Email Security
Email SecurityInvestigate
Search email messages
Get message details
ModelsExpand Collapse
InvestigateListResponse object { id, action_log, client_recipients, 29 more }
Deprecatedaction_log: array of object { completed_at, operation, completed_timestamp, 2 more } Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.
Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.
properties: object { allowlisted_pattern, allowlisted_pattern_type, blocklisted_message, 2 more } Message processing properties
Message processing properties
Deprecatedfindings: optional array of object { attachment, detail, detection, 6 more } Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message.
Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message.
post_delivery_operations: optional array of "PREVIEW" or "QUARANTINE_RELEASE" or "SUBMISSION" or "MOVE"Post-delivery operations performed on this message
Post-delivery operations performed on this message
InvestigateGetResponse object { id, action_log, client_recipients, 29 more }
Deprecatedaction_log: array of object { completed_at, operation, completed_timestamp, 2 more } Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.
Deprecated, use GET /investigate/{investigate_id}/action_log instead. End of life: November 1, 2026.
properties: object { allowlisted_pattern, allowlisted_pattern_type, blocklisted_message, 2 more } Message processing properties
Message processing properties
Deprecatedfindings: optional array of object { attachment, detail, detection, 6 more } Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message.
Deprecated, use the findings field from GET /investigate/{investigate_id}/detections instead. End of life: November 1, 2026. Detection findings for this message.
post_delivery_operations: optional array of "PREVIEW" or "QUARANTINE_RELEASE" or "SUBMISSION" or "MOVE"Post-delivery operations performed on this message
Post-delivery operations performed on this message
Email SecurityInvestigateDetections
Get message detection details
ModelsExpand Collapse
DetectionGetResponse object { action, attachments, findings, 6 more }
attachments: array of object { size, content_type, detection, 6 more }
findings: array of object { attachment, detail, detection, 6 more }
Email SecurityInvestigatePreview
Get email preview
Preview for non-detection messages
Email SecurityInvestigateRaw
Get raw email content
Email SecurityInvestigateTrace
Get email trace
Email SecurityInvestigateMove
Move a message
Move multiple messages
ModelsExpand Collapse
Email SecurityInvestigateReclassify
Change email classification
Email SecurityInvestigateRelease
Release messages from quarantine
Email SecurityPhishguard
Email SecurityPhishguardReports
Get PhishGuard reports
Email SecuritySettings
Email SecuritySettingsAllow Policies
List email allow policies
Get an email allow policy
Create email allow policy
Update an email allow policy
Delete an email allow policy
ModelsExpand Collapse
AllowPolicyListResponse object { id, created_at, last_modified, 12 more } An email allow policy
An email allow policy
Deprecated, use modified_at instead. End of life: November 1, 2026.
Messages from this sender will be exempted from Spam, Spoof and Bulk dispositions. Note - This will not exempt messages with Malicious or Suspicious dispositions.
Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026.
Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026.
Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026.
Messages from this sender will bypass all detections and link following
AllowPolicyGetResponse object { id, created_at, last_modified, 12 more } An email allow policy
An email allow policy
Deprecated, use modified_at instead. End of life: November 1, 2026.
Messages from this sender will be exempted from Spam, Spoof and Bulk dispositions. Note - This will not exempt messages with Malicious or Suspicious dispositions.
Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026.
Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026.
Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026.
Messages from this sender will bypass all detections and link following
AllowPolicyCreateResponse object { id, created_at, last_modified, 12 more } An email allow policy
An email allow policy
Deprecated, use modified_at instead. End of life: November 1, 2026.
Messages from this sender will be exempted from Spam, Spoof and Bulk dispositions. Note - This will not exempt messages with Malicious or Suspicious dispositions.
Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026.
Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026.
Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026.
Messages from this sender will bypass all detections and link following
AllowPolicyEditResponse object { id, created_at, last_modified, 12 more } An email allow policy
An email allow policy
Deprecated, use modified_at instead. End of life: November 1, 2026.
Messages from this sender will be exempted from Spam, Spoof and Bulk dispositions. Note - This will not exempt messages with Malicious or Suspicious dispositions.
Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026.
Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026.
Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026.
Messages from this sender will bypass all detections and link following
Email SecuritySettingsBlock Senders
List blocked email senders
Get a blocked email sender
Create blocked email sender
Update a blocked email sender
Delete a blocked email sender
ModelsExpand Collapse
Email SecuritySettingsDomains
List protected email domains
Get an email domain
Update an email domain
Unprotect an email domain
ModelsExpand Collapse
DomainListResponse object { id, allowed_delivery_modes, authorization, 19 more }
emails_processed: optional object { timestamp, total_emails_processed, total_emails_processed_previous }
Deprecated, use modified_at instead. End of life: November 1, 2026.
DomainGetResponse object { id, allowed_delivery_modes, authorization, 19 more }
emails_processed: optional object { timestamp, total_emails_processed, total_emails_processed_previous }
Deprecated, use modified_at instead. End of life: November 1, 2026.
DomainEditResponse object { id, allowed_delivery_modes, authorization, 19 more }
emails_processed: optional object { timestamp, total_emails_processed, total_emails_processed_previous }
Deprecated, use modified_at instead. End of life: November 1, 2026.
Email SecuritySettingsImpersonation Registry
List entries in impersonation registry
Get an impersonation registry entry
Create impersonation registry entry
Update an impersonation registry entry
Delete an impersonation registry entry
ModelsExpand Collapse
Email SecuritySettingsTrusted Domains
List trusted email domains
Get a trusted email domain
Create trusted email domain
Update a trusted email domain
Delete a trusted email domain
ModelsExpand Collapse
TrustedDomainListResponse object { id, comments, created_at, 6 more } A trusted email domain
A trusted email domain
Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition.
Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition.
TrustedDomainGetResponse object { id, comments, created_at, 6 more } A trusted email domain
A trusted email domain
Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition.
Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition.
TrustedDomainCreateResponse object { id, comments, created_at, 6 more } A trusted email domain
A trusted email domain
Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition.
Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition.
TrustedDomainEditResponse object { id, comments, created_at, 6 more } A trusted email domain
A trusted email domain
Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition.
Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition.