GET /accounts/{account_id}/email-security/investigate

Returns information for each email that matches the search parameter(s).

Servers

https://api.cloudflare.com/client/v4

Path parameters

Name	Type	Required	Description
`account_id`	String	Yes

Query parameters

Name	Type	Required	Description
`metric`	String	No
`detections_only`	Boolean	No	Determines if the search results will include detections or not. Default value: true
`sender`	String	No
`domain`	String	No	The sender domains the search filters by.
`final_disposition`	String	No	The dispositions the search filters by. Possible values: `"SUSPICIOUS"` `"BULK"` `"SPOOF"` `"MALICIOUS"` `"SPAM"` `"NONE"`
`recipient`	String	No
`page`	Integer	No	The page number of paginated results. Default value: 1
`end`	String	No	The end of the search date range. Defaults to `now`.
`message_id`	String	No
`query`	String	No	The space-delimited term used in the query. The search is case-insensitive. The content of the following email metadata fields are searched: alert_id CC From (envelope_from) From Name final_disposition md5 hash (of any attachment) sha1 hash (of any attachment) sha256 hash (of any attachment) name (of any attachment) Reason Received DateTime (yyyy-mm-ddThh:mm:ss) Sent DateTime (yyyy-mm-ddThh:mm:ss) ReplyTo To (envelope_to) To Name Message-ID smtp_helo_server_ip smtp_previous_hop_ip x_originating_ip Subject
`action_log`	Boolean	No	Determines if the message action log is included in the response. Default value: true
`per_page`	Integer	No	The number of results per page. Default value: 20
`alert_id`	String	No
`start`	String	No	The beginning of the search date range. Defaults to `now - 30 days`.
`message_action`	String	No	The message actions the search filters by. Possible values: `"QUARANTINE_RELEASED"` `"MOVED"` `"PREVIEW"`

How to start integrating

Add HTTP Task to your workflow definition.
Search for the API you want to integrate with and click on the name.
- This loads the API reference documentation and prepares the Http request settings.
Click Test request to test run your request to the API and see the API's response.