# Investigate ## Search email messages `email_security.investigate.list(InvestigateListParams**kwargs) -> SyncV4PagePaginationArray[InvestigateListResponse]` **get** `/accounts/{account_id}/email-security/investigate` Returns information for each email that matches the search parameter(s). ### Parameters - `account_id: str` Identifier. - `action_log: Optional[bool]` Whether to include the message action log in the response. - `alert_id: Optional[str]` - `cursor: Optional[str]` - `detections_only: Optional[bool]` Whether to include only detections in search results. - `domain: Optional[str]` Sender domains to filter by. - `end: Optional[Union[str, datetime]]` The end of the search date range. Defaults to `now`. - `final_disposition: Optional[Literal["MALICIOUS", "SUSPICIOUS", "SPOOF", 3 more]]` Dispositions to filter by. - `"MALICIOUS"` - `"SUSPICIOUS"` - `"SPOOF"` - `"SPAM"` - `"BULK"` - `"NONE"` - `message_action: Optional[Literal["PREVIEW", "QUARANTINE_RELEASED", "MOVED"]]` Message actions to filter by. - `"PREVIEW"` - `"QUARANTINE_RELEASED"` - `"MOVED"` - `message_id: Optional[str]` - `metric: Optional[str]` - `page: Optional[int]` Deprecated: Use cursor pagination instead. End of life: November 1, 2026. - `per_page: Optional[int]` The number of results per page. Maximum value is 1000. - `query: Optional[str]` Space-delimited search term. Case-insensitive. - `recipient: Optional[str]` - `sender: Optional[str]` - `start: Optional[Union[str, datetime]]` The beginning of the search date range. Defaults to `now - 30 days`. - `subject: Optional[str]` ### Returns - `class InvestigateListResponse: …` - `id: str` Unique identifier for a message retrieved from investigation - `action_log: List[ActionLog]` Deprecated, use `GET /investigate/{investigate_id}/action_log` instead. End of life: November 1, 2026. - `completed_at: datetime` Timestamp when action completed - `operation: Literal["MOVE", "RELEASE", "RECLASSIFY", 3 more]` Type of action performed - `"MOVE"` - `"RELEASE"` - `"RECLASSIFY"` - `"SUBMISSION"` - `"QUARANTINE_RELEASE"` - `"PREVIEW"` - `completed_timestamp: Optional[str]` Deprecated, use `completed_at` instead. End of life: November 1, 2026. - `properties: Optional[ActionLogProperties]` Additional properties for the action - `folder: Optional[str]` Target folder for move operations - `requested_by: Optional[str]` User who requested the action - `status: Optional[str]` Status of the action - `client_recipients: List[str]` - `detection_reasons: List[str]` - `is_phish_submission: bool` - `is_quarantined: bool` - `postfix_id: str` The identifier of the message - `properties: Properties` Message processing properties - `allowlisted_pattern: Optional[str]` Pattern that allowlisted this message - `allowlisted_pattern_type: Optional[Literal["quarantine_release", "acceptable_sender", "allowed_sender", 5 more]]` Type of allowlist pattern - `"quarantine_release"` - `"acceptable_sender"` - `"allowed_sender"` - `"allowed_recipient"` - `"domain_similarity"` - `"domain_recency"` - `"managed_acceptable_sender"` - `"outbound_ndr"` - `blocklisted_message: Optional[bool]` Whether message was blocklisted - `blocklisted_pattern: Optional[str]` Pattern that blocklisted this message - `whitelisted_pattern_type: Optional[Literal["quarantine_release", "acceptable_sender", "allowed_sender", 5 more]]` Legacy field for allowlist pattern type - `"quarantine_release"` - `"acceptable_sender"` - `"allowed_sender"` - `"allowed_recipient"` - `"domain_similarity"` - `"domain_recency"` - `"managed_acceptable_sender"` - `"outbound_ndr"` - `ts: str` Deprecated, use `scanned_at` instead. End of life: November 1, 2026. - `alert_id: Optional[str]` - `delivery_mode: Optional[Literal["DIRECT", "BCC", "JOURNAL", 8 more]]` - `"DIRECT"` - `"BCC"` - `"JOURNAL"` - `"REVIEW_SUBMISSION"` - `"DMARC_UNVERIFIED"` - `"DMARC_FAILURE_REPORT"` - `"DMARC_AGGREGATE_REPORT"` - `"THREAT_INTEL_SUBMISSION"` - `"SIMULATION_SUBMISSION"` - `"API"` - `"RETRO_SCAN"` - `delivery_status: Optional[List[Literal["delivered", "moved", "quarantined", 4 more]]]` - `"delivered"` - `"moved"` - `"quarantined"` - `"rejected"` - `"deferred"` - `"bounced"` - `"queued"` - `edf_hash: Optional[str]` - `envelope_from: Optional[str]` - `envelope_to: Optional[List[str]]` - `final_disposition: Optional[Literal["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]` - `"MALICIOUS"` - `"MALICIOUS-BEC"` - `"SUSPICIOUS"` - `"SPOOF"` - `"SPAM"` - `"BULK"` - `"ENCRYPTED"` - `"EXTERNAL"` - `"UNKNOWN"` - `"NONE"` - `findings: Optional[List[Finding]]` Deprecated, use the `findings` field from `GET /investigate/{investigate_id}/detections` instead. End of life: November 1, 2026. Detection findings for this message. - `attachment: Optional[str]` - `detail: Optional[str]` - `detection: Optional[Literal["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]` - `"MALICIOUS"` - `"MALICIOUS-BEC"` - `"SUSPICIOUS"` - `"SPOOF"` - `"SPAM"` - `"BULK"` - `"ENCRYPTED"` - `"EXTERNAL"` - `"UNKNOWN"` - `"NONE"` - `field: Optional[str]` - `name: Optional[str]` - `portion: Optional[str]` - `reason: Optional[str]` - `score: Optional[float]` - `value: Optional[str]` - `from_: Optional[str]` - `from_name: Optional[str]` - `htmltext_structure_hash: Optional[str]` - `message_id: Optional[str]` - `post_delivery_operations: Optional[List[Literal["PREVIEW", "QUARANTINE_RELEASE", "SUBMISSION", "MOVE"]]]` Post-delivery operations performed on this message - `"PREVIEW"` - `"QUARANTINE_RELEASE"` - `"SUBMISSION"` - `"MOVE"` - `postfix_id_outbound: Optional[str]` - `replyto: Optional[str]` - `scanned_at: Optional[datetime]` When the message was scanned (UTC) - `sent_at: Optional[datetime]` When the message was sent (UTC) - `sent_date: Optional[str]` - `subject: Optional[str]` - `threat_categories: Optional[List[str]]` - `to: Optional[List[str]]` - `to_name: Optional[List[str]]` - `validation: Optional[Validation]` - `comment: Optional[str]` - `dkim: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` - `dmarc: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` - `spf: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.email_security.investigate.list( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) page = page.result[0] print(page.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "id": "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", "action_log": [ { "completed_at": "2019-12-27T18:11:19.117Z", "operation": "MOVE", "completed_timestamp": "completed_timestamp", "properties": { "folder": "folder", "requested_by": "requested_by" }, "status": "status" } ], "client_recipients": [ "string" ], "detection_reasons": [ "string" ], "is_phish_submission": true, "is_quarantined": true, "postfix_id": "4Njp3P0STMz2c02Q", "properties": { "allowlisted_pattern": "allowlisted_pattern", "allowlisted_pattern_type": "quarantine_release", "blocklisted_message": true, "blocklisted_pattern": "blocklisted_pattern", "whitelisted_pattern_type": "quarantine_release" }, "ts": "ts", "alert_id": "alert_id", "delivery_mode": "DIRECT", "delivery_status": [ "delivered" ], "edf_hash": "edf_hash", "envelope_from": "envelope_from", "envelope_to": [ "string" ], "final_disposition": "MALICIOUS", "findings": [ { "attachment": "attachment", "detail": "detail", "detection": "MALICIOUS", "field": "field", "name": "name", "portion": "portion", "reason": "reason", "score": 0, "value": "value" } ], "from": "from", "from_name": "from_name", "htmltext_structure_hash": "htmltext_structure_hash", "message_id": "message_id", "post_delivery_operations": [ "PREVIEW" ], "postfix_id_outbound": "postfix_id_outbound", "replyto": "replyto", "scanned_at": "2019-12-27T18:11:19.117Z", "sent_at": "2019-12-27T18:11:19.117Z", "sent_date": "sent_date", "subject": "subject", "threat_categories": [ "string" ], "to": [ "string" ], "to_name": [ "string" ], "validation": { "comment": "comment", "dkim": "pass", "dmarc": "pass", "spf": "pass" } } ], "result_info": { "count": 0, "per_page": 0, "total_count": 0, "next": "next", "page": 0, "previous": "previous" }, "success": true } ``` ## Get message details `email_security.investigate.get(strinvestigate_id, InvestigateGetParams**kwargs) -> InvestigateGetResponse` **get** `/accounts/{account_id}/email-security/investigate/{investigate_id}` Retrieves comprehensive details for a specific email message including headers, recipients, sender information, and current quarantine status. Use the investigate_id from search results to fetch detailed information. ### Parameters - `account_id: str` Identifier. - `investigate_id: str` Unique identifier for a message retrieved from investigation - `submission: Optional[bool]` When true, search the submissions datastore only. When false or omitted, search the regular datastore only. ### Returns - `class InvestigateGetResponse: …` - `id: str` Unique identifier for a message retrieved from investigation - `action_log: List[ActionLog]` Deprecated, use `GET /investigate/{investigate_id}/action_log` instead. End of life: November 1, 2026. - `completed_at: datetime` Timestamp when action completed - `operation: Literal["MOVE", "RELEASE", "RECLASSIFY", 3 more]` Type of action performed - `"MOVE"` - `"RELEASE"` - `"RECLASSIFY"` - `"SUBMISSION"` - `"QUARANTINE_RELEASE"` - `"PREVIEW"` - `completed_timestamp: Optional[str]` Deprecated, use `completed_at` instead. End of life: November 1, 2026. - `properties: Optional[ActionLogProperties]` Additional properties for the action - `folder: Optional[str]` Target folder for move operations - `requested_by: Optional[str]` User who requested the action - `status: Optional[str]` Status of the action - `client_recipients: List[str]` - `detection_reasons: List[str]` - `is_phish_submission: bool` - `is_quarantined: bool` - `postfix_id: str` The identifier of the message - `properties: Properties` Message processing properties - `allowlisted_pattern: Optional[str]` Pattern that allowlisted this message - `allowlisted_pattern_type: Optional[Literal["quarantine_release", "acceptable_sender", "allowed_sender", 5 more]]` Type of allowlist pattern - `"quarantine_release"` - `"acceptable_sender"` - `"allowed_sender"` - `"allowed_recipient"` - `"domain_similarity"` - `"domain_recency"` - `"managed_acceptable_sender"` - `"outbound_ndr"` - `blocklisted_message: Optional[bool]` Whether message was blocklisted - `blocklisted_pattern: Optional[str]` Pattern that blocklisted this message - `whitelisted_pattern_type: Optional[Literal["quarantine_release", "acceptable_sender", "allowed_sender", 5 more]]` Legacy field for allowlist pattern type - `"quarantine_release"` - `"acceptable_sender"` - `"allowed_sender"` - `"allowed_recipient"` - `"domain_similarity"` - `"domain_recency"` - `"managed_acceptable_sender"` - `"outbound_ndr"` - `ts: str` Deprecated, use `scanned_at` instead. End of life: November 1, 2026. - `alert_id: Optional[str]` - `delivery_mode: Optional[Literal["DIRECT", "BCC", "JOURNAL", 8 more]]` - `"DIRECT"` - `"BCC"` - `"JOURNAL"` - `"REVIEW_SUBMISSION"` - `"DMARC_UNVERIFIED"` - `"DMARC_FAILURE_REPORT"` - `"DMARC_AGGREGATE_REPORT"` - `"THREAT_INTEL_SUBMISSION"` - `"SIMULATION_SUBMISSION"` - `"API"` - `"RETRO_SCAN"` - `delivery_status: Optional[List[Literal["delivered", "moved", "quarantined", 4 more]]]` - `"delivered"` - `"moved"` - `"quarantined"` - `"rejected"` - `"deferred"` - `"bounced"` - `"queued"` - `edf_hash: Optional[str]` - `envelope_from: Optional[str]` - `envelope_to: Optional[List[str]]` - `final_disposition: Optional[Literal["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]` - `"MALICIOUS"` - `"MALICIOUS-BEC"` - `"SUSPICIOUS"` - `"SPOOF"` - `"SPAM"` - `"BULK"` - `"ENCRYPTED"` - `"EXTERNAL"` - `"UNKNOWN"` - `"NONE"` - `findings: Optional[List[Finding]]` Deprecated, use the `findings` field from `GET /investigate/{investigate_id}/detections` instead. End of life: November 1, 2026. Detection findings for this message. - `attachment: Optional[str]` - `detail: Optional[str]` - `detection: Optional[Literal["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]` - `"MALICIOUS"` - `"MALICIOUS-BEC"` - `"SUSPICIOUS"` - `"SPOOF"` - `"SPAM"` - `"BULK"` - `"ENCRYPTED"` - `"EXTERNAL"` - `"UNKNOWN"` - `"NONE"` - `field: Optional[str]` - `name: Optional[str]` - `portion: Optional[str]` - `reason: Optional[str]` - `score: Optional[float]` - `value: Optional[str]` - `from_: Optional[str]` - `from_name: Optional[str]` - `htmltext_structure_hash: Optional[str]` - `message_id: Optional[str]` - `post_delivery_operations: Optional[List[Literal["PREVIEW", "QUARANTINE_RELEASE", "SUBMISSION", "MOVE"]]]` Post-delivery operations performed on this message - `"PREVIEW"` - `"QUARANTINE_RELEASE"` - `"SUBMISSION"` - `"MOVE"` - `postfix_id_outbound: Optional[str]` - `replyto: Optional[str]` - `scanned_at: Optional[datetime]` When the message was scanned (UTC) - `sent_at: Optional[datetime]` When the message was sent (UTC) - `sent_date: Optional[str]` - `subject: Optional[str]` - `threat_categories: Optional[List[str]]` - `to: Optional[List[str]]` - `to_name: Optional[List[str]]` - `validation: Optional[Validation]` - `comment: Optional[str]` - `dkim: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` - `dmarc: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` - `spf: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) investigate = client.email_security.investigate.get( investigate_id="4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(investigate.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "id": "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", "action_log": [ { "completed_at": "2019-12-27T18:11:19.117Z", "operation": "MOVE", "completed_timestamp": "completed_timestamp", "properties": { "folder": "folder", "requested_by": "requested_by" }, "status": "status" } ], "client_recipients": [ "string" ], "detection_reasons": [ "string" ], "is_phish_submission": true, "is_quarantined": true, "postfix_id": "4Njp3P0STMz2c02Q", "properties": { "allowlisted_pattern": "allowlisted_pattern", "allowlisted_pattern_type": "quarantine_release", "blocklisted_message": true, "blocklisted_pattern": "blocklisted_pattern", "whitelisted_pattern_type": "quarantine_release" }, "ts": "ts", "alert_id": "alert_id", "delivery_mode": "DIRECT", "delivery_status": [ "delivered" ], "edf_hash": "edf_hash", "envelope_from": "envelope_from", "envelope_to": [ "string" ], "final_disposition": "MALICIOUS", "findings": [ { "attachment": "attachment", "detail": "detail", "detection": "MALICIOUS", "field": "field", "name": "name", "portion": "portion", "reason": "reason", "score": 0, "value": "value" } ], "from": "from", "from_name": "from_name", "htmltext_structure_hash": "htmltext_structure_hash", "message_id": "message_id", "post_delivery_operations": [ "PREVIEW" ], "postfix_id_outbound": "postfix_id_outbound", "replyto": "replyto", "scanned_at": "2019-12-27T18:11:19.117Z", "sent_at": "2019-12-27T18:11:19.117Z", "sent_date": "sent_date", "subject": "subject", "threat_categories": [ "string" ], "to": [ "string" ], "to_name": [ "string" ], "validation": { "comment": "comment", "dkim": "pass", "dmarc": "pass", "spf": "pass" } }, "success": true } ``` ## Domain Types ### Investigate List Response - `class InvestigateListResponse: …` - `id: str` Unique identifier for a message retrieved from investigation - `action_log: List[ActionLog]` Deprecated, use `GET /investigate/{investigate_id}/action_log` instead. End of life: November 1, 2026. - `completed_at: datetime` Timestamp when action completed - `operation: Literal["MOVE", "RELEASE", "RECLASSIFY", 3 more]` Type of action performed - `"MOVE"` - `"RELEASE"` - `"RECLASSIFY"` - `"SUBMISSION"` - `"QUARANTINE_RELEASE"` - `"PREVIEW"` - `completed_timestamp: Optional[str]` Deprecated, use `completed_at` instead. End of life: November 1, 2026. - `properties: Optional[ActionLogProperties]` Additional properties for the action - `folder: Optional[str]` Target folder for move operations - `requested_by: Optional[str]` User who requested the action - `status: Optional[str]` Status of the action - `client_recipients: List[str]` - `detection_reasons: List[str]` - `is_phish_submission: bool` - `is_quarantined: bool` - `postfix_id: str` The identifier of the message - `properties: Properties` Message processing properties - `allowlisted_pattern: Optional[str]` Pattern that allowlisted this message - `allowlisted_pattern_type: Optional[Literal["quarantine_release", "acceptable_sender", "allowed_sender", 5 more]]` Type of allowlist pattern - `"quarantine_release"` - `"acceptable_sender"` - `"allowed_sender"` - `"allowed_recipient"` - `"domain_similarity"` - `"domain_recency"` - `"managed_acceptable_sender"` - `"outbound_ndr"` - `blocklisted_message: Optional[bool]` Whether message was blocklisted - `blocklisted_pattern: Optional[str]` Pattern that blocklisted this message - `whitelisted_pattern_type: Optional[Literal["quarantine_release", "acceptable_sender", "allowed_sender", 5 more]]` Legacy field for allowlist pattern type - `"quarantine_release"` - `"acceptable_sender"` - `"allowed_sender"` - `"allowed_recipient"` - `"domain_similarity"` - `"domain_recency"` - `"managed_acceptable_sender"` - `"outbound_ndr"` - `ts: str` Deprecated, use `scanned_at` instead. End of life: November 1, 2026. - `alert_id: Optional[str]` - `delivery_mode: Optional[Literal["DIRECT", "BCC", "JOURNAL", 8 more]]` - `"DIRECT"` - `"BCC"` - `"JOURNAL"` - `"REVIEW_SUBMISSION"` - `"DMARC_UNVERIFIED"` - `"DMARC_FAILURE_REPORT"` - `"DMARC_AGGREGATE_REPORT"` - `"THREAT_INTEL_SUBMISSION"` - `"SIMULATION_SUBMISSION"` - `"API"` - `"RETRO_SCAN"` - `delivery_status: Optional[List[Literal["delivered", "moved", "quarantined", 4 more]]]` - `"delivered"` - `"moved"` - `"quarantined"` - `"rejected"` - `"deferred"` - `"bounced"` - `"queued"` - `edf_hash: Optional[str]` - `envelope_from: Optional[str]` - `envelope_to: Optional[List[str]]` - `final_disposition: Optional[Literal["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]` - `"MALICIOUS"` - `"MALICIOUS-BEC"` - `"SUSPICIOUS"` - `"SPOOF"` - `"SPAM"` - `"BULK"` - `"ENCRYPTED"` - `"EXTERNAL"` - `"UNKNOWN"` - `"NONE"` - `findings: Optional[List[Finding]]` Deprecated, use the `findings` field from `GET /investigate/{investigate_id}/detections` instead. End of life: November 1, 2026. Detection findings for this message. - `attachment: Optional[str]` - `detail: Optional[str]` - `detection: Optional[Literal["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]` - `"MALICIOUS"` - `"MALICIOUS-BEC"` - `"SUSPICIOUS"` - `"SPOOF"` - `"SPAM"` - `"BULK"` - `"ENCRYPTED"` - `"EXTERNAL"` - `"UNKNOWN"` - `"NONE"` - `field: Optional[str]` - `name: Optional[str]` - `portion: Optional[str]` - `reason: Optional[str]` - `score: Optional[float]` - `value: Optional[str]` - `from_: Optional[str]` - `from_name: Optional[str]` - `htmltext_structure_hash: Optional[str]` - `message_id: Optional[str]` - `post_delivery_operations: Optional[List[Literal["PREVIEW", "QUARANTINE_RELEASE", "SUBMISSION", "MOVE"]]]` Post-delivery operations performed on this message - `"PREVIEW"` - `"QUARANTINE_RELEASE"` - `"SUBMISSION"` - `"MOVE"` - `postfix_id_outbound: Optional[str]` - `replyto: Optional[str]` - `scanned_at: Optional[datetime]` When the message was scanned (UTC) - `sent_at: Optional[datetime]` When the message was sent (UTC) - `sent_date: Optional[str]` - `subject: Optional[str]` - `threat_categories: Optional[List[str]]` - `to: Optional[List[str]]` - `to_name: Optional[List[str]]` - `validation: Optional[Validation]` - `comment: Optional[str]` - `dkim: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` - `dmarc: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` - `spf: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` ### Investigate Get Response - `class InvestigateGetResponse: …` - `id: str` Unique identifier for a message retrieved from investigation - `action_log: List[ActionLog]` Deprecated, use `GET /investigate/{investigate_id}/action_log` instead. End of life: November 1, 2026. - `completed_at: datetime` Timestamp when action completed - `operation: Literal["MOVE", "RELEASE", "RECLASSIFY", 3 more]` Type of action performed - `"MOVE"` - `"RELEASE"` - `"RECLASSIFY"` - `"SUBMISSION"` - `"QUARANTINE_RELEASE"` - `"PREVIEW"` - `completed_timestamp: Optional[str]` Deprecated, use `completed_at` instead. End of life: November 1, 2026. - `properties: Optional[ActionLogProperties]` Additional properties for the action - `folder: Optional[str]` Target folder for move operations - `requested_by: Optional[str]` User who requested the action - `status: Optional[str]` Status of the action - `client_recipients: List[str]` - `detection_reasons: List[str]` - `is_phish_submission: bool` - `is_quarantined: bool` - `postfix_id: str` The identifier of the message - `properties: Properties` Message processing properties - `allowlisted_pattern: Optional[str]` Pattern that allowlisted this message - `allowlisted_pattern_type: Optional[Literal["quarantine_release", "acceptable_sender", "allowed_sender", 5 more]]` Type of allowlist pattern - `"quarantine_release"` - `"acceptable_sender"` - `"allowed_sender"` - `"allowed_recipient"` - `"domain_similarity"` - `"domain_recency"` - `"managed_acceptable_sender"` - `"outbound_ndr"` - `blocklisted_message: Optional[bool]` Whether message was blocklisted - `blocklisted_pattern: Optional[str]` Pattern that blocklisted this message - `whitelisted_pattern_type: Optional[Literal["quarantine_release", "acceptable_sender", "allowed_sender", 5 more]]` Legacy field for allowlist pattern type - `"quarantine_release"` - `"acceptable_sender"` - `"allowed_sender"` - `"allowed_recipient"` - `"domain_similarity"` - `"domain_recency"` - `"managed_acceptable_sender"` - `"outbound_ndr"` - `ts: str` Deprecated, use `scanned_at` instead. End of life: November 1, 2026. - `alert_id: Optional[str]` - `delivery_mode: Optional[Literal["DIRECT", "BCC", "JOURNAL", 8 more]]` - `"DIRECT"` - `"BCC"` - `"JOURNAL"` - `"REVIEW_SUBMISSION"` - `"DMARC_UNVERIFIED"` - `"DMARC_FAILURE_REPORT"` - `"DMARC_AGGREGATE_REPORT"` - `"THREAT_INTEL_SUBMISSION"` - `"SIMULATION_SUBMISSION"` - `"API"` - `"RETRO_SCAN"` - `delivery_status: Optional[List[Literal["delivered", "moved", "quarantined", 4 more]]]` - `"delivered"` - `"moved"` - `"quarantined"` - `"rejected"` - `"deferred"` - `"bounced"` - `"queued"` - `edf_hash: Optional[str]` - `envelope_from: Optional[str]` - `envelope_to: Optional[List[str]]` - `final_disposition: Optional[Literal["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]` - `"MALICIOUS"` - `"MALICIOUS-BEC"` - `"SUSPICIOUS"` - `"SPOOF"` - `"SPAM"` - `"BULK"` - `"ENCRYPTED"` - `"EXTERNAL"` - `"UNKNOWN"` - `"NONE"` - `findings: Optional[List[Finding]]` Deprecated, use the `findings` field from `GET /investigate/{investigate_id}/detections` instead. End of life: November 1, 2026. Detection findings for this message. - `attachment: Optional[str]` - `detail: Optional[str]` - `detection: Optional[Literal["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]` - `"MALICIOUS"` - `"MALICIOUS-BEC"` - `"SUSPICIOUS"` - `"SPOOF"` - `"SPAM"` - `"BULK"` - `"ENCRYPTED"` - `"EXTERNAL"` - `"UNKNOWN"` - `"NONE"` - `field: Optional[str]` - `name: Optional[str]` - `portion: Optional[str]` - `reason: Optional[str]` - `score: Optional[float]` - `value: Optional[str]` - `from_: Optional[str]` - `from_name: Optional[str]` - `htmltext_structure_hash: Optional[str]` - `message_id: Optional[str]` - `post_delivery_operations: Optional[List[Literal["PREVIEW", "QUARANTINE_RELEASE", "SUBMISSION", "MOVE"]]]` Post-delivery operations performed on this message - `"PREVIEW"` - `"QUARANTINE_RELEASE"` - `"SUBMISSION"` - `"MOVE"` - `postfix_id_outbound: Optional[str]` - `replyto: Optional[str]` - `scanned_at: Optional[datetime]` When the message was scanned (UTC) - `sent_at: Optional[datetime]` When the message was sent (UTC) - `sent_date: Optional[str]` - `subject: Optional[str]` - `threat_categories: Optional[List[str]]` - `to: Optional[List[str]]` - `to_name: Optional[List[str]]` - `validation: Optional[Validation]` - `comment: Optional[str]` - `dkim: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` - `dmarc: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` - `spf: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` # Detections ## Get message detection details `email_security.investigate.detections.get(strinvestigate_id, DetectionGetParams**kwargs) -> DetectionGetResponse` **get** `/accounts/{account_id}/email-security/investigate/{investigate_id}/detections` Returns detection details such as threat categories and sender information for non-benign messages. ### Parameters - `account_id: str` Identifier. - `investigate_id: str` Unique identifier for a message retrieved from investigation ### Returns - `class DetectionGetResponse: …` - `action: str` - `attachments: List[Attachment]` - `size: int` Size of the attachment in bytes - `content_type: Optional[str]` MIME type of the attachment - `detection: Optional[Literal["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]` Detection result for this attachment - `"MALICIOUS"` - `"MALICIOUS-BEC"` - `"SUSPICIOUS"` - `"SPOOF"` - `"SPAM"` - `"BULK"` - `"ENCRYPTED"` - `"EXTERNAL"` - `"UNKNOWN"` - `"NONE"` - `encrypted: Optional[bool]` Whether the attachment is encrypted - `filename: Optional[str]` Name of the attached file - `md5: Optional[str]` MD5 hash of the attachment - `name: Optional[str]` Attachment name (alternative to filename) - `sha1: Optional[str]` SHA1 hash of the attachment - `sha256: Optional[str]` SHA256 hash of the attachment - `findings: Optional[List[Finding]]` - `attachment: Optional[str]` - `detail: Optional[str]` - `detection: Optional[Literal["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]` - `"MALICIOUS"` - `"MALICIOUS-BEC"` - `"SUSPICIOUS"` - `"SPOOF"` - `"SPAM"` - `"BULK"` - `"ENCRYPTED"` - `"EXTERNAL"` - `"UNKNOWN"` - `"NONE"` - `field: Optional[str]` - `name: Optional[str]` - `portion: Optional[str]` - `reason: Optional[str]` - `score: Optional[float]` - `value: Optional[str]` - `headers: List[Header]` - `name: str` - `value: str` - `links: List[Link]` - `href: str` - `text: Optional[str]` - `sender_info: SenderInfo` - `as_name: Optional[str]` The name of the autonomous system. - `as_number: Optional[int]` The number of the autonomous system. - `geo: Optional[str]` - `ip: Optional[str]` - `pld: Optional[str]` - `threat_categories: List[ThreatCategory]` - `id: Optional[int]` - `description: Optional[str]` - `name: Optional[str]` - `validation: Validation` - `comment: Optional[str]` - `dkim: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` - `dmarc: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` - `spf: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` - `final_disposition: Optional[Literal["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]` - `"MALICIOUS"` - `"MALICIOUS-BEC"` - `"SUSPICIOUS"` - `"SPOOF"` - `"SPAM"` - `"BULK"` - `"ENCRYPTED"` - `"EXTERNAL"` - `"UNKNOWN"` - `"NONE"` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) detection = client.email_security.investigate.detections.get( investigate_id="4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(detection.validation) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "action": "action", "attachments": [ { "size": 0, "content_type": "content_type", "detection": "MALICIOUS", "encrypted": true, "filename": "filename", "md5": "md5", "name": "name", "sha1": "sha1", "sha256": "sha256" } ], "findings": [ { "attachment": "attachment", "detail": "detail", "detection": "MALICIOUS", "field": "field", "name": "name", "portion": "portion", "reason": "reason", "score": 0, "value": "value" } ], "headers": [ { "name": "name", "value": "value" } ], "links": [ { "href": "href", "text": "text" } ], "sender_info": { "as_name": "as_name", "as_number": 0, "geo": "geo", "ip": "ip", "pld": "pld" }, "threat_categories": [ { "id": 0, "description": "description", "name": "name" } ], "validation": { "comment": "comment", "dkim": "pass", "dmarc": "pass", "spf": "pass" }, "final_disposition": "MALICIOUS" }, "success": true } ``` ## Domain Types ### Detection Get Response - `class DetectionGetResponse: …` - `action: str` - `attachments: List[Attachment]` - `size: int` Size of the attachment in bytes - `content_type: Optional[str]` MIME type of the attachment - `detection: Optional[Literal["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]` Detection result for this attachment - `"MALICIOUS"` - `"MALICIOUS-BEC"` - `"SUSPICIOUS"` - `"SPOOF"` - `"SPAM"` - `"BULK"` - `"ENCRYPTED"` - `"EXTERNAL"` - `"UNKNOWN"` - `"NONE"` - `encrypted: Optional[bool]` Whether the attachment is encrypted - `filename: Optional[str]` Name of the attached file - `md5: Optional[str]` MD5 hash of the attachment - `name: Optional[str]` Attachment name (alternative to filename) - `sha1: Optional[str]` SHA1 hash of the attachment - `sha256: Optional[str]` SHA256 hash of the attachment - `findings: Optional[List[Finding]]` - `attachment: Optional[str]` - `detail: Optional[str]` - `detection: Optional[Literal["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]` - `"MALICIOUS"` - `"MALICIOUS-BEC"` - `"SUSPICIOUS"` - `"SPOOF"` - `"SPAM"` - `"BULK"` - `"ENCRYPTED"` - `"EXTERNAL"` - `"UNKNOWN"` - `"NONE"` - `field: Optional[str]` - `name: Optional[str]` - `portion: Optional[str]` - `reason: Optional[str]` - `score: Optional[float]` - `value: Optional[str]` - `headers: List[Header]` - `name: str` - `value: str` - `links: List[Link]` - `href: str` - `text: Optional[str]` - `sender_info: SenderInfo` - `as_name: Optional[str]` The name of the autonomous system. - `as_number: Optional[int]` The number of the autonomous system. - `geo: Optional[str]` - `ip: Optional[str]` - `pld: Optional[str]` - `threat_categories: List[ThreatCategory]` - `id: Optional[int]` - `description: Optional[str]` - `name: Optional[str]` - `validation: Validation` - `comment: Optional[str]` - `dkim: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` - `dmarc: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` - `spf: Optional[Literal["pass", "neutral", "fail", 2 more]]` - `"pass"` - `"neutral"` - `"fail"` - `"error"` - `"none"` - `final_disposition: Optional[Literal["MALICIOUS", "MALICIOUS-BEC", "SUSPICIOUS", 7 more]]` - `"MALICIOUS"` - `"MALICIOUS-BEC"` - `"SUSPICIOUS"` - `"SPOOF"` - `"SPAM"` - `"BULK"` - `"ENCRYPTED"` - `"EXTERNAL"` - `"UNKNOWN"` - `"NONE"` # Preview ## Get email preview `email_security.investigate.preview.get(strinvestigate_id, PreviewGetParams**kwargs) -> PreviewGetResponse` **get** `/accounts/{account_id}/email-security/investigate/{investigate_id}/preview` Returns a preview of the message body as a base64 encoded PNG image for non-benign messages. ### Parameters - `account_id: str` Identifier. - `investigate_id: str` Unique identifier for a message retrieved from investigation ### Returns - `class PreviewGetResponse: …` - `screenshot: str` A base64 encoded PNG image of the email. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) preview = client.email_security.investigate.preview.get( investigate_id="4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(preview.screenshot) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "screenshot": "screenshot" }, "success": true } ``` ## Preview for non-detection messages `email_security.investigate.preview.create(PreviewCreateParams**kwargs) -> PreviewCreateResponse` **post** `/accounts/{account_id}/email-security/investigate/preview` Generates a preview image for a message that was not flagged as a detection. Useful for investigating benign messages. Returns a base64-encoded PNG screenshot of the email body. ### Parameters - `account_id: str` Identifier. - `postfix_id: str` The identifier of the message ### Returns - `class PreviewCreateResponse: …` - `screenshot: str` A base64 encoded PNG image of the email. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) preview = client.email_security.investigate.preview.create( account_id="023e105f4ecef8ad9ca31a8372d0c353", postfix_id="4Njp3P0STMz2c02Q", ) print(preview.screenshot) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "screenshot": "screenshot" }, "success": true } ``` ## Domain Types ### Preview Get Response - `class PreviewGetResponse: …` - `screenshot: str` A base64 encoded PNG image of the email. ### Preview Create Response - `class PreviewCreateResponse: …` - `screenshot: str` A base64 encoded PNG image of the email. # Raw ## Get raw email content `email_security.investigate.raw.get(strinvestigate_id, RawGetParams**kwargs) -> RawGetResponse` **get** `/accounts/{account_id}/email-security/investigate/{investigate_id}/raw` Returns the raw eml of any non-benign message. ### Parameters - `account_id: str` Identifier. - `investigate_id: str` Unique identifier for a message retrieved from investigation ### Returns - `class RawGetResponse: …` - `raw: str` A UTF-8 encoded eml file of the email. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) raw = client.email_security.investigate.raw.get( investigate_id="4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(raw.raw) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "raw": "raw" }, "success": true } ``` ## Domain Types ### Raw Get Response - `class RawGetResponse: …` - `raw: str` A UTF-8 encoded eml file of the email. # Trace ## Get email trace `email_security.investigate.trace.get(strinvestigate_id, TraceGetParams**kwargs) -> TraceGetResponse` **get** `/accounts/{account_id}/email-security/investigate/{investigate_id}/trace` Retrieves delivery and processing trace information for an email message. Shows the delivery path, retraction history, and move operations performed on the message. Useful for debugging delivery issues. ### Parameters - `account_id: str` Identifier. - `investigate_id: str` Unique identifier for a message retrieved from investigation ### Returns - `class TraceGetResponse: …` - `inbound: Inbound` - `lines: Optional[List[InboundLine]]` - `lineno: Optional[int]` Line number in the trace log - `logged_at: Optional[datetime]` - `message: Optional[str]` - `ts: Optional[str]` Deprecated, use `logged_at` instead. End of life: November 1, 2026. - `pending: Optional[bool]` - `outbound: Outbound` - `lines: Optional[List[OutboundLine]]` - `lineno: Optional[int]` Line number in the trace log - `logged_at: Optional[datetime]` - `message: Optional[str]` - `ts: Optional[str]` Deprecated, use `logged_at` instead. End of life: November 1, 2026. - `pending: Optional[bool]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) trace = client.email_security.investigate.trace.get( investigate_id="4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(trace.inbound) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "inbound": { "lines": [ { "lineno": 0, "logged_at": "2019-12-27T18:11:19.117Z", "message": "message", "ts": "ts" } ], "pending": true }, "outbound": { "lines": [ { "lineno": 0, "logged_at": "2019-12-27T18:11:19.117Z", "message": "message", "ts": "ts" } ], "pending": true } }, "success": true } ``` ## Domain Types ### Trace Get Response - `class TraceGetResponse: …` - `inbound: Inbound` - `lines: Optional[List[InboundLine]]` - `lineno: Optional[int]` Line number in the trace log - `logged_at: Optional[datetime]` - `message: Optional[str]` - `ts: Optional[str]` Deprecated, use `logged_at` instead. End of life: November 1, 2026. - `pending: Optional[bool]` - `outbound: Outbound` - `lines: Optional[List[OutboundLine]]` - `lineno: Optional[int]` Line number in the trace log - `logged_at: Optional[datetime]` - `message: Optional[str]` - `ts: Optional[str]` Deprecated, use `logged_at` instead. End of life: November 1, 2026. - `pending: Optional[bool]` # Move ## Move a message `email_security.investigate.move.create(strinvestigate_id, MoveCreateParams**kwargs) -> SyncSinglePage[MoveCreateResponse]` **post** `/accounts/{account_id}/email-security/investigate/{investigate_id}/move` Moves a single message to a specified mailbox folder (Inbox, JunkEmail, DeletedItems, RecoverableItemsDeletions, or RecoverableItemsPurges). Requires active integration. ### Parameters - `account_id: str` Identifier. - `investigate_id: str` Unique identifier for a message retrieved from investigation - `destination: Literal["Inbox", "JunkEmail", "DeletedItems", 2 more]` - `"Inbox"` - `"JunkEmail"` - `"DeletedItems"` - `"RecoverableItemsDeletions"` - `"RecoverableItemsPurges"` ### Returns - `class MoveCreateResponse: …` - `success: bool` Whether the operation succeeded - `completed_at: Optional[datetime]` When the move operation completed (UTC) - `completed_timestamp: Optional[datetime]` Deprecated, use `completed_at` instead. End of life: November 1, 2026. - `destination: Optional[str]` Destination folder for the message - `item_count: Optional[int]` Number of items moved. End of life: November 1, 2026. - `message_id: Optional[str]` Message identifier - `operation: Optional[str]` Type of operation performed - `recipient: Optional[str]` Recipient email address - `status: Optional[str]` Operation status ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.email_security.investigate.move.create( investigate_id="4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", account_id="023e105f4ecef8ad9ca31a8372d0c353", destination="Inbox", ) page = page.result[0] print(page.message_id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "success": true, "completed_at": "2019-12-27T18:11:19.117Z", "completed_timestamp": "2019-12-27T18:11:19.117Z", "destination": "destination", "item_count": 0, "message_id": "message_id", "operation": "operation", "recipient": "recipient", "status": "status" } ], "success": true } ``` ## Move multiple messages `email_security.investigate.move.bulk(MoveBulkParams**kwargs) -> SyncSinglePage[MoveBulkResponse]` **post** `/accounts/{account_id}/email-security/investigate/move` Moves multiple messages to a specified mailbox folder (Inbox, JunkEmail, DeletedItems, RecoverableItemsDeletions, or RecoverableItemsPurges). Requires active integration. ### Parameters - `account_id: str` Identifier. - `destination: Literal["Inbox", "JunkEmail", "DeletedItems", 2 more]` - `"Inbox"` - `"JunkEmail"` - `"DeletedItems"` - `"RecoverableItemsDeletions"` - `"RecoverableItemsPurges"` - `ids: Optional[Sequence[str]]` List of message IDs to move - `postfix_ids: Optional[Sequence[str]]` Deprecated, use `ids` instead. End of life: November 1, 2026. List of message IDs to move. ### Returns - `class MoveBulkResponse: …` - `success: bool` Whether the operation succeeded - `completed_at: Optional[datetime]` When the move operation completed (UTC) - `completed_timestamp: Optional[datetime]` Deprecated, use `completed_at` instead. End of life: November 1, 2026. - `destination: Optional[str]` Destination folder for the message - `item_count: Optional[int]` Number of items moved. End of life: November 1, 2026. - `message_id: Optional[str]` Message identifier - `operation: Optional[str]` Type of operation performed - `recipient: Optional[str]` Recipient email address - `status: Optional[str]` Operation status ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.email_security.investigate.move.bulk( account_id="023e105f4ecef8ad9ca31a8372d0c353", destination="Inbox", ) page = page.result[0] print(page.message_id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "success": true, "completed_at": "2019-12-27T18:11:19.117Z", "completed_timestamp": "2019-12-27T18:11:19.117Z", "destination": "destination", "item_count": 0, "message_id": "message_id", "operation": "operation", "recipient": "recipient", "status": "status" } ], "success": true } ``` ## Domain Types ### Move Create Response - `class MoveCreateResponse: …` - `success: bool` Whether the operation succeeded - `completed_at: Optional[datetime]` When the move operation completed (UTC) - `completed_timestamp: Optional[datetime]` Deprecated, use `completed_at` instead. End of life: November 1, 2026. - `destination: Optional[str]` Destination folder for the message - `item_count: Optional[int]` Number of items moved. End of life: November 1, 2026. - `message_id: Optional[str]` Message identifier - `operation: Optional[str]` Type of operation performed - `recipient: Optional[str]` Recipient email address - `status: Optional[str]` Operation status ### Move Bulk Response - `class MoveBulkResponse: …` - `success: bool` Whether the operation succeeded - `completed_at: Optional[datetime]` When the move operation completed (UTC) - `completed_timestamp: Optional[datetime]` Deprecated, use `completed_at` instead. End of life: November 1, 2026. - `destination: Optional[str]` Destination folder for the message - `item_count: Optional[int]` Number of items moved. End of life: November 1, 2026. - `message_id: Optional[str]` Message identifier - `operation: Optional[str]` Type of operation performed - `recipient: Optional[str]` Recipient email address - `status: Optional[str]` Operation status # Reclassify ## Change email classification `email_security.investigate.reclassify.create(strinvestigate_id, ReclassifyCreateParams**kwargs) -> object` **post** `/accounts/{account_id}/email-security/investigate/{investigate_id}/reclassify` Submits a request to reclassify an email's disposition. Use for reporting false positives or false negatives. Optionally provide the raw EML content for reanalysis. The reclassification is processed asynchronously. ### Parameters - `account_id: str` Identifier. - `investigate_id: str` Unique identifier for a message retrieved from investigation - `expected_disposition: Literal["NONE", "BULK", "MALICIOUS", 3 more]` - `"NONE"` - `"BULK"` - `"MALICIOUS"` - `"SPAM"` - `"SPOOF"` - `"SUSPICIOUS"` - `eml_content: Optional[str]` Base64 encoded content of the EML file. - `escalated_submission_id: Optional[str]` ### Returns - `object` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) reclassify = client.email_security.investigate.reclassify.create( investigate_id="4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", account_id="023e105f4ecef8ad9ca31a8372d0c353", expected_disposition="NONE", ) print(reclassify) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": {}, "success": true } ``` # Release ## Release messages from quarantine `email_security.investigate.release.bulk(ReleaseBulkParams**kwargs) -> SyncSinglePage[ReleaseBulkResponse]` **post** `/accounts/{account_id}/email-security/investigate/release` Releases one or more quarantined messages, delivering them to the intended recipients. Use when a message was incorrectly quarantined. Returns delivery status for each recipient. ### Parameters - `account_id: str` Identifier. - `body: Sequence[str]` ### Returns - `class ReleaseBulkResponse: …` - `id: str` Unique identifier for a message retrieved from investigation - `delivered: Optional[List[str]]` - `failed: Optional[List[str]]` - `postfix_id: Optional[str]` Deprecated, use `id` instead. End of life: November 1, 2026. - `undelivered: Optional[List[str]]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.email_security.investigate.release.bulk( account_id="023e105f4ecef8ad9ca31a8372d0c353", body=["4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678"], ) page = page.result[0] print(page.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "id": "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", "delivered": [ "string" ], "failed": [ "string" ], "postfix_id": "4Njp3P0STMz2c02Q", "undelivered": [ "string" ] } ], "success": true } ``` ## Domain Types ### Release Bulk Response - `class ReleaseBulkResponse: …` - `id: str` Unique identifier for a message retrieved from investigation - `delivered: Optional[List[str]]` - `failed: Optional[List[str]]` - `postfix_id: Optional[str]` Deprecated, use `id` instead. End of life: November 1, 2026. - `undelivered: Optional[List[str]]`