POST /accounts/{account_id}/email-security/investigate/bulk

Creates a new bulk action job to move or release messages that match the provided search parameters.

Servers

https://api.cloudflare.com/client/v4

Path parameters

Name	Type	Required	Description
`account_id`	String	Yes	Account identifier tag.

Request headers

Name	Type	Required	Description
`Content-Type`	String	Yes	The media type of the request body. Default value: "application/json"

Request body fields

Name	Type	Required	Description
`expected_disposition`	String	No	Valid values: `"SUSPICIOUS"` `"BULK"` `"ENCRYPTED"` `"MALICIOUS-BEC"` `"UNKNOWN"` `"SPOOF"` `"EXTERNAL"` `"MALICIOUS"` `"SPAM"` `"NONE"`
`comment`	String	No
`action`	String	Yes	Valid values: `"MOVE"` `"RELEASE"`
`destination`	String	No	Valid values: `"DeletedItems"` `"JunkEmail"` `"RecoverableItemsPurges"` `"RecoverableItemsDeletions"` `"Inbox"`
`search_params`	Object	Yes
`search_params.exact_subject`	String	No
`search_params.metric`	String	No
`search_params.detections_only`	Boolean	No	Default value: true
`search_params.domain`	String	No
`search_params.sender`	String	No
`search_params.subject`	String	No
`search_params.submissions`	Boolean	No	Default value: false
`search_params.final_disposition`	String	No	Valid values: `"SUSPICIOUS"` `"BULK"` `"ENCRYPTED"` `"MALICIOUS-BEC"` `"UNKNOWN"` `"SPOOF"` `"EXTERNAL"` `"MALICIOUS"` `"SPAM"` `"NONE"`
`search_params.recipient`	String	No
`search_params.delivery_status`	String	No	Delivery status of the message. Valid values: `"deferred"` `"moved"` `"queued"` `"bounced"` `"rejected"` `"delivered"` `"quarantined"`
`search_params.end`	String	No	End of search date range
`search_params.message_id`	String	No
`search_params.query`	String	No
`search_params.action_log`	Boolean	No	Deprecated, use `GET /investigate/{investigate_id}/action_log` instead. End of life: November 1, 2026. Default value: false
`search_params.alert_id`	String	No
`search_params.start`	String	No	Beginning of search date range
`search_params.message_action`	String	No	Valid values: `"QUARANTINE_RELEASED"` `"MOVED"` `"PREVIEW"`

How to start integrating

Add HTTP Task to your workflow definition.
Search for the API you want to integrate with and click on the name.
- This loads the API reference documentation and prepares the Http request settings.
Click Test request to test run your request to the API and see the API's response.