Search email messages
client.emailSecurity.investigate.list(InvestigateListParams { account_id, action_log, alert_id, 15 more } params, RequestOptionsoptions?): V4PagePaginationArray<InvestigateListResponse { id, action_log, client_recipients, 29 more } >
GET/accounts/{account_id}/email-security/investigate
Returns information for each email that matches the search parameter(s).
Security
API Token
The preferred authorization scheme for interacting with the Cloudflare API. Create a token.
Example:
API Email + API Key
The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.
Example:
The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.
Example:
Accepted Permissions (at least one required)
Search email messages
import Cloudflare from 'cloudflare';
const client = new Cloudflare({
apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});
// Automatically fetches more pages as needed.
for await (const investigateListResponse of client.emailSecurity.investigate.list({
account_id: '023e105f4ecef8ad9ca31a8372d0c353',
})) {
console.log(investigateListResponse.id);
}{
"errors": [
{
"code": 1000,
"message": "message",
"documentation_url": "documentation_url",
"source": {
"pointer": "pointer"
}
}
],
"messages": [
{
"code": 1000,
"message": "message",
"documentation_url": "documentation_url",
"source": {
"pointer": "pointer"
}
}
],
"result": [
{
"id": "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678",
"action_log": [
{
"completed_at": "2019-12-27T18:11:19.117Z",
"operation": "MOVE",
"completed_timestamp": "completed_timestamp",
"properties": {
"folder": "folder",
"requested_by": "requested_by"
},
"status": "status"
}
],
"client_recipients": [
"string"
],
"detection_reasons": [
"string"
],
"is_phish_submission": true,
"is_quarantined": true,
"postfix_id": "4Njp3P0STMz2c02Q",
"properties": {
"allowlisted_pattern": "allowlisted_pattern",
"allowlisted_pattern_type": "quarantine_release",
"blocklisted_message": true,
"blocklisted_pattern": "blocklisted_pattern",
"whitelisted_pattern_type": "quarantine_release"
},
"ts": "ts",
"alert_id": "alert_id",
"delivery_mode": "DIRECT",
"delivery_status": [
"delivered"
],
"edf_hash": "edf_hash",
"envelope_from": "envelope_from",
"envelope_to": [
"string"
],
"final_disposition": "MALICIOUS",
"findings": [
{
"attachment": "attachment",
"detail": "detail",
"detection": "MALICIOUS",
"field": "field",
"name": "name",
"portion": "portion",
"reason": "reason",
"score": 0,
"value": "value"
}
],
"from": "from",
"from_name": "from_name",
"htmltext_structure_hash": "htmltext_structure_hash",
"message_id": "message_id",
"post_delivery_operations": [
"PREVIEW"
],
"postfix_id_outbound": "postfix_id_outbound",
"replyto": "replyto",
"scanned_at": "2019-12-27T18:11:19.117Z",
"sent_at": "2019-12-27T18:11:19.117Z",
"sent_date": "sent_date",
"subject": "subject",
"threat_categories": [
"string"
],
"to": [
"string"
],
"to_name": [
"string"
],
"validation": {
"comment": "comment",
"dkim": "pass",
"dmarc": "pass",
"spf": "pass"
}
}
],
"result_info": {
"count": 0,
"per_page": 0,
"total_count": 0,
"next": "next",
"page": 0,
"previous": "previous"
},
"success": true
}Returns Examples
{
"errors": [
{
"code": 1000,
"message": "message",
"documentation_url": "documentation_url",
"source": {
"pointer": "pointer"
}
}
],
"messages": [
{
"code": 1000,
"message": "message",
"documentation_url": "documentation_url",
"source": {
"pointer": "pointer"
}
}
],
"result": [
{
"id": "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678",
"action_log": [
{
"completed_at": "2019-12-27T18:11:19.117Z",
"operation": "MOVE",
"completed_timestamp": "completed_timestamp",
"properties": {
"folder": "folder",
"requested_by": "requested_by"
},
"status": "status"
}
],
"client_recipients": [
"string"
],
"detection_reasons": [
"string"
],
"is_phish_submission": true,
"is_quarantined": true,
"postfix_id": "4Njp3P0STMz2c02Q",
"properties": {
"allowlisted_pattern": "allowlisted_pattern",
"allowlisted_pattern_type": "quarantine_release",
"blocklisted_message": true,
"blocklisted_pattern": "blocklisted_pattern",
"whitelisted_pattern_type": "quarantine_release"
},
"ts": "ts",
"alert_id": "alert_id",
"delivery_mode": "DIRECT",
"delivery_status": [
"delivered"
],
"edf_hash": "edf_hash",
"envelope_from": "envelope_from",
"envelope_to": [
"string"
],
"final_disposition": "MALICIOUS",
"findings": [
{
"attachment": "attachment",
"detail": "detail",
"detection": "MALICIOUS",
"field": "field",
"name": "name",
"portion": "portion",
"reason": "reason",
"score": 0,
"value": "value"
}
],
"from": "from",
"from_name": "from_name",
"htmltext_structure_hash": "htmltext_structure_hash",
"message_id": "message_id",
"post_delivery_operations": [
"PREVIEW"
],
"postfix_id_outbound": "postfix_id_outbound",
"replyto": "replyto",
"scanned_at": "2019-12-27T18:11:19.117Z",
"sent_at": "2019-12-27T18:11:19.117Z",
"sent_date": "sent_date",
"subject": "subject",
"threat_categories": [
"string"
],
"to": [
"string"
],
"to_name": [
"string"
],
"validation": {
"comment": "comment",
"dkim": "pass",
"dmarc": "pass",
"spf": "pass"
}
}
],
"result_info": {
"count": 0,
"per_page": 0,
"total_count": 0,
"next": "next",
"page": 0,
"previous": "previous"
},
"success": true
}