## Search email messages `client.EmailSecurity.Investigate.List(ctx, params) (*V4PagePaginationArray[InvestigateListResponse], error)` **get** `/accounts/{account_id}/email-security/investigate` Returns information for each email that matches the search parameter(s). ### Parameters - `params InvestigateListParams` - `AccountID param.Field[string]` Path param: Identifier. - `ActionLog param.Field[bool]` Query param: Whether to include the message action log in the response. - `AlertID param.Field[string]` Query param - `Cursor param.Field[string]` Query param - `DetectionsOnly param.Field[bool]` Query param: Whether to include only detections in search results. - `Domain param.Field[string]` Query param: Sender domains to filter by. - `End param.Field[Time]` Query param: The end of the search date range. Defaults to `now`. - `FinalDisposition param.Field[InvestigateListParamsFinalDisposition]` Query param: Dispositions to filter by. - `const InvestigateListParamsFinalDispositionMalicious InvestigateListParamsFinalDisposition = "MALICIOUS"` - `const InvestigateListParamsFinalDispositionSuspicious InvestigateListParamsFinalDisposition = "SUSPICIOUS"` - `const InvestigateListParamsFinalDispositionSpoof InvestigateListParamsFinalDisposition = "SPOOF"` - `const InvestigateListParamsFinalDispositionSpam InvestigateListParamsFinalDisposition = "SPAM"` - `const InvestigateListParamsFinalDispositionBulk InvestigateListParamsFinalDisposition = "BULK"` - `const InvestigateListParamsFinalDispositionNone InvestigateListParamsFinalDisposition = "NONE"` - `MessageAction param.Field[InvestigateListParamsMessageAction]` Query param: Message actions to filter by. - `const InvestigateListParamsMessageActionPreview InvestigateListParamsMessageAction = "PREVIEW"` - `const InvestigateListParamsMessageActionQuarantineReleased InvestigateListParamsMessageAction = "QUARANTINE_RELEASED"` - `const InvestigateListParamsMessageActionMoved InvestigateListParamsMessageAction = "MOVED"` - `MessageID param.Field[string]` Query param - `Metric param.Field[string]` Query param - `Page param.Field[int64]` Query param: Deprecated: Use cursor pagination instead. End of life: November 1, 2026. - `PerPage param.Field[int64]` Query param: The number of results per page. Maximum value is 1000. - `Query param.Field[string]` Query param: Space-delimited search term. Case-insensitive. - `Recipient param.Field[string]` Query param - `Sender param.Field[string]` Query param - `Start param.Field[Time]` Query param: The beginning of the search date range. Defaults to `now - 30 days`. - `Subject param.Field[string]` Query param ### Returns - `type InvestigateListResponse struct{…}` - `ID string` Unique identifier for a message retrieved from investigation - `ActionLog []InvestigateListResponseActionLog` Deprecated, use `GET /investigate/{investigate_id}/action_log` instead. End of life: November 1, 2026. - `CompletedAt Time` Timestamp when action completed - `Operation InvestigateListResponseActionLogOperation` Type of action performed - `const InvestigateListResponseActionLogOperationMove InvestigateListResponseActionLogOperation = "MOVE"` - `const InvestigateListResponseActionLogOperationRelease InvestigateListResponseActionLogOperation = "RELEASE"` - `const InvestigateListResponseActionLogOperationReclassify InvestigateListResponseActionLogOperation = "RECLASSIFY"` - `const InvestigateListResponseActionLogOperationSubmission InvestigateListResponseActionLogOperation = "SUBMISSION"` - `const InvestigateListResponseActionLogOperationQuarantineRelease InvestigateListResponseActionLogOperation = "QUARANTINE_RELEASE"` - `const InvestigateListResponseActionLogOperationPreview InvestigateListResponseActionLogOperation = "PREVIEW"` - `CompletedTimestamp string` Deprecated, use `completed_at` instead. End of life: November 1, 2026. - `Properties InvestigateListResponseActionLogProperties` Additional properties for the action - `Folder string` Target folder for move operations - `RequestedBy string` User who requested the action - `Status string` Status of the action - `ClientRecipients []string` - `DetectionReasons []string` - `IsPhishSubmission bool` - `IsQuarantined bool` - `PostfixID string` The identifier of the message - `Properties InvestigateListResponseProperties` Message processing properties - `AllowlistedPattern string` Pattern that allowlisted this message - `AllowlistedPatternType InvestigateListResponsePropertiesAllowlistedPatternType` Type of allowlist pattern - `const InvestigateListResponsePropertiesAllowlistedPatternTypeQuarantineRelease InvestigateListResponsePropertiesAllowlistedPatternType = "quarantine_release"` - `const InvestigateListResponsePropertiesAllowlistedPatternTypeAcceptableSender InvestigateListResponsePropertiesAllowlistedPatternType = "acceptable_sender"` - `const InvestigateListResponsePropertiesAllowlistedPatternTypeAllowedSender InvestigateListResponsePropertiesAllowlistedPatternType = "allowed_sender"` - `const InvestigateListResponsePropertiesAllowlistedPatternTypeAllowedRecipient InvestigateListResponsePropertiesAllowlistedPatternType = "allowed_recipient"` - `const InvestigateListResponsePropertiesAllowlistedPatternTypeDomainSimilarity InvestigateListResponsePropertiesAllowlistedPatternType = "domain_similarity"` - `const InvestigateListResponsePropertiesAllowlistedPatternTypeDomainRecency InvestigateListResponsePropertiesAllowlistedPatternType = "domain_recency"` - `const InvestigateListResponsePropertiesAllowlistedPatternTypeManagedAcceptableSender InvestigateListResponsePropertiesAllowlistedPatternType = "managed_acceptable_sender"` - `const InvestigateListResponsePropertiesAllowlistedPatternTypeOutboundNdr InvestigateListResponsePropertiesAllowlistedPatternType = "outbound_ndr"` - `BlocklistedMessage bool` Whether message was blocklisted - `BlocklistedPattern string` Pattern that blocklisted this message - `WhitelistedPatternType InvestigateListResponsePropertiesWhitelistedPatternType` Legacy field for allowlist pattern type - `const InvestigateListResponsePropertiesWhitelistedPatternTypeQuarantineRelease InvestigateListResponsePropertiesWhitelistedPatternType = "quarantine_release"` - `const InvestigateListResponsePropertiesWhitelistedPatternTypeAcceptableSender InvestigateListResponsePropertiesWhitelistedPatternType = "acceptable_sender"` - `const InvestigateListResponsePropertiesWhitelistedPatternTypeAllowedSender InvestigateListResponsePropertiesWhitelistedPatternType = "allowed_sender"` - `const InvestigateListResponsePropertiesWhitelistedPatternTypeAllowedRecipient InvestigateListResponsePropertiesWhitelistedPatternType = "allowed_recipient"` - `const InvestigateListResponsePropertiesWhitelistedPatternTypeDomainSimilarity InvestigateListResponsePropertiesWhitelistedPatternType = "domain_similarity"` - `const InvestigateListResponsePropertiesWhitelistedPatternTypeDomainRecency InvestigateListResponsePropertiesWhitelistedPatternType = "domain_recency"` - `const InvestigateListResponsePropertiesWhitelistedPatternTypeManagedAcceptableSender InvestigateListResponsePropertiesWhitelistedPatternType = "managed_acceptable_sender"` - `const InvestigateListResponsePropertiesWhitelistedPatternTypeOutboundNdr InvestigateListResponsePropertiesWhitelistedPatternType = "outbound_ndr"` - `Ts string` Deprecated, use `scanned_at` instead. End of life: November 1, 2026. - `AlertID string` - `DeliveryMode InvestigateListResponseDeliveryMode` - `const InvestigateListResponseDeliveryModeDirect InvestigateListResponseDeliveryMode = "DIRECT"` - `const InvestigateListResponseDeliveryModeBcc InvestigateListResponseDeliveryMode = "BCC"` - `const InvestigateListResponseDeliveryModeJournal InvestigateListResponseDeliveryMode = "JOURNAL"` - `const InvestigateListResponseDeliveryModeReviewSubmission InvestigateListResponseDeliveryMode = "REVIEW_SUBMISSION"` - `const InvestigateListResponseDeliveryModeDMARCUnverified InvestigateListResponseDeliveryMode = "DMARC_UNVERIFIED"` - `const InvestigateListResponseDeliveryModeDMARCFailureReport InvestigateListResponseDeliveryMode = "DMARC_FAILURE_REPORT"` - `const InvestigateListResponseDeliveryModeDMARCAggregateReport InvestigateListResponseDeliveryMode = "DMARC_AGGREGATE_REPORT"` - `const InvestigateListResponseDeliveryModeThreatIntelSubmission InvestigateListResponseDeliveryMode = "THREAT_INTEL_SUBMISSION"` - `const InvestigateListResponseDeliveryModeSimulationSubmission InvestigateListResponseDeliveryMode = "SIMULATION_SUBMISSION"` - `const InvestigateListResponseDeliveryModeAPI InvestigateListResponseDeliveryMode = "API"` - `const InvestigateListResponseDeliveryModeRetroScan InvestigateListResponseDeliveryMode = "RETRO_SCAN"` - `DeliveryStatus []InvestigateListResponseDeliveryStatus` - `const InvestigateListResponseDeliveryStatusDelivered InvestigateListResponseDeliveryStatus = "delivered"` - `const InvestigateListResponseDeliveryStatusMoved InvestigateListResponseDeliveryStatus = "moved"` - `const InvestigateListResponseDeliveryStatusQuarantined InvestigateListResponseDeliveryStatus = "quarantined"` - `const InvestigateListResponseDeliveryStatusRejected InvestigateListResponseDeliveryStatus = "rejected"` - `const InvestigateListResponseDeliveryStatusDeferred InvestigateListResponseDeliveryStatus = "deferred"` - `const InvestigateListResponseDeliveryStatusBounced InvestigateListResponseDeliveryStatus = "bounced"` - `const InvestigateListResponseDeliveryStatusQueued InvestigateListResponseDeliveryStatus = "queued"` - `EdfHash string` - `EnvelopeFrom string` - `EnvelopeTo []string` - `FinalDisposition InvestigateListResponseFinalDisposition` - `const InvestigateListResponseFinalDispositionMalicious InvestigateListResponseFinalDisposition = "MALICIOUS"` - `const InvestigateListResponseFinalDispositionMaliciousBec InvestigateListResponseFinalDisposition = "MALICIOUS-BEC"` - `const InvestigateListResponseFinalDispositionSuspicious InvestigateListResponseFinalDisposition = "SUSPICIOUS"` - `const InvestigateListResponseFinalDispositionSpoof InvestigateListResponseFinalDisposition = "SPOOF"` - `const InvestigateListResponseFinalDispositionSpam InvestigateListResponseFinalDisposition = "SPAM"` - `const InvestigateListResponseFinalDispositionBulk InvestigateListResponseFinalDisposition = "BULK"` - `const InvestigateListResponseFinalDispositionEncrypted InvestigateListResponseFinalDisposition = "ENCRYPTED"` - `const InvestigateListResponseFinalDispositionExternal InvestigateListResponseFinalDisposition = "EXTERNAL"` - `const InvestigateListResponseFinalDispositionUnknown InvestigateListResponseFinalDisposition = "UNKNOWN"` - `const InvestigateListResponseFinalDispositionNone InvestigateListResponseFinalDisposition = "NONE"` - `Findings []InvestigateListResponseFinding` Deprecated, use the `findings` field from `GET /investigate/{investigate_id}/detections` instead. End of life: November 1, 2026. Detection findings for this message. - `Attachment string` - `Detail string` - `Detection InvestigateListResponseFindingsDetection` - `const InvestigateListResponseFindingsDetectionMalicious InvestigateListResponseFindingsDetection = "MALICIOUS"` - `const InvestigateListResponseFindingsDetectionMaliciousBec InvestigateListResponseFindingsDetection = "MALICIOUS-BEC"` - `const InvestigateListResponseFindingsDetectionSuspicious InvestigateListResponseFindingsDetection = "SUSPICIOUS"` - `const InvestigateListResponseFindingsDetectionSpoof InvestigateListResponseFindingsDetection = "SPOOF"` - `const InvestigateListResponseFindingsDetectionSpam InvestigateListResponseFindingsDetection = "SPAM"` - `const InvestigateListResponseFindingsDetectionBulk InvestigateListResponseFindingsDetection = "BULK"` - `const InvestigateListResponseFindingsDetectionEncrypted InvestigateListResponseFindingsDetection = "ENCRYPTED"` - `const InvestigateListResponseFindingsDetectionExternal InvestigateListResponseFindingsDetection = "EXTERNAL"` - `const InvestigateListResponseFindingsDetectionUnknown InvestigateListResponseFindingsDetection = "UNKNOWN"` - `const InvestigateListResponseFindingsDetectionNone InvestigateListResponseFindingsDetection = "NONE"` - `Field string` - `Name string` - `Portion string` - `Reason string` - `Score float64` - `Value string` - `From string` - `FromName string` - `HtmltextStructureHash string` - `MessageID string` - `PostDeliveryOperations []InvestigateListResponsePostDeliveryOperation` Post-delivery operations performed on this message - `const InvestigateListResponsePostDeliveryOperationPreview InvestigateListResponsePostDeliveryOperation = "PREVIEW"` - `const InvestigateListResponsePostDeliveryOperationQuarantineRelease InvestigateListResponsePostDeliveryOperation = "QUARANTINE_RELEASE"` - `const InvestigateListResponsePostDeliveryOperationSubmission InvestigateListResponsePostDeliveryOperation = "SUBMISSION"` - `const InvestigateListResponsePostDeliveryOperationMove InvestigateListResponsePostDeliveryOperation = "MOVE"` - `PostfixIDOutbound string` - `Replyto string` - `ScannedAt Time` When the message was scanned (UTC) - `SentAt Time` When the message was sent (UTC) - `SentDate string` - `Subject string` - `ThreatCategories []string` - `To []string` - `ToName []string` - `Validation InvestigateListResponseValidation` - `Comment string` - `DKIM InvestigateListResponseValidationDKIM` - `const InvestigateListResponseValidationDKIMPass InvestigateListResponseValidationDKIM = "pass"` - `const InvestigateListResponseValidationDKIMNeutral InvestigateListResponseValidationDKIM = "neutral"` - `const InvestigateListResponseValidationDKIMFail InvestigateListResponseValidationDKIM = "fail"` - `const InvestigateListResponseValidationDKIMError InvestigateListResponseValidationDKIM = "error"` - `const InvestigateListResponseValidationDKIMNone InvestigateListResponseValidationDKIM = "none"` - `DMARC InvestigateListResponseValidationDMARC` - `const InvestigateListResponseValidationDMARCPass InvestigateListResponseValidationDMARC = "pass"` - `const InvestigateListResponseValidationDMARCNeutral InvestigateListResponseValidationDMARC = "neutral"` - `const InvestigateListResponseValidationDMARCFail InvestigateListResponseValidationDMARC = "fail"` - `const InvestigateListResponseValidationDMARCError InvestigateListResponseValidationDMARC = "error"` - `const InvestigateListResponseValidationDMARCNone InvestigateListResponseValidationDMARC = "none"` - `SPF InvestigateListResponseValidationSPF` - `const InvestigateListResponseValidationSPFPass InvestigateListResponseValidationSPF = "pass"` - `const InvestigateListResponseValidationSPFNeutral InvestigateListResponseValidationSPF = "neutral"` - `const InvestigateListResponseValidationSPFFail InvestigateListResponseValidationSPF = "fail"` - `const InvestigateListResponseValidationSPFError InvestigateListResponseValidationSPF = "error"` - `const InvestigateListResponseValidationSPFNone InvestigateListResponseValidationSPF = "none"` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) page, err := client.EmailSecurity.Investigate.List(context.TODO(), email_security.InvestigateListParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "id": "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", "action_log": [ { "completed_at": "2019-12-27T18:11:19.117Z", "operation": "MOVE", "completed_timestamp": "completed_timestamp", "properties": { "folder": "folder", "requested_by": "requested_by" }, "status": "status" } ], "client_recipients": [ "string" ], "detection_reasons": [ "string" ], "is_phish_submission": true, "is_quarantined": true, "postfix_id": "4Njp3P0STMz2c02Q", "properties": { "allowlisted_pattern": "allowlisted_pattern", "allowlisted_pattern_type": "quarantine_release", "blocklisted_message": true, "blocklisted_pattern": "blocklisted_pattern", "whitelisted_pattern_type": "quarantine_release" }, "ts": "ts", "alert_id": "alert_id", "delivery_mode": "DIRECT", "delivery_status": [ "delivered" ], "edf_hash": "edf_hash", "envelope_from": "envelope_from", "envelope_to": [ "string" ], "final_disposition": "MALICIOUS", "findings": [ { "attachment": "attachment", "detail": "detail", "detection": "MALICIOUS", "field": "field", "name": "name", "portion": "portion", "reason": "reason", "score": 0, "value": "value" } ], "from": "from", "from_name": "from_name", "htmltext_structure_hash": "htmltext_structure_hash", "message_id": "message_id", "post_delivery_operations": [ "PREVIEW" ], "postfix_id_outbound": "postfix_id_outbound", "replyto": "replyto", "scanned_at": "2019-12-27T18:11:19.117Z", "sent_at": "2019-12-27T18:11:19.117Z", "sent_date": "sent_date", "subject": "subject", "threat_categories": [ "string" ], "to": [ "string" ], "to_name": [ "string" ], "validation": { "comment": "comment", "dkim": "pass", "dmarc": "pass", "spf": "pass" } } ], "result_info": { "count": 0, "per_page": 0, "total_count": 0, "next": "next", "page": 0, "previous": "previous" }, "success": true } ```