the following: "delivered" Link to this property "moved" Link to this property "quarantined" Link to this property "rejected" Link to this property "deferred" Link to this property "bounced" Link to this property "queued" Link to this property "move\_failed" Link to this property
Link to this property edf\_hash?: string| null Link to this property envelope\_from?: string| null Link to this property envelope\_to?: Array<string>| null Link to this property
final\_disposition?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property
Deprecatedfindings?: Array<Finding>| null Use the findings field from GET /investigate/{investigate\_id}/detections instead. Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message. attachment?: string| null Link to this property detail?: string| null Link to this property
detection?: "MALICIOUS"| "MALICIOUS-BEC"| "SUSPICIOUS"| 7 more| null The verdict Email Security assigns to a message. One of the following: "MALICIOUS" Link to this property "MALICIOUS-BEC" Link to this property "SUSPICIOUS" Link to this property "SPOOF" Link to this property "SPAM" Link to this property "BULK" Link to this property "ENCRYPTED" Link to this property "EXTERNAL" Link to this property "UNKNOWN" Link to this property "NONE" Link to this property
Link to this property field?: string| null Link to this property name?: string| null Link to this property portion?: string| null Link to this property reason?: string| null Link to this property score?: number| null formatdouble Link to this property value?: string| null Link to this property
Link to this property from?: string| null Link to this property from\_name?: string| null Link to this property htmltext\_structure\_hash?: string| null Link to this property message\_id?: string| null Link to this property
post\_delivery\_operations?: Array<"PREVIEW"| "QUARANTINE\_RELEASE"| "SUBMISSION"| "MOVE">| null Post-delivery operations performed on this message. One of the following: "PREVIEW" Link to this property "QUARANTINE\_RELEASE" Link to this property "SUBMISSION" Link to this property "MOVE" Link to this property
Link to this property postfix\_id\_outbound?: string| null Link to this property replyto?: string| null Link to this property scanned\_at?: string| null When the message was scanned (UTC). formatdate-time Link to this property sent\_at?: string| null When the message was sent (UTC). formatdate-time Link to this property sent\_date?: string| null Link to this property smtp\_helo\_server\_ip?: string| null Link to this property smtp\_previous\_hop\_ip?: string| null Link to this property subject?: string| null Link to this property threat\_categories?: Array<string>| null Link to this property to?: Array<string>| null Link to this property to\_name?: Array<string>| null Link to this property
validation?: Validation| null comment?: string| null Link to this property
dkim?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
dmarc?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
spf?: "pass"| "neutral"| "fail"| 2 more| null One of the following: "pass" Link to this property "neutral" Link to this property "fail" Link to this property "error" Link to this property "none" Link to this property
Link to this property
Link to this property x\_originating\_ip?: string| null Link to this property
Link to this property processed\_at?: string| null formatdate-time Link to this property retry\_after?: string| null When to retry the action if it failed. formatdate-time Link to this property status\_message?: string| null Link to this property
[Link to this property](<#(resource)%20email_security.investigate.bulk.messages%20%3E%20(model)%20message_list_response%20%3E%20(schema)>)