Skip to content
Cloudflare API
Start here
API Reference
Email Security
Investigate

Bulk

List bulk action jobs
client.emailSecurity.investigate.bulk.list(BulkListParams { account_id, action_type, page, 2 more } params, RequestOptionsoptions?): V4PagePaginationArray<BulkListResponse { action_params, action_type, created_at, 11 more } >
GET/accounts/{account_id}/email-security/investigate/bulk
Create a bulk action job
client.emailSecurity.investigate.bulk.create(BulkCreateParams { account_id, action, search_params, 3 more } params, RequestOptionsoptions?): BulkCreateResponse { action_params, action_type, created_at, 11 more }
POST/accounts/{account_id}/email-security/investigate/bulk
Get bulk action job details
client.emailSecurity.investigate.bulk.get(stringjobId, BulkGetParams { account_id } params, RequestOptionsoptions?): BulkGetResponse { action_params, action_type, created_at, 11 more }
GET/accounts/{account_id}/email-security/investigate/bulk/{job_id}
Delete a bulk action job
client.emailSecurity.investigate.bulk.delete(stringjobId, BulkDeleteParams { account_id } params, RequestOptionsoptions?): BulkDeleteResponse { id }
DELETE/accounts/{account_id}/email-security/investigate/bulk/{job_id}
ModelsExpand Collapse
BulkListResponse { action_params, action_type, created_at, 11 more }
action_params: Move { destination, type, expected_disposition } | Release { type }
One of the following:
Move { destination, type, expected_disposition }
destination: "Inbox" | "JunkEmail" | "DeletedItems" | 2 more
One of the following:
"Inbox"
"JunkEmail"
"DeletedItems"
"RecoverableItemsDeletions"
"RecoverableItemsPurges"
type: "MOVE"
expected_disposition?: "MALICIOUS" | "MALICIOUS-BEC" | "SUSPICIOUS" | 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
Release { type }
type: "RELEASE"
action_type: "MOVE" | "RELEASE"
One of the following:
"MOVE"
"RELEASE"
created_at: string
formatdate-time
job_id: string
formatuuid
messages_failed: number
messages_pending: number
messages_successful: number
search_params: SearchParams { action_log, alert_id, delivery_status, 14 more }
Deprecatedaction_log?: boolean

Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.

alert_id?: string | null
delivery_status?: "delivered" | "moved" | "quarantined" | 4 more

Delivery status of the message.

One of the following:
"delivered"
"moved"
"quarantined"
"rejected"
"deferred"
"bounced"
"queued"
detections_only?: boolean
domain?: string | null
end?: string

End of search date range

formatdate-time
exact_subject?: string | null
final_disposition?: "MALICIOUS" | "MALICIOUS-BEC" | "SUSPICIOUS" | 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
message_action?: "PREVIEW" | "QUARANTINE_RELEASED" | "MOVED" | null
One of the following:
"PREVIEW"
"QUARANTINE_RELEASED"
"MOVED"
message_id?: string | null
metric?: string | null
query?: string | null
recipient?: string | null
sender?: string | null
start?: string

Beginning of search date range

formatdate-time
subject?: string | null
submissions?: boolean
status: "PENDING" | "DISCOVERING" | "PROCESSING" | 4 more
One of the following:
"PENDING"
"DISCOVERING"
"PROCESSING"
"COMPLETED"
"FAILED"
"CANCELLED"
"SKIPPED"
total_messages_discovered: number
comment?: string | null
completed_at?: string | null
formatdate-time
started_at?: string | null
formatdate-time
status_message?: string | null
BulkCreateResponse { action_params, action_type, created_at, 11 more }
action_params: Move { destination, type, expected_disposition } | Release { type }
One of the following:
Move { destination, type, expected_disposition }
destination: "Inbox" | "JunkEmail" | "DeletedItems" | 2 more
One of the following:
"Inbox"
"JunkEmail"
"DeletedItems"
"RecoverableItemsDeletions"
"RecoverableItemsPurges"
type: "MOVE"
expected_disposition?: "MALICIOUS" | "MALICIOUS-BEC" | "SUSPICIOUS" | 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
Release { type }
type: "RELEASE"
action_type: "MOVE" | "RELEASE"
One of the following:
"MOVE"
"RELEASE"
created_at: string
formatdate-time
job_id: string
formatuuid
messages_failed: number
messages_pending: number
messages_successful: number
search_params: SearchParams { action_log, alert_id, delivery_status, 14 more }
Deprecatedaction_log?: boolean

Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.

alert_id?: string | null
delivery_status?: "delivered" | "moved" | "quarantined" | 4 more

Delivery status of the message.

One of the following:
"delivered"
"moved"
"quarantined"
"rejected"
"deferred"
"bounced"
"queued"
detections_only?: boolean
domain?: string | null
end?: string

End of search date range

formatdate-time
exact_subject?: string | null
final_disposition?: "MALICIOUS" | "MALICIOUS-BEC" | "SUSPICIOUS" | 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
message_action?: "PREVIEW" | "QUARANTINE_RELEASED" | "MOVED" | null
One of the following:
"PREVIEW"
"QUARANTINE_RELEASED"
"MOVED"
message_id?: string | null
metric?: string | null
query?: string | null
recipient?: string | null
sender?: string | null
start?: string

Beginning of search date range

formatdate-time
subject?: string | null
submissions?: boolean
status: "PENDING" | "DISCOVERING" | "PROCESSING" | 4 more
One of the following:
"PENDING"
"DISCOVERING"
"PROCESSING"
"COMPLETED"
"FAILED"
"CANCELLED"
"SKIPPED"
total_messages_discovered: number
comment?: string | null
completed_at?: string | null
formatdate-time
started_at?: string | null
formatdate-time
status_message?: string | null
BulkGetResponse { action_params, action_type, created_at, 11 more }
action_params: Move { destination, type, expected_disposition } | Release { type }
One of the following:
Move { destination, type, expected_disposition }
destination: "Inbox" | "JunkEmail" | "DeletedItems" | 2 more
One of the following:
"Inbox"
"JunkEmail"
"DeletedItems"
"RecoverableItemsDeletions"
"RecoverableItemsPurges"
type: "MOVE"
expected_disposition?: "MALICIOUS" | "MALICIOUS-BEC" | "SUSPICIOUS" | 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
Release { type }
type: "RELEASE"
action_type: "MOVE" | "RELEASE"
One of the following:
"MOVE"
"RELEASE"
created_at: string
formatdate-time
job_id: string
formatuuid
messages_failed: number
messages_pending: number
messages_successful: number
search_params: SearchParams { action_log, alert_id, delivery_status, 14 more }
Deprecatedaction_log?: boolean

Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.

alert_id?: string | null
delivery_status?: "delivered" | "moved" | "quarantined" | 4 more

Delivery status of the message.

One of the following:
"delivered"
"moved"
"quarantined"
"rejected"
"deferred"
"bounced"
"queued"
detections_only?: boolean
domain?: string | null
end?: string

End of search date range

formatdate-time
exact_subject?: string | null
final_disposition?: "MALICIOUS" | "MALICIOUS-BEC" | "SUSPICIOUS" | 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
message_action?: "PREVIEW" | "QUARANTINE_RELEASED" | "MOVED" | null
One of the following:
"PREVIEW"
"QUARANTINE_RELEASED"
"MOVED"
message_id?: string | null
metric?: string | null
query?: string | null
recipient?: string | null
sender?: string | null
start?: string

Beginning of search date range

formatdate-time
subject?: string | null
submissions?: boolean
status: "PENDING" | "DISCOVERING" | "PROCESSING" | 4 more
One of the following:
"PENDING"
"DISCOVERING"
"PROCESSING"
"COMPLETED"
"FAILED"
"CANCELLED"
"SKIPPED"
total_messages_discovered: number
comment?: string | null
completed_at?: string | null
formatdate-time
started_at?: string | null
formatdate-time
status_message?: string | null
BulkDeleteResponse { id }
id: string
formatuuid

BulkCancel

Cancel a bulk action job
client.emailSecurity.investigate.bulk.cancel.create(stringjobId, CancelCreateParams { account_id } params, RequestOptionsoptions?): CancelCreateResponse { action_params, action_type, created_at, 11 more }
POST/accounts/{account_id}/email-security/investigate/bulk/{job_id}/cancel
ModelsExpand Collapse
CancelCreateResponse { action_params, action_type, created_at, 11 more }
action_params: Move { destination, type, expected_disposition } | Release { type }
One of the following:
Move { destination, type, expected_disposition }
destination: "Inbox" | "JunkEmail" | "DeletedItems" | 2 more
One of the following:
"Inbox"
"JunkEmail"
"DeletedItems"
"RecoverableItemsDeletions"
"RecoverableItemsPurges"
type: "MOVE"
expected_disposition?: "MALICIOUS" | "MALICIOUS-BEC" | "SUSPICIOUS" | 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
Release { type }
type: "RELEASE"
action_type: "MOVE" | "RELEASE"
One of the following:
"MOVE"
"RELEASE"
created_at: string
formatdate-time
job_id: string
formatuuid
messages_failed: number
messages_pending: number
messages_successful: number
search_params: SearchParams { action_log, alert_id, delivery_status, 14 more }
Deprecatedaction_log?: boolean

Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.

alert_id?: string | null
delivery_status?: "delivered" | "moved" | "quarantined" | 4 more

Delivery status of the message.

One of the following:
"delivered"
"moved"
"quarantined"
"rejected"
"deferred"
"bounced"
"queued"
detections_only?: boolean
domain?: string | null
end?: string

End of search date range

formatdate-time
exact_subject?: string | null
final_disposition?: "MALICIOUS" | "MALICIOUS-BEC" | "SUSPICIOUS" | 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
message_action?: "PREVIEW" | "QUARANTINE_RELEASED" | "MOVED" | null
One of the following:
"PREVIEW"
"QUARANTINE_RELEASED"
"MOVED"
message_id?: string | null
metric?: string | null
query?: string | null
recipient?: string | null
sender?: string | null
start?: string

Beginning of search date range

formatdate-time
subject?: string | null
submissions?: boolean
status: "PENDING" | "DISCOVERING" | "PROCESSING" | 4 more
One of the following:
"PENDING"
"DISCOVERING"
"PROCESSING"
"COMPLETED"
"FAILED"
"CANCELLED"
"SKIPPED"
total_messages_discovered: number
comment?: string | null
completed_at?: string | null
formatdate-time
started_at?: string | null
formatdate-time
status_message?: string | null

BulkMessages

List messages for a bulk action job
client.emailSecurity.investigate.bulk.messages.list(stringjobId, MessageListParams { account_id, page, per_page, status } params, RequestOptionsoptions?): V4PagePaginationArray<MessageListResponse { action_params, action_type, created_at, 9 more } >
GET/accounts/{account_id}/email-security/investigate/bulk/{job_id}/messages
ModelsExpand Collapse
MessageListResponse { action_params, action_type, created_at, 9 more }
action_params: Move { client_recipient, destination, type, expected_disposition } | Release { client_recipient, type }
One of the following:
Move { client_recipient, destination, type, expected_disposition }
client_recipient: string
destination: "Inbox" | "JunkEmail" | "DeletedItems" | 2 more
One of the following:
"Inbox"
"JunkEmail"
"DeletedItems"
"RecoverableItemsDeletions"
"RecoverableItemsPurges"
type: "MOVE"
expected_disposition?: "MALICIOUS" | "MALICIOUS-BEC" | "SUSPICIOUS" | 7 more
One of the following:
"MALICIOUS"
"MALICIOUS-BEC"
"SUSPICIOUS"
"SPOOF"
"SPAM"
"BULK"
"ENCRYPTED"
"EXTERNAL"
"UNKNOWN"
"NONE"
Release { client_recipient, type }
client_recipient: string
type: "RELEASE"
action_type: "MOVE" | "RELEASE"
One of the following:
"MOVE"
"RELEASE"
created_at: string
formatdate-time
message_id: string
formatuuid
postfix_id: string
retry_count: number
status: "PENDING" | "DISCOVERING" | "PROCESSING" | 4 more
One of the following:
"PENDING"
"DISCOVERING"
"PROCESSING"
"COMPLETED"
"FAILED"
"CANCELLED"
"SKIPPED"
alert_id?: string | null
email_message_id?: string | null
processed_at?: string | null
formatdate-time
retry_after?: string | null

When to retry the action if it failed

formatdate-time
status_message?: string | null