Get message details
email_security.investigate.get(strinvestigate_id, InvestigateGetParams**kwargs) -> InvestigateGetResponse
GET/accounts/{account_id}/email-security/investigate/{investigate_id}
Retrieves comprehensive details for a specific email message including headers, recipients, sender information, and current quarantine status. Use the investigate_id from search results to fetch detailed information.
Security
API Token
The preferred authorization scheme for interacting with the Cloudflare API. Create a token.
Example:
API Email + API Key
The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.
Example:
The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.
Example:
Accepted Permissions (at least one required)
Get message details
import os
from cloudflare import Cloudflare
client = Cloudflare(
api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted
)
investigate = client.email_security.investigate.get(
investigate_id="4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678",
account_id="023e105f4ecef8ad9ca31a8372d0c353",
)
print(investigate.id){
"errors": [
{
"code": 1000,
"message": "message",
"documentation_url": "documentation_url",
"source": {
"pointer": "pointer"
}
}
],
"messages": [
{
"code": 1000,
"message": "message",
"documentation_url": "documentation_url",
"source": {
"pointer": "pointer"
}
}
],
"result": {
"id": "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678",
"action_log": [
{
"completed_at": "2019-12-27T18:11:19.117Z",
"operation": "MOVE",
"completed_timestamp": "completed_timestamp",
"properties": {
"folder": "folder",
"requested_by": "requested_by"
},
"status": "status"
}
],
"client_recipients": [
"string"
],
"detection_reasons": [
"string"
],
"is_phish_submission": true,
"is_quarantined": true,
"postfix_id": "4Njp3P0STMz2c02Q",
"properties": {
"allowlisted_pattern": "allowlisted_pattern",
"allowlisted_pattern_type": "quarantine_release",
"blocklisted_message": true,
"blocklisted_pattern": "blocklisted_pattern",
"whitelisted_pattern_type": "quarantine_release"
},
"ts": "ts",
"alert_id": "alert_id",
"delivery_mode": "DIRECT",
"delivery_status": [
"delivered"
],
"edf_hash": "edf_hash",
"envelope_from": "envelope_from",
"envelope_to": [
"string"
],
"final_disposition": "MALICIOUS",
"findings": [
{
"attachment": "attachment",
"detail": "detail",
"detection": "MALICIOUS",
"field": "field",
"name": "name",
"portion": "portion",
"reason": "reason",
"score": 0,
"value": "value"
}
],
"from": "from",
"from_name": "from_name",
"htmltext_structure_hash": "htmltext_structure_hash",
"message_id": "message_id",
"post_delivery_operations": [
"PREVIEW"
],
"postfix_id_outbound": "postfix_id_outbound",
"replyto": "replyto",
"scanned_at": "2019-12-27T18:11:19.117Z",
"sent_at": "2019-12-27T18:11:19.117Z",
"sent_date": "sent_date",
"subject": "subject",
"threat_categories": [
"string"
],
"to": [
"string"
],
"to_name": [
"string"
],
"validation": {
"comment": "comment",
"dkim": "pass",
"dmarc": "pass",
"spf": "pass"
}
},
"success": true
}Returns Examples
{
"errors": [
{
"code": 1000,
"message": "message",
"documentation_url": "documentation_url",
"source": {
"pointer": "pointer"
}
}
],
"messages": [
{
"code": 1000,
"message": "message",
"documentation_url": "documentation_url",
"source": {
"pointer": "pointer"
}
}
],
"result": {
"id": "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678",
"action_log": [
{
"completed_at": "2019-12-27T18:11:19.117Z",
"operation": "MOVE",
"completed_timestamp": "completed_timestamp",
"properties": {
"folder": "folder",
"requested_by": "requested_by"
},
"status": "status"
}
],
"client_recipients": [
"string"
],
"detection_reasons": [
"string"
],
"is_phish_submission": true,
"is_quarantined": true,
"postfix_id": "4Njp3P0STMz2c02Q",
"properties": {
"allowlisted_pattern": "allowlisted_pattern",
"allowlisted_pattern_type": "quarantine_release",
"blocklisted_message": true,
"blocklisted_pattern": "blocklisted_pattern",
"whitelisted_pattern_type": "quarantine_release"
},
"ts": "ts",
"alert_id": "alert_id",
"delivery_mode": "DIRECT",
"delivery_status": [
"delivered"
],
"edf_hash": "edf_hash",
"envelope_from": "envelope_from",
"envelope_to": [
"string"
],
"final_disposition": "MALICIOUS",
"findings": [
{
"attachment": "attachment",
"detail": "detail",
"detection": "MALICIOUS",
"field": "field",
"name": "name",
"portion": "portion",
"reason": "reason",
"score": 0,
"value": "value"
}
],
"from": "from",
"from_name": "from_name",
"htmltext_structure_hash": "htmltext_structure_hash",
"message_id": "message_id",
"post_delivery_operations": [
"PREVIEW"
],
"postfix_id_outbound": "postfix_id_outbound",
"replyto": "replyto",
"scanned_at": "2019-12-27T18:11:19.117Z",
"sent_at": "2019-12-27T18:11:19.117Z",
"sent_date": "sent_date",
"subject": "subject",
"threat_categories": [
"string"
],
"to": [
"string"
],
"to_name": [
"string"
],
"validation": {
"comment": "comment",
"dkim": "pass",
"dmarc": "pass",
"spf": "pass"
}
},
"success": true
}