GET /accounts/{account_id}/email-security/investigate

Returns information for each email that matches the search parameter(s).

Servers

Path parameters

Name Type Required Description
account_id String Yes

Account identifier tag.

Query parameters

Name Type Required Description
metric String No
detections_only Boolean No

Whether to include only detections in search results.

Default value: true

sender String No
domain String No

Sender domains to filter by.

subject String No
final_disposition String No

Dispositions to filter by.

Valid values:

  • "SUSPICIOUS"
  • "BULK"
  • "SPOOF"
  • "MALICIOUS"
  • "SPAM"
  • "NONE"
recipient String No
page Integer No

Deprecated: Use cursor pagination instead. End of life: November 1, 2026.

Default value: 1

end String No

The end of the search date range. Defaults to now.

message_id String No
delivery_status String No

Delivery status to filter by.

Valid values:

  • "deferred"
  • "moved"
  • "queued"
  • "bounced"
  • "rejected"
  • "delivered"
  • "quarantined"
query String No

Space-delimited search term. Case-insensitive.

per_page Integer No

The number of results per page. Maximum value is 1000.

Default value: 20

alert_id String No
start String No

The beginning of the search date range. Defaults to now - 30 days.

cursor String No
message_action String No

Message actions to filter by.

Valid values:

  • "QUARANTINE_RELEASED"
  • "MOVED"
  • "PREVIEW"

How to start integrating

  1. Add HTTP Task to your workflow definition.
  2. Search for the API you want to integrate with and click on the name.
    • This loads the API reference documentation and prepares the Http request settings.
  3. Click Test request to test run your request to the API and see the API's response.