# Investigate ## Search email messages `client.EmailSecurity.Investigate.List(ctx, params) (*V4PagePaginationArray[InvestigateListResponse], error)` **get** `/accounts/{account_id}/email-security/investigate` Returns information for each email that matches the search parameter(s). ### Parameters - `params InvestigateListParams` - `AccountID param.Field[string]` Path param: Identifier. - `AlertID param.Field[string]` Query param - `Cursor param.Field[string]` Query param - `DeliveryStatus param.Field[InvestigateListParamsDeliveryStatus]` Query param: Delivery status to filter by. - `const InvestigateListParamsDeliveryStatusDelivered InvestigateListParamsDeliveryStatus = "delivered"` - `const InvestigateListParamsDeliveryStatusMoved InvestigateListParamsDeliveryStatus = "moved"` - `const InvestigateListParamsDeliveryStatusQuarantined InvestigateListParamsDeliveryStatus = "quarantined"` - `const InvestigateListParamsDeliveryStatusRejected InvestigateListParamsDeliveryStatus = "rejected"` - `const InvestigateListParamsDeliveryStatusDeferred InvestigateListParamsDeliveryStatus = "deferred"` - `const InvestigateListParamsDeliveryStatusBounced InvestigateListParamsDeliveryStatus = "bounced"` - `const InvestigateListParamsDeliveryStatusQueued InvestigateListParamsDeliveryStatus = "queued"` - `DetectionsOnly param.Field[bool]` Query param: Whether to include only detections in search results. - `Domain param.Field[string]` Query param: Sender domains to filter by. - `End param.Field[Time]` Query param: The end of the search date range. Defaults to `now`. - `FinalDisposition param.Field[InvestigateListParamsFinalDisposition]` Query param: Dispositions to filter by. - `const InvestigateListParamsFinalDispositionMalicious InvestigateListParamsFinalDisposition = "MALICIOUS"` - `const InvestigateListParamsFinalDispositionSuspicious InvestigateListParamsFinalDisposition = "SUSPICIOUS"` - `const InvestigateListParamsFinalDispositionSpoof InvestigateListParamsFinalDisposition = "SPOOF"` - `const InvestigateListParamsFinalDispositionSpam InvestigateListParamsFinalDisposition = "SPAM"` - `const InvestigateListParamsFinalDispositionBulk InvestigateListParamsFinalDisposition = "BULK"` - `const InvestigateListParamsFinalDispositionNone InvestigateListParamsFinalDisposition = "NONE"` - `MessageAction param.Field[InvestigateListParamsMessageAction]` Query param: Message actions to filter by. - `const InvestigateListParamsMessageActionPreview InvestigateListParamsMessageAction = "PREVIEW"` - `const InvestigateListParamsMessageActionQuarantineReleased InvestigateListParamsMessageAction = "QUARANTINE_RELEASED"` - `const InvestigateListParamsMessageActionMoved InvestigateListParamsMessageAction = "MOVED"` - `MessageID param.Field[string]` Query param - `Metric param.Field[string]` Query param - `Page param.Field[int64]` Query param: Deprecated: Use cursor pagination instead. End of life: November 1, 2026. - `PerPage param.Field[int64]` Query param: The number of results per page. Maximum value is 1000. - `Query param.Field[string]` Query param: Space-delimited search term. Case-insensitive. - `Recipient param.Field[string]` Query param - `Sender param.Field[string]` Query param - `Start param.Field[Time]` Query param: The beginning of the search date range. Defaults to `now - 30 days`. Must not be in the future. - `Subject param.Field[string]` Query param ### Returns - `type InvestigateListResponse struct{…}` - `ID string` Unique identifier for a message retrieved from investigation - `ActionLog []InvestigateListResponseActionLog` Deprecated, use `GET /investigate/{investigate_id}/action_log` instead. End of life: November 1, 2026. - `CompletedAt Time` Timestamp when action completed - `Operation InvestigateListResponseActionLogOperation` Type of action performed - `const InvestigateListResponseActionLogOperationMove InvestigateListResponseActionLogOperation = "MOVE"` - `const InvestigateListResponseActionLogOperationRelease InvestigateListResponseActionLogOperation = "RELEASE"` - `const InvestigateListResponseActionLogOperationReclassify InvestigateListResponseActionLogOperation = "RECLASSIFY"` - `const InvestigateListResponseActionLogOperationSubmission InvestigateListResponseActionLogOperation = "SUBMISSION"` - `const InvestigateListResponseActionLogOperationQuarantineRelease InvestigateListResponseActionLogOperation = "QUARANTINE_RELEASE"` - `const InvestigateListResponseActionLogOperationPreview InvestigateListResponseActionLogOperation = "PREVIEW"` - `CompletedTimestamp string` Deprecated, use `completed_at` instead. End of life: November 1, 2026. - `Properties InvestigateListResponseActionLogProperties` Additional properties for the action - `Folder string` Target folder for move operations - `RequestedBy string` User who requested the action - `Status string` Status of the action - `ClientRecipients []string` - `DetectionReasons []string` - `IsPhishSubmission bool` - `IsQuarantined bool` - `PostfixID string` The identifier of the message - `Properties InvestigateListResponseProperties` Message processing properties - `AllowlistedPattern string` Pattern that allowlisted this message - `AllowlistedPatternType InvestigateListResponsePropertiesAllowlistedPatternType` Type of allowlist pattern - `const InvestigateListResponsePropertiesAllowlistedPatternTypeQuarantineRelease InvestigateListResponsePropertiesAllowlistedPatternType = "quarantine_release"` - `const InvestigateListResponsePropertiesAllowlistedPatternTypeAcceptableSender InvestigateListResponsePropertiesAllowlistedPatternType = "acceptable_sender"` - `const InvestigateListResponsePropertiesAllowlistedPatternTypeAllowedSender InvestigateListResponsePropertiesAllowlistedPatternType = "allowed_sender"` - `const InvestigateListResponsePropertiesAllowlistedPatternTypeAllowedRecipient InvestigateListResponsePropertiesAllowlistedPatternType = "allowed_recipient"` - `const InvestigateListResponsePropertiesAllowlistedPatternTypeDomainSimilarity InvestigateListResponsePropertiesAllowlistedPatternType = "domain_similarity"` - `const InvestigateListResponsePropertiesAllowlistedPatternTypeDomainRecency InvestigateListResponsePropertiesAllowlistedPatternType = "domain_recency"` - `const InvestigateListResponsePropertiesAllowlistedPatternTypeManagedAcceptableSender InvestigateListResponsePropertiesAllowlistedPatternType = "managed_acceptable_sender"` - `const InvestigateListResponsePropertiesAllowlistedPatternTypeOutboundNdr InvestigateListResponsePropertiesAllowlistedPatternType = "outbound_ndr"` - `BlocklistedMessage bool` Whether message was blocklisted - `BlocklistedPattern string` Pattern that blocklisted this message - `WhitelistedPatternType InvestigateListResponsePropertiesWhitelistedPatternType` Legacy field for allowlist pattern type - `const InvestigateListResponsePropertiesWhitelistedPatternTypeQuarantineRelease InvestigateListResponsePropertiesWhitelistedPatternType = "quarantine_release"` - `const InvestigateListResponsePropertiesWhitelistedPatternTypeAcceptableSender InvestigateListResponsePropertiesWhitelistedPatternType = "acceptable_sender"` - `const InvestigateListResponsePropertiesWhitelistedPatternTypeAllowedSender InvestigateListResponsePropertiesWhitelistedPatternType = "allowed_sender"` - `const InvestigateListResponsePropertiesWhitelistedPatternTypeAllowedRecipient InvestigateListResponsePropertiesWhitelistedPatternType = "allowed_recipient"` - `const InvestigateListResponsePropertiesWhitelistedPatternTypeDomainSimilarity InvestigateListResponsePropertiesWhitelistedPatternType = "domain_similarity"` - `const InvestigateListResponsePropertiesWhitelistedPatternTypeDomainRecency InvestigateListResponsePropertiesWhitelistedPatternType = "domain_recency"` - `const InvestigateListResponsePropertiesWhitelistedPatternTypeManagedAcceptableSender InvestigateListResponsePropertiesWhitelistedPatternType = "managed_acceptable_sender"` - `const InvestigateListResponsePropertiesWhitelistedPatternTypeOutboundNdr InvestigateListResponsePropertiesWhitelistedPatternType = "outbound_ndr"` - `Ts string` Deprecated, use `scanned_at` instead. End of life: November 1, 2026. - `AlertID string` - `DeliveryMode InvestigateListResponseDeliveryMode` - `const InvestigateListResponseDeliveryModeDirect InvestigateListResponseDeliveryMode = "DIRECT"` - `const InvestigateListResponseDeliveryModeBcc InvestigateListResponseDeliveryMode = "BCC"` - `const InvestigateListResponseDeliveryModeJournal InvestigateListResponseDeliveryMode = "JOURNAL"` - `const InvestigateListResponseDeliveryModeReviewSubmission InvestigateListResponseDeliveryMode = "REVIEW_SUBMISSION"` - `const InvestigateListResponseDeliveryModeDMARCUnverified InvestigateListResponseDeliveryMode = "DMARC_UNVERIFIED"` - `const InvestigateListResponseDeliveryModeDMARCFailureReport InvestigateListResponseDeliveryMode = "DMARC_FAILURE_REPORT"` - `const InvestigateListResponseDeliveryModeDMARCAggregateReport InvestigateListResponseDeliveryMode = "DMARC_AGGREGATE_REPORT"` - `const InvestigateListResponseDeliveryModeThreatIntelSubmission InvestigateListResponseDeliveryMode = "THREAT_INTEL_SUBMISSION"` - `const InvestigateListResponseDeliveryModeSimulationSubmission InvestigateListResponseDeliveryMode = "SIMULATION_SUBMISSION"` - `const InvestigateListResponseDeliveryModeAPI InvestigateListResponseDeliveryMode = "API"` - `const InvestigateListResponseDeliveryModeRetroScan InvestigateListResponseDeliveryMode = "RETRO_SCAN"` - `DeliveryStatus []InvestigateListResponseDeliveryStatus` - `const InvestigateListResponseDeliveryStatusDelivered InvestigateListResponseDeliveryStatus = "delivered"` - `const InvestigateListResponseDeliveryStatusMoved InvestigateListResponseDeliveryStatus = "moved"` - `const InvestigateListResponseDeliveryStatusQuarantined InvestigateListResponseDeliveryStatus = "quarantined"` - `const InvestigateListResponseDeliveryStatusRejected InvestigateListResponseDeliveryStatus = "rejected"` - `const InvestigateListResponseDeliveryStatusDeferred InvestigateListResponseDeliveryStatus = "deferred"` - `const InvestigateListResponseDeliveryStatusBounced InvestigateListResponseDeliveryStatus = "bounced"` - `const InvestigateListResponseDeliveryStatusQueued InvestigateListResponseDeliveryStatus = "queued"` - `EdfHash string` - `EnvelopeFrom string` - `EnvelopeTo []string` - `FinalDisposition InvestigateListResponseFinalDisposition` - `const InvestigateListResponseFinalDispositionMalicious InvestigateListResponseFinalDisposition = "MALICIOUS"` - `const InvestigateListResponseFinalDispositionMaliciousBec InvestigateListResponseFinalDisposition = "MALICIOUS-BEC"` - `const InvestigateListResponseFinalDispositionSuspicious InvestigateListResponseFinalDisposition = "SUSPICIOUS"` - `const InvestigateListResponseFinalDispositionSpoof InvestigateListResponseFinalDisposition = "SPOOF"` - `const InvestigateListResponseFinalDispositionSpam InvestigateListResponseFinalDisposition = "SPAM"` - `const InvestigateListResponseFinalDispositionBulk InvestigateListResponseFinalDisposition = "BULK"` - `const InvestigateListResponseFinalDispositionEncrypted InvestigateListResponseFinalDisposition = "ENCRYPTED"` - `const InvestigateListResponseFinalDispositionExternal InvestigateListResponseFinalDisposition = "EXTERNAL"` - `const InvestigateListResponseFinalDispositionUnknown InvestigateListResponseFinalDisposition = "UNKNOWN"` - `const InvestigateListResponseFinalDispositionNone InvestigateListResponseFinalDisposition = "NONE"` - `Findings []InvestigateListResponseFinding` Deprecated, use the `findings` field from `GET /investigate/{investigate_id}/detections` instead. End of life: November 1, 2026. Detection findings for this message. - `Attachment string` - `Detail string` - `Detection InvestigateListResponseFindingsDetection` - `const InvestigateListResponseFindingsDetectionMalicious InvestigateListResponseFindingsDetection = "MALICIOUS"` - `const InvestigateListResponseFindingsDetectionMaliciousBec InvestigateListResponseFindingsDetection = "MALICIOUS-BEC"` - `const InvestigateListResponseFindingsDetectionSuspicious InvestigateListResponseFindingsDetection = "SUSPICIOUS"` - `const InvestigateListResponseFindingsDetectionSpoof InvestigateListResponseFindingsDetection = "SPOOF"` - `const InvestigateListResponseFindingsDetectionSpam InvestigateListResponseFindingsDetection = "SPAM"` - `const InvestigateListResponseFindingsDetectionBulk InvestigateListResponseFindingsDetection = "BULK"` - `const InvestigateListResponseFindingsDetectionEncrypted InvestigateListResponseFindingsDetection = "ENCRYPTED"` - `const InvestigateListResponseFindingsDetectionExternal InvestigateListResponseFindingsDetection = "EXTERNAL"` - `const InvestigateListResponseFindingsDetectionUnknown InvestigateListResponseFindingsDetection = "UNKNOWN"` - `const InvestigateListResponseFindingsDetectionNone InvestigateListResponseFindingsDetection = "NONE"` - `Field string` - `Name string` - `Portion string` - `Reason string` - `Score float64` - `Value string` - `From string` - `FromName string` - `HtmltextStructureHash string` - `MessageID string` - `PostDeliveryOperations []InvestigateListResponsePostDeliveryOperation` Post-delivery operations performed on this message - `const InvestigateListResponsePostDeliveryOperationPreview InvestigateListResponsePostDeliveryOperation = "PREVIEW"` - `const InvestigateListResponsePostDeliveryOperationQuarantineRelease InvestigateListResponsePostDeliveryOperation = "QUARANTINE_RELEASE"` - `const InvestigateListResponsePostDeliveryOperationSubmission InvestigateListResponsePostDeliveryOperation = "SUBMISSION"` - `const InvestigateListResponsePostDeliveryOperationMove InvestigateListResponsePostDeliveryOperation = "MOVE"` - `PostfixIDOutbound string` - `Replyto string` - `ScannedAt Time` When the message was scanned (UTC) - `SentAt Time` When the message was sent (UTC) - `SentDate string` - `SmtpHeloServerIP string` - `SmtpPreviousHopIP string` - `Subject string` - `ThreatCategories []string` - `To []string` - `ToName []string` - `Validation InvestigateListResponseValidation` - `Comment string` - `DKIM InvestigateListResponseValidationDKIM` - `const InvestigateListResponseValidationDKIMPass InvestigateListResponseValidationDKIM = "pass"` - `const InvestigateListResponseValidationDKIMNeutral InvestigateListResponseValidationDKIM = "neutral"` - `const InvestigateListResponseValidationDKIMFail InvestigateListResponseValidationDKIM = "fail"` - `const InvestigateListResponseValidationDKIMError InvestigateListResponseValidationDKIM = "error"` - `const InvestigateListResponseValidationDKIMNone InvestigateListResponseValidationDKIM = "none"` - `DMARC InvestigateListResponseValidationDMARC` - `const InvestigateListResponseValidationDMARCPass InvestigateListResponseValidationDMARC = "pass"` - `const InvestigateListResponseValidationDMARCNeutral InvestigateListResponseValidationDMARC = "neutral"` - `const InvestigateListResponseValidationDMARCFail InvestigateListResponseValidationDMARC = "fail"` - `const InvestigateListResponseValidationDMARCError InvestigateListResponseValidationDMARC = "error"` - `const InvestigateListResponseValidationDMARCNone InvestigateListResponseValidationDMARC = "none"` - `SPF InvestigateListResponseValidationSPF` - `const InvestigateListResponseValidationSPFPass InvestigateListResponseValidationSPF = "pass"` - `const InvestigateListResponseValidationSPFNeutral InvestigateListResponseValidationSPF = "neutral"` - `const InvestigateListResponseValidationSPFFail InvestigateListResponseValidationSPF = "fail"` - `const InvestigateListResponseValidationSPFError InvestigateListResponseValidationSPF = "error"` - `const InvestigateListResponseValidationSPFNone InvestigateListResponseValidationSPF = "none"` - `XOriginatingIP string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) page, err := client.EmailSecurity.Investigate.List(context.TODO(), email_security.InvestigateListParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "id": "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", "action_log": [ { "completed_at": "2019-12-27T18:11:19.117Z", "operation": "MOVE", "completed_timestamp": "completed_timestamp", "properties": { "folder": "folder", "requested_by": "requested_by" }, "status": "status" } ], "client_recipients": [ "string" ], "detection_reasons": [ "string" ], "is_phish_submission": true, "is_quarantined": true, "postfix_id": "4Njp3P0STMz2c02Q", "properties": { "allowlisted_pattern": "allowlisted_pattern", "allowlisted_pattern_type": "quarantine_release", "blocklisted_message": true, "blocklisted_pattern": "blocklisted_pattern", "whitelisted_pattern_type": "quarantine_release" }, "ts": "ts", "alert_id": "alert_id", "delivery_mode": "DIRECT", "delivery_status": [ "delivered" ], "edf_hash": "edf_hash", "envelope_from": "envelope_from", "envelope_to": [ "string" ], "final_disposition": "MALICIOUS", "findings": [ { "attachment": "attachment", "detail": "detail", "detection": "MALICIOUS", "field": "field", "name": "name", "portion": "portion", "reason": "reason", "score": 0, "value": "value" } ], "from": "from", "from_name": "from_name", "htmltext_structure_hash": "htmltext_structure_hash", "message_id": "message_id", "post_delivery_operations": [ "PREVIEW" ], "postfix_id_outbound": "postfix_id_outbound", "replyto": "replyto", "scanned_at": "2019-12-27T18:11:19.117Z", "sent_at": "2019-12-27T18:11:19.117Z", "sent_date": "sent_date", "smtp_helo_server_ip": "smtp_helo_server_ip", "smtp_previous_hop_ip": "smtp_previous_hop_ip", "subject": "subject", "threat_categories": [ "string" ], "to": [ "string" ], "to_name": [ "string" ], "validation": { "comment": "comment", "dkim": "pass", "dmarc": "pass", "spf": "pass" }, "x_originating_ip": "x_originating_ip" } ], "result_info": { "count": 0, "per_page": 0, "total_count": 0, "next": "next", "page": 0, "previous": "previous" }, "success": true } ``` ## Get message details `client.EmailSecurity.Investigate.Get(ctx, investigateID, params) (*InvestigateGetResponse, error)` **get** `/accounts/{account_id}/email-security/investigate/{investigate_id}` Retrieves comprehensive details for a specific email message including headers, recipients, sender information, and current quarantine status. Use the investigate_id from search results to fetch detailed information. ### Parameters - `investigateID string` Unique identifier for a message retrieved from investigation - `params InvestigateGetParams` - `AccountID param.Field[string]` Path param: Identifier. - `Submission param.Field[bool]` Query param: When true, search the submissions datastore only. When false or omitted, search the regular datastore only. ### Returns - `type InvestigateGetResponse struct{…}` - `ID string` Unique identifier for a message retrieved from investigation - `ActionLog []InvestigateGetResponseActionLog` Deprecated, use `GET /investigate/{investigate_id}/action_log` instead. End of life: November 1, 2026. - `CompletedAt Time` Timestamp when action completed - `Operation InvestigateGetResponseActionLogOperation` Type of action performed - `const InvestigateGetResponseActionLogOperationMove InvestigateGetResponseActionLogOperation = "MOVE"` - `const InvestigateGetResponseActionLogOperationRelease InvestigateGetResponseActionLogOperation = "RELEASE"` - `const InvestigateGetResponseActionLogOperationReclassify InvestigateGetResponseActionLogOperation = "RECLASSIFY"` - `const InvestigateGetResponseActionLogOperationSubmission InvestigateGetResponseActionLogOperation = "SUBMISSION"` - `const InvestigateGetResponseActionLogOperationQuarantineRelease InvestigateGetResponseActionLogOperation = "QUARANTINE_RELEASE"` - `const InvestigateGetResponseActionLogOperationPreview InvestigateGetResponseActionLogOperation = "PREVIEW"` - `CompletedTimestamp string` Deprecated, use `completed_at` instead. End of life: November 1, 2026. - `Properties InvestigateGetResponseActionLogProperties` Additional properties for the action - `Folder string` Target folder for move operations - `RequestedBy string` User who requested the action - `Status string` Status of the action - `ClientRecipients []string` - `DetectionReasons []string` - `IsPhishSubmission bool` - `IsQuarantined bool` - `PostfixID string` The identifier of the message - `Properties InvestigateGetResponseProperties` Message processing properties - `AllowlistedPattern string` Pattern that allowlisted this message - `AllowlistedPatternType InvestigateGetResponsePropertiesAllowlistedPatternType` Type of allowlist pattern - `const InvestigateGetResponsePropertiesAllowlistedPatternTypeQuarantineRelease InvestigateGetResponsePropertiesAllowlistedPatternType = "quarantine_release"` - `const InvestigateGetResponsePropertiesAllowlistedPatternTypeAcceptableSender InvestigateGetResponsePropertiesAllowlistedPatternType = "acceptable_sender"` - `const InvestigateGetResponsePropertiesAllowlistedPatternTypeAllowedSender InvestigateGetResponsePropertiesAllowlistedPatternType = "allowed_sender"` - `const InvestigateGetResponsePropertiesAllowlistedPatternTypeAllowedRecipient InvestigateGetResponsePropertiesAllowlistedPatternType = "allowed_recipient"` - `const InvestigateGetResponsePropertiesAllowlistedPatternTypeDomainSimilarity InvestigateGetResponsePropertiesAllowlistedPatternType = "domain_similarity"` - `const InvestigateGetResponsePropertiesAllowlistedPatternTypeDomainRecency InvestigateGetResponsePropertiesAllowlistedPatternType = "domain_recency"` - `const InvestigateGetResponsePropertiesAllowlistedPatternTypeManagedAcceptableSender InvestigateGetResponsePropertiesAllowlistedPatternType = "managed_acceptable_sender"` - `const InvestigateGetResponsePropertiesAllowlistedPatternTypeOutboundNdr InvestigateGetResponsePropertiesAllowlistedPatternType = "outbound_ndr"` - `BlocklistedMessage bool` Whether message was blocklisted - `BlocklistedPattern string` Pattern that blocklisted this message - `WhitelistedPatternType InvestigateGetResponsePropertiesWhitelistedPatternType` Legacy field for allowlist pattern type - `const InvestigateGetResponsePropertiesWhitelistedPatternTypeQuarantineRelease InvestigateGetResponsePropertiesWhitelistedPatternType = "quarantine_release"` - `const InvestigateGetResponsePropertiesWhitelistedPatternTypeAcceptableSender InvestigateGetResponsePropertiesWhitelistedPatternType = "acceptable_sender"` - `const InvestigateGetResponsePropertiesWhitelistedPatternTypeAllowedSender InvestigateGetResponsePropertiesWhitelistedPatternType = "allowed_sender"` - `const InvestigateGetResponsePropertiesWhitelistedPatternTypeAllowedRecipient InvestigateGetResponsePropertiesWhitelistedPatternType = "allowed_recipient"` - `const InvestigateGetResponsePropertiesWhitelistedPatternTypeDomainSimilarity InvestigateGetResponsePropertiesWhitelistedPatternType = "domain_similarity"` - `const InvestigateGetResponsePropertiesWhitelistedPatternTypeDomainRecency InvestigateGetResponsePropertiesWhitelistedPatternType = "domain_recency"` - `const InvestigateGetResponsePropertiesWhitelistedPatternTypeManagedAcceptableSender InvestigateGetResponsePropertiesWhitelistedPatternType = "managed_acceptable_sender"` - `const InvestigateGetResponsePropertiesWhitelistedPatternTypeOutboundNdr InvestigateGetResponsePropertiesWhitelistedPatternType = "outbound_ndr"` - `Ts string` Deprecated, use `scanned_at` instead. End of life: November 1, 2026. - `AlertID string` - `DeliveryMode InvestigateGetResponseDeliveryMode` - `const InvestigateGetResponseDeliveryModeDirect InvestigateGetResponseDeliveryMode = "DIRECT"` - `const InvestigateGetResponseDeliveryModeBcc InvestigateGetResponseDeliveryMode = "BCC"` - `const InvestigateGetResponseDeliveryModeJournal InvestigateGetResponseDeliveryMode = "JOURNAL"` - `const InvestigateGetResponseDeliveryModeReviewSubmission InvestigateGetResponseDeliveryMode = "REVIEW_SUBMISSION"` - `const InvestigateGetResponseDeliveryModeDMARCUnverified InvestigateGetResponseDeliveryMode = "DMARC_UNVERIFIED"` - `const InvestigateGetResponseDeliveryModeDMARCFailureReport InvestigateGetResponseDeliveryMode = "DMARC_FAILURE_REPORT"` - `const InvestigateGetResponseDeliveryModeDMARCAggregateReport InvestigateGetResponseDeliveryMode = "DMARC_AGGREGATE_REPORT"` - `const InvestigateGetResponseDeliveryModeThreatIntelSubmission InvestigateGetResponseDeliveryMode = "THREAT_INTEL_SUBMISSION"` - `const InvestigateGetResponseDeliveryModeSimulationSubmission InvestigateGetResponseDeliveryMode = "SIMULATION_SUBMISSION"` - `const InvestigateGetResponseDeliveryModeAPI InvestigateGetResponseDeliveryMode = "API"` - `const InvestigateGetResponseDeliveryModeRetroScan InvestigateGetResponseDeliveryMode = "RETRO_SCAN"` - `DeliveryStatus []InvestigateGetResponseDeliveryStatus` - `const InvestigateGetResponseDeliveryStatusDelivered InvestigateGetResponseDeliveryStatus = "delivered"` - `const InvestigateGetResponseDeliveryStatusMoved InvestigateGetResponseDeliveryStatus = "moved"` - `const InvestigateGetResponseDeliveryStatusQuarantined InvestigateGetResponseDeliveryStatus = "quarantined"` - `const InvestigateGetResponseDeliveryStatusRejected InvestigateGetResponseDeliveryStatus = "rejected"` - `const InvestigateGetResponseDeliveryStatusDeferred InvestigateGetResponseDeliveryStatus = "deferred"` - `const InvestigateGetResponseDeliveryStatusBounced InvestigateGetResponseDeliveryStatus = "bounced"` - `const InvestigateGetResponseDeliveryStatusQueued InvestigateGetResponseDeliveryStatus = "queued"` - `EdfHash string` - `EnvelopeFrom string` - `EnvelopeTo []string` - `FinalDisposition InvestigateGetResponseFinalDisposition` - `const InvestigateGetResponseFinalDispositionMalicious InvestigateGetResponseFinalDisposition = "MALICIOUS"` - `const InvestigateGetResponseFinalDispositionMaliciousBec InvestigateGetResponseFinalDisposition = "MALICIOUS-BEC"` - `const InvestigateGetResponseFinalDispositionSuspicious InvestigateGetResponseFinalDisposition = "SUSPICIOUS"` - `const InvestigateGetResponseFinalDispositionSpoof InvestigateGetResponseFinalDisposition = "SPOOF"` - `const InvestigateGetResponseFinalDispositionSpam InvestigateGetResponseFinalDisposition = "SPAM"` - `const InvestigateGetResponseFinalDispositionBulk InvestigateGetResponseFinalDisposition = "BULK"` - `const InvestigateGetResponseFinalDispositionEncrypted InvestigateGetResponseFinalDisposition = "ENCRYPTED"` - `const InvestigateGetResponseFinalDispositionExternal InvestigateGetResponseFinalDisposition = "EXTERNAL"` - `const InvestigateGetResponseFinalDispositionUnknown InvestigateGetResponseFinalDisposition = "UNKNOWN"` - `const InvestigateGetResponseFinalDispositionNone InvestigateGetResponseFinalDisposition = "NONE"` - `Findings []InvestigateGetResponseFinding` Deprecated, use the `findings` field from `GET /investigate/{investigate_id}/detections` instead. End of life: November 1, 2026. Detection findings for this message. - `Attachment string` - `Detail string` - `Detection InvestigateGetResponseFindingsDetection` - `const InvestigateGetResponseFindingsDetectionMalicious InvestigateGetResponseFindingsDetection = "MALICIOUS"` - `const InvestigateGetResponseFindingsDetectionMaliciousBec InvestigateGetResponseFindingsDetection = "MALICIOUS-BEC"` - `const InvestigateGetResponseFindingsDetectionSuspicious InvestigateGetResponseFindingsDetection = "SUSPICIOUS"` - `const InvestigateGetResponseFindingsDetectionSpoof InvestigateGetResponseFindingsDetection = "SPOOF"` - `const InvestigateGetResponseFindingsDetectionSpam InvestigateGetResponseFindingsDetection = "SPAM"` - `const InvestigateGetResponseFindingsDetectionBulk InvestigateGetResponseFindingsDetection = "BULK"` - `const InvestigateGetResponseFindingsDetectionEncrypted InvestigateGetResponseFindingsDetection = "ENCRYPTED"` - `const InvestigateGetResponseFindingsDetectionExternal InvestigateGetResponseFindingsDetection = "EXTERNAL"` - `const InvestigateGetResponseFindingsDetectionUnknown InvestigateGetResponseFindingsDetection = "UNKNOWN"` - `const InvestigateGetResponseFindingsDetectionNone InvestigateGetResponseFindingsDetection = "NONE"` - `Field string` - `Name string` - `Portion string` - `Reason string` - `Score float64` - `Value string` - `From string` - `FromName string` - `HtmltextStructureHash string` - `MessageID string` - `PostDeliveryOperations []InvestigateGetResponsePostDeliveryOperation` Post-delivery operations performed on this message - `const InvestigateGetResponsePostDeliveryOperationPreview InvestigateGetResponsePostDeliveryOperation = "PREVIEW"` - `const InvestigateGetResponsePostDeliveryOperationQuarantineRelease InvestigateGetResponsePostDeliveryOperation = "QUARANTINE_RELEASE"` - `const InvestigateGetResponsePostDeliveryOperationSubmission InvestigateGetResponsePostDeliveryOperation = "SUBMISSION"` - `const InvestigateGetResponsePostDeliveryOperationMove InvestigateGetResponsePostDeliveryOperation = "MOVE"` - `PostfixIDOutbound string` - `Replyto string` - `ScannedAt Time` When the message was scanned (UTC) - `SentAt Time` When the message was sent (UTC) - `SentDate string` - `SmtpHeloServerIP string` - `SmtpPreviousHopIP string` - `Subject string` - `ThreatCategories []string` - `To []string` - `ToName []string` - `Validation InvestigateGetResponseValidation` - `Comment string` - `DKIM InvestigateGetResponseValidationDKIM` - `const InvestigateGetResponseValidationDKIMPass InvestigateGetResponseValidationDKIM = "pass"` - `const InvestigateGetResponseValidationDKIMNeutral InvestigateGetResponseValidationDKIM = "neutral"` - `const InvestigateGetResponseValidationDKIMFail InvestigateGetResponseValidationDKIM = "fail"` - `const InvestigateGetResponseValidationDKIMError InvestigateGetResponseValidationDKIM = "error"` - `const InvestigateGetResponseValidationDKIMNone InvestigateGetResponseValidationDKIM = "none"` - `DMARC InvestigateGetResponseValidationDMARC` - `const InvestigateGetResponseValidationDMARCPass InvestigateGetResponseValidationDMARC = "pass"` - `const InvestigateGetResponseValidationDMARCNeutral InvestigateGetResponseValidationDMARC = "neutral"` - `const InvestigateGetResponseValidationDMARCFail InvestigateGetResponseValidationDMARC = "fail"` - `const InvestigateGetResponseValidationDMARCError InvestigateGetResponseValidationDMARC = "error"` - `const InvestigateGetResponseValidationDMARCNone InvestigateGetResponseValidationDMARC = "none"` - `SPF InvestigateGetResponseValidationSPF` - `const InvestigateGetResponseValidationSPFPass InvestigateGetResponseValidationSPF = "pass"` - `const InvestigateGetResponseValidationSPFNeutral InvestigateGetResponseValidationSPF = "neutral"` - `const InvestigateGetResponseValidationSPFFail InvestigateGetResponseValidationSPF = "fail"` - `const InvestigateGetResponseValidationSPFError InvestigateGetResponseValidationSPF = "error"` - `const InvestigateGetResponseValidationSPFNone InvestigateGetResponseValidationSPF = "none"` - `XOriginatingIP string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) investigate, err := client.EmailSecurity.Investigate.Get( context.TODO(), "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", email_security.InvestigateGetParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", investigate.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "id": "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", "action_log": [ { "completed_at": "2019-12-27T18:11:19.117Z", "operation": "MOVE", "completed_timestamp": "completed_timestamp", "properties": { "folder": "folder", "requested_by": "requested_by" }, "status": "status" } ], "client_recipients": [ "string" ], "detection_reasons": [ "string" ], "is_phish_submission": true, "is_quarantined": true, "postfix_id": "4Njp3P0STMz2c02Q", "properties": { "allowlisted_pattern": "allowlisted_pattern", "allowlisted_pattern_type": "quarantine_release", "blocklisted_message": true, "blocklisted_pattern": "blocklisted_pattern", "whitelisted_pattern_type": "quarantine_release" }, "ts": "ts", "alert_id": "alert_id", "delivery_mode": "DIRECT", "delivery_status": [ "delivered" ], "edf_hash": "edf_hash", "envelope_from": "envelope_from", "envelope_to": [ "string" ], "final_disposition": "MALICIOUS", "findings": [ { "attachment": "attachment", "detail": "detail", "detection": "MALICIOUS", "field": "field", "name": "name", "portion": "portion", "reason": "reason", "score": 0, "value": "value" } ], "from": "from", "from_name": "from_name", "htmltext_structure_hash": "htmltext_structure_hash", "message_id": "message_id", "post_delivery_operations": [ "PREVIEW" ], "postfix_id_outbound": "postfix_id_outbound", "replyto": "replyto", "scanned_at": "2019-12-27T18:11:19.117Z", "sent_at": "2019-12-27T18:11:19.117Z", "sent_date": "sent_date", "smtp_helo_server_ip": "smtp_helo_server_ip", "smtp_previous_hop_ip": "smtp_previous_hop_ip", "subject": "subject", "threat_categories": [ "string" ], "to": [ "string" ], "to_name": [ "string" ], "validation": { "comment": "comment", "dkim": "pass", "dmarc": "pass", "spf": "pass" }, "x_originating_ip": "x_originating_ip" }, "success": true } ``` # Detections ## Get message detection details `client.EmailSecurity.Investigate.Detections.Get(ctx, investigateID, query) (*InvestigateDetectionGetResponse, error)` **get** `/accounts/{account_id}/email-security/investigate/{investigate_id}/detections` Returns detection details such as threat categories and sender information for non-benign messages. ### Parameters - `investigateID string` Unique identifier for a message retrieved from investigation - `query InvestigateDetectionGetParams` - `AccountID param.Field[string]` Identifier. ### Returns - `type InvestigateDetectionGetResponse struct{…}` - `Action string` - `Attachments []InvestigateDetectionGetResponseAttachment` - `Size int64` Size of the attachment in bytes - `ContentType string` MIME type of the attachment - `Detection InvestigateDetectionGetResponseAttachmentsDetection` Detection result for this attachment - `const InvestigateDetectionGetResponseAttachmentsDetectionMalicious InvestigateDetectionGetResponseAttachmentsDetection = "MALICIOUS"` - `const InvestigateDetectionGetResponseAttachmentsDetectionMaliciousBec InvestigateDetectionGetResponseAttachmentsDetection = "MALICIOUS-BEC"` - `const InvestigateDetectionGetResponseAttachmentsDetectionSuspicious InvestigateDetectionGetResponseAttachmentsDetection = "SUSPICIOUS"` - `const InvestigateDetectionGetResponseAttachmentsDetectionSpoof InvestigateDetectionGetResponseAttachmentsDetection = "SPOOF"` - `const InvestigateDetectionGetResponseAttachmentsDetectionSpam InvestigateDetectionGetResponseAttachmentsDetection = "SPAM"` - `const InvestigateDetectionGetResponseAttachmentsDetectionBulk InvestigateDetectionGetResponseAttachmentsDetection = "BULK"` - `const InvestigateDetectionGetResponseAttachmentsDetectionEncrypted InvestigateDetectionGetResponseAttachmentsDetection = "ENCRYPTED"` - `const InvestigateDetectionGetResponseAttachmentsDetectionExternal InvestigateDetectionGetResponseAttachmentsDetection = "EXTERNAL"` - `const InvestigateDetectionGetResponseAttachmentsDetectionUnknown InvestigateDetectionGetResponseAttachmentsDetection = "UNKNOWN"` - `const InvestigateDetectionGetResponseAttachmentsDetectionNone InvestigateDetectionGetResponseAttachmentsDetection = "NONE"` - `Encrypted bool` Whether the attachment is encrypted - `Filename string` Name of the attached file - `Md5 string` MD5 hash of the attachment - `Name string` Attachment name (alternative to filename) - `Sha1 string` SHA1 hash of the attachment - `Sha256 string` SHA256 hash of the attachment - `Findings []InvestigateDetectionGetResponseFinding` - `Attachment string` - `Detail string` - `Detection InvestigateDetectionGetResponseFindingsDetection` - `const InvestigateDetectionGetResponseFindingsDetectionMalicious InvestigateDetectionGetResponseFindingsDetection = "MALICIOUS"` - `const InvestigateDetectionGetResponseFindingsDetectionMaliciousBec InvestigateDetectionGetResponseFindingsDetection = "MALICIOUS-BEC"` - `const InvestigateDetectionGetResponseFindingsDetectionSuspicious InvestigateDetectionGetResponseFindingsDetection = "SUSPICIOUS"` - `const InvestigateDetectionGetResponseFindingsDetectionSpoof InvestigateDetectionGetResponseFindingsDetection = "SPOOF"` - `const InvestigateDetectionGetResponseFindingsDetectionSpam InvestigateDetectionGetResponseFindingsDetection = "SPAM"` - `const InvestigateDetectionGetResponseFindingsDetectionBulk InvestigateDetectionGetResponseFindingsDetection = "BULK"` - `const InvestigateDetectionGetResponseFindingsDetectionEncrypted InvestigateDetectionGetResponseFindingsDetection = "ENCRYPTED"` - `const InvestigateDetectionGetResponseFindingsDetectionExternal InvestigateDetectionGetResponseFindingsDetection = "EXTERNAL"` - `const InvestigateDetectionGetResponseFindingsDetectionUnknown InvestigateDetectionGetResponseFindingsDetection = "UNKNOWN"` - `const InvestigateDetectionGetResponseFindingsDetectionNone InvestigateDetectionGetResponseFindingsDetection = "NONE"` - `Field string` - `Name string` - `Portion string` - `Reason string` - `Score float64` - `Value string` - `Headers []InvestigateDetectionGetResponseHeader` - `Name string` - `Value string` - `Links []InvestigateDetectionGetResponseLink` - `Href string` - `Text string` - `SenderInfo InvestigateDetectionGetResponseSenderInfo` - `AsName string` The name of the autonomous system. - `AsNumber int64` The number of the autonomous system. - `Geo string` - `IP string` - `Pld string` - `ThreatCategories []InvestigateDetectionGetResponseThreatCategory` - `ID int64` - `Description string` - `Name string` - `Validation InvestigateDetectionGetResponseValidation` - `Comment string` - `DKIM InvestigateDetectionGetResponseValidationDKIM` - `const InvestigateDetectionGetResponseValidationDKIMPass InvestigateDetectionGetResponseValidationDKIM = "pass"` - `const InvestigateDetectionGetResponseValidationDKIMNeutral InvestigateDetectionGetResponseValidationDKIM = "neutral"` - `const InvestigateDetectionGetResponseValidationDKIMFail InvestigateDetectionGetResponseValidationDKIM = "fail"` - `const InvestigateDetectionGetResponseValidationDKIMError InvestigateDetectionGetResponseValidationDKIM = "error"` - `const InvestigateDetectionGetResponseValidationDKIMNone InvestigateDetectionGetResponseValidationDKIM = "none"` - `DMARC InvestigateDetectionGetResponseValidationDMARC` - `const InvestigateDetectionGetResponseValidationDMARCPass InvestigateDetectionGetResponseValidationDMARC = "pass"` - `const InvestigateDetectionGetResponseValidationDMARCNeutral InvestigateDetectionGetResponseValidationDMARC = "neutral"` - `const InvestigateDetectionGetResponseValidationDMARCFail InvestigateDetectionGetResponseValidationDMARC = "fail"` - `const InvestigateDetectionGetResponseValidationDMARCError InvestigateDetectionGetResponseValidationDMARC = "error"` - `const InvestigateDetectionGetResponseValidationDMARCNone InvestigateDetectionGetResponseValidationDMARC = "none"` - `SPF InvestigateDetectionGetResponseValidationSPF` - `const InvestigateDetectionGetResponseValidationSPFPass InvestigateDetectionGetResponseValidationSPF = "pass"` - `const InvestigateDetectionGetResponseValidationSPFNeutral InvestigateDetectionGetResponseValidationSPF = "neutral"` - `const InvestigateDetectionGetResponseValidationSPFFail InvestigateDetectionGetResponseValidationSPF = "fail"` - `const InvestigateDetectionGetResponseValidationSPFError InvestigateDetectionGetResponseValidationSPF = "error"` - `const InvestigateDetectionGetResponseValidationSPFNone InvestigateDetectionGetResponseValidationSPF = "none"` - `FinalDisposition InvestigateDetectionGetResponseFinalDisposition` - `const InvestigateDetectionGetResponseFinalDispositionMalicious InvestigateDetectionGetResponseFinalDisposition = "MALICIOUS"` - `const InvestigateDetectionGetResponseFinalDispositionMaliciousBec InvestigateDetectionGetResponseFinalDisposition = "MALICIOUS-BEC"` - `const InvestigateDetectionGetResponseFinalDispositionSuspicious InvestigateDetectionGetResponseFinalDisposition = "SUSPICIOUS"` - `const InvestigateDetectionGetResponseFinalDispositionSpoof InvestigateDetectionGetResponseFinalDisposition = "SPOOF"` - `const InvestigateDetectionGetResponseFinalDispositionSpam InvestigateDetectionGetResponseFinalDisposition = "SPAM"` - `const InvestigateDetectionGetResponseFinalDispositionBulk InvestigateDetectionGetResponseFinalDisposition = "BULK"` - `const InvestigateDetectionGetResponseFinalDispositionEncrypted InvestigateDetectionGetResponseFinalDisposition = "ENCRYPTED"` - `const InvestigateDetectionGetResponseFinalDispositionExternal InvestigateDetectionGetResponseFinalDisposition = "EXTERNAL"` - `const InvestigateDetectionGetResponseFinalDispositionUnknown InvestigateDetectionGetResponseFinalDisposition = "UNKNOWN"` - `const InvestigateDetectionGetResponseFinalDispositionNone InvestigateDetectionGetResponseFinalDisposition = "NONE"` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) detection, err := client.EmailSecurity.Investigate.Detections.Get( context.TODO(), "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", email_security.InvestigateDetectionGetParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", detection.Validation) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "action": "action", "attachments": [ { "size": 0, "content_type": "content_type", "detection": "MALICIOUS", "encrypted": true, "filename": "filename", "md5": "md5", "name": "name", "sha1": "sha1", "sha256": "sha256" } ], "findings": [ { "attachment": "attachment", "detail": "detail", "detection": "MALICIOUS", "field": "field", "name": "name", "portion": "portion", "reason": "reason", "score": 0, "value": "value" } ], "headers": [ { "name": "name", "value": "value" } ], "links": [ { "href": "href", "text": "text" } ], "sender_info": { "as_name": "as_name", "as_number": 0, "geo": "geo", "ip": "ip", "pld": "pld" }, "threat_categories": [ { "id": 0, "description": "description", "name": "name" } ], "validation": { "comment": "comment", "dkim": "pass", "dmarc": "pass", "spf": "pass" }, "final_disposition": "MALICIOUS" }, "success": true } ``` # Preview ## Get email preview `client.EmailSecurity.Investigate.Preview.Get(ctx, investigateID, query) (*InvestigatePreviewGetResponse, error)` **get** `/accounts/{account_id}/email-security/investigate/{investigate_id}/preview` Returns a preview of the message body as a base64 encoded PNG image for non-benign messages. ### Parameters - `investigateID string` Unique identifier for a message retrieved from investigation - `query InvestigatePreviewGetParams` - `AccountID param.Field[string]` Identifier. ### Returns - `type InvestigatePreviewGetResponse struct{…}` - `Screenshot string` A base64 encoded PNG image of the email. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) preview, err := client.EmailSecurity.Investigate.Preview.Get( context.TODO(), "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", email_security.InvestigatePreviewGetParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", preview.Screenshot) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "screenshot": "screenshot" }, "success": true } ``` ## Preview for non-detection messages `client.EmailSecurity.Investigate.Preview.New(ctx, params) (*InvestigatePreviewNewResponse, error)` **post** `/accounts/{account_id}/email-security/investigate/preview` Generates a preview image for a message that was not flagged as a detection. Useful for investigating benign messages. Returns a base64-encoded PNG screenshot of the email body. ### Parameters - `params InvestigatePreviewNewParams` - `AccountID param.Field[string]` Path param: Identifier. - `PostfixID param.Field[string]` Body param: The identifier of the message ### Returns - `type InvestigatePreviewNewResponse struct{…}` - `Screenshot string` A base64 encoded PNG image of the email. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) preview, err := client.EmailSecurity.Investigate.Preview.New(context.TODO(), email_security.InvestigatePreviewNewParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), PostfixID: cloudflare.F("4Njp3P0STMz2c02Q"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", preview.Screenshot) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "screenshot": "screenshot" }, "success": true } ``` # Raw ## Get raw email content `client.EmailSecurity.Investigate.Raw.Get(ctx, investigateID, query) (*InvestigateRawGetResponse, error)` **get** `/accounts/{account_id}/email-security/investigate/{investigate_id}/raw` Returns the raw eml of any non-benign message. ### Parameters - `investigateID string` Unique identifier for a message retrieved from investigation - `query InvestigateRawGetParams` - `AccountID param.Field[string]` Identifier. ### Returns - `type InvestigateRawGetResponse struct{…}` - `Raw string` A UTF-8 encoded eml file of the email. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) raw, err := client.EmailSecurity.Investigate.Raw.Get( context.TODO(), "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", email_security.InvestigateRawGetParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", raw.Raw) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "raw": "raw" }, "success": true } ``` # Trace ## Get email trace `client.EmailSecurity.Investigate.Trace.Get(ctx, investigateID, query) (*InvestigateTraceGetResponse, error)` **get** `/accounts/{account_id}/email-security/investigate/{investigate_id}/trace` Retrieves delivery and processing trace information for an email message. Shows the delivery path, retraction history, and move operations performed on the message. Useful for debugging delivery issues. ### Parameters - `investigateID string` Unique identifier for a message retrieved from investigation - `query InvestigateTraceGetParams` - `AccountID param.Field[string]` Identifier. ### Returns - `type InvestigateTraceGetResponse struct{…}` - `Inbound InvestigateTraceGetResponseInbound` - `Lines []InvestigateTraceGetResponseInboundLine` - `Lineno int64` Line number in the trace log - `LoggedAt Time` - `Message string` - `Ts string` Deprecated, use `logged_at` instead. End of life: November 1, 2026. - `Pending bool` - `Outbound InvestigateTraceGetResponseOutbound` - `Lines []InvestigateTraceGetResponseOutboundLine` - `Lineno int64` Line number in the trace log - `LoggedAt Time` - `Message string` - `Ts string` Deprecated, use `logged_at` instead. End of life: November 1, 2026. - `Pending bool` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) trace, err := client.EmailSecurity.Investigate.Trace.Get( context.TODO(), "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", email_security.InvestigateTraceGetParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", trace.Inbound) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "inbound": { "lines": [ { "lineno": 0, "logged_at": "2019-12-27T18:11:19.117Z", "message": "message", "ts": "ts" } ], "pending": true }, "outbound": { "lines": [ { "lineno": 0, "logged_at": "2019-12-27T18:11:19.117Z", "message": "message", "ts": "ts" } ], "pending": true } }, "success": true } ``` # Move ## Move a message `client.EmailSecurity.Investigate.Move.New(ctx, investigateID, params) (*SinglePage[InvestigateMoveNewResponse], error)` **post** `/accounts/{account_id}/email-security/investigate/{investigate_id}/move` Moves a single message to a specified mailbox folder (Inbox, JunkEmail, DeletedItems, RecoverableItemsDeletions, or RecoverableItemsPurges). Requires active integration. ### Parameters - `investigateID string` Unique identifier for a message retrieved from investigation - `params InvestigateMoveNewParams` - `AccountID param.Field[string]` Path param: Identifier. - `Destination param.Field[InvestigateMoveNewParamsDestination]` Body param - `const InvestigateMoveNewParamsDestinationInbox InvestigateMoveNewParamsDestination = "Inbox"` - `const InvestigateMoveNewParamsDestinationJunkEmail InvestigateMoveNewParamsDestination = "JunkEmail"` - `const InvestigateMoveNewParamsDestinationDeletedItems InvestigateMoveNewParamsDestination = "DeletedItems"` - `const InvestigateMoveNewParamsDestinationRecoverableItemsDeletions InvestigateMoveNewParamsDestination = "RecoverableItemsDeletions"` - `const InvestigateMoveNewParamsDestinationRecoverableItemsPurges InvestigateMoveNewParamsDestination = "RecoverableItemsPurges"` - `ExpectedDisposition param.Field[InvestigateMoveNewParamsExpectedDisposition]` Body param - `const InvestigateMoveNewParamsExpectedDispositionMalicious InvestigateMoveNewParamsExpectedDisposition = "MALICIOUS"` - `const InvestigateMoveNewParamsExpectedDispositionMaliciousBec InvestigateMoveNewParamsExpectedDisposition = "MALICIOUS-BEC"` - `const InvestigateMoveNewParamsExpectedDispositionSuspicious InvestigateMoveNewParamsExpectedDisposition = "SUSPICIOUS"` - `const InvestigateMoveNewParamsExpectedDispositionSpoof InvestigateMoveNewParamsExpectedDisposition = "SPOOF"` - `const InvestigateMoveNewParamsExpectedDispositionSpam InvestigateMoveNewParamsExpectedDisposition = "SPAM"` - `const InvestigateMoveNewParamsExpectedDispositionBulk InvestigateMoveNewParamsExpectedDisposition = "BULK"` - `const InvestigateMoveNewParamsExpectedDispositionEncrypted InvestigateMoveNewParamsExpectedDisposition = "ENCRYPTED"` - `const InvestigateMoveNewParamsExpectedDispositionExternal InvestigateMoveNewParamsExpectedDisposition = "EXTERNAL"` - `const InvestigateMoveNewParamsExpectedDispositionUnknown InvestigateMoveNewParamsExpectedDisposition = "UNKNOWN"` - `const InvestigateMoveNewParamsExpectedDispositionNone InvestigateMoveNewParamsExpectedDisposition = "NONE"` ### Returns - `type InvestigateMoveNewResponse struct{…}` - `Success bool` Whether the operation succeeded - `CompletedAt Time` When the move operation completed (UTC) - `CompletedTimestamp Time` Deprecated, use `completed_at` instead. End of life: November 1, 2026. - `Destination string` Destination folder for the message - `ItemCount int64` Number of items moved. End of life: November 1, 2026. - `MessageID string` Message identifier - `Operation string` Type of operation performed - `Recipient string` Recipient email address - `Status string` Operation status ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) page, err := client.EmailSecurity.Investigate.Move.New( context.TODO(), "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", email_security.InvestigateMoveNewParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), Destination: cloudflare.F(email_security.InvestigateMoveNewParamsDestinationInbox), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "success": true, "completed_at": "2019-12-27T18:11:19.117Z", "completed_timestamp": "2019-12-27T18:11:19.117Z", "destination": "destination", "item_count": 0, "message_id": "message_id", "operation": "operation", "recipient": "recipient", "status": "status" } ], "success": true } ``` ## Move multiple messages `client.EmailSecurity.Investigate.Move.Bulk(ctx, params) (*SinglePage[InvestigateMoveBulkResponse], error)` **post** `/accounts/{account_id}/email-security/investigate/move` Moves multiple messages to a specified mailbox folder (Inbox, JunkEmail, DeletedItems, RecoverableItemsDeletions, or RecoverableItemsPurges). Requires active integration. ### Parameters - `params InvestigateMoveBulkParams` - `AccountID param.Field[string]` Path param: Identifier. - `Destination param.Field[InvestigateMoveBulkParamsDestination]` Body param - `const InvestigateMoveBulkParamsDestinationInbox InvestigateMoveBulkParamsDestination = "Inbox"` - `const InvestigateMoveBulkParamsDestinationJunkEmail InvestigateMoveBulkParamsDestination = "JunkEmail"` - `const InvestigateMoveBulkParamsDestinationDeletedItems InvestigateMoveBulkParamsDestination = "DeletedItems"` - `const InvestigateMoveBulkParamsDestinationRecoverableItemsDeletions InvestigateMoveBulkParamsDestination = "RecoverableItemsDeletions"` - `const InvestigateMoveBulkParamsDestinationRecoverableItemsPurges InvestigateMoveBulkParamsDestination = "RecoverableItemsPurges"` - `ExpectedDisposition param.Field[InvestigateMoveBulkParamsExpectedDisposition]` Body param - `const InvestigateMoveBulkParamsExpectedDispositionMalicious InvestigateMoveBulkParamsExpectedDisposition = "MALICIOUS"` - `const InvestigateMoveBulkParamsExpectedDispositionMaliciousBec InvestigateMoveBulkParamsExpectedDisposition = "MALICIOUS-BEC"` - `const InvestigateMoveBulkParamsExpectedDispositionSuspicious InvestigateMoveBulkParamsExpectedDisposition = "SUSPICIOUS"` - `const InvestigateMoveBulkParamsExpectedDispositionSpoof InvestigateMoveBulkParamsExpectedDisposition = "SPOOF"` - `const InvestigateMoveBulkParamsExpectedDispositionSpam InvestigateMoveBulkParamsExpectedDisposition = "SPAM"` - `const InvestigateMoveBulkParamsExpectedDispositionBulk InvestigateMoveBulkParamsExpectedDisposition = "BULK"` - `const InvestigateMoveBulkParamsExpectedDispositionEncrypted InvestigateMoveBulkParamsExpectedDisposition = "ENCRYPTED"` - `const InvestigateMoveBulkParamsExpectedDispositionExternal InvestigateMoveBulkParamsExpectedDisposition = "EXTERNAL"` - `const InvestigateMoveBulkParamsExpectedDispositionUnknown InvestigateMoveBulkParamsExpectedDisposition = "UNKNOWN"` - `const InvestigateMoveBulkParamsExpectedDispositionNone InvestigateMoveBulkParamsExpectedDisposition = "NONE"` - `IDs param.Field[[]string]` Body param: List of message IDs to move - `PostfixIDs param.Field[[]string]` Body param: Deprecated, use `ids` instead. End of life: November 1, 2026. List of message IDs to move. ### Returns - `type InvestigateMoveBulkResponse struct{…}` - `Success bool` Whether the operation succeeded - `CompletedAt Time` When the move operation completed (UTC) - `CompletedTimestamp Time` Deprecated, use `completed_at` instead. End of life: November 1, 2026. - `Destination string` Destination folder for the message - `ItemCount int64` Number of items moved. End of life: November 1, 2026. - `MessageID string` Message identifier - `Operation string` Type of operation performed - `Recipient string` Recipient email address - `Status string` Operation status ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) page, err := client.EmailSecurity.Investigate.Move.Bulk(context.TODO(), email_security.InvestigateMoveBulkParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), Destination: cloudflare.F(email_security.InvestigateMoveBulkParamsDestinationInbox), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "success": true, "completed_at": "2019-12-27T18:11:19.117Z", "completed_timestamp": "2019-12-27T18:11:19.117Z", "destination": "destination", "item_count": 0, "message_id": "message_id", "operation": "operation", "recipient": "recipient", "status": "status" } ], "success": true } ``` # Reclassify ## Change email classification `client.EmailSecurity.Investigate.Reclassify.New(ctx, investigateID, params) (*InvestigateReclassifyNewResponse, error)` **post** `/accounts/{account_id}/email-security/investigate/{investigate_id}/reclassify` Submits a request to reclassify an email's disposition. Use for reporting false positives or false negatives. Optionally provide the raw EML content for reanalysis. The reclassification is processed asynchronously. ### Parameters - `investigateID string` Unique identifier for a message retrieved from investigation - `params InvestigateReclassifyNewParams` - `AccountID param.Field[string]` Path param: Identifier. - `ExpectedDisposition param.Field[InvestigateReclassifyNewParamsExpectedDisposition]` Body param - `const InvestigateReclassifyNewParamsExpectedDispositionNone InvestigateReclassifyNewParamsExpectedDisposition = "NONE"` - `const InvestigateReclassifyNewParamsExpectedDispositionBulk InvestigateReclassifyNewParamsExpectedDisposition = "BULK"` - `const InvestigateReclassifyNewParamsExpectedDispositionMalicious InvestigateReclassifyNewParamsExpectedDisposition = "MALICIOUS"` - `const InvestigateReclassifyNewParamsExpectedDispositionSpam InvestigateReclassifyNewParamsExpectedDisposition = "SPAM"` - `const InvestigateReclassifyNewParamsExpectedDispositionSpoof InvestigateReclassifyNewParamsExpectedDisposition = "SPOOF"` - `const InvestigateReclassifyNewParamsExpectedDispositionSuspicious InvestigateReclassifyNewParamsExpectedDisposition = "SUSPICIOUS"` - `EmlContent param.Field[string]` Body param: Base64 encoded content of the EML file. - `EscalatedSubmissionID param.Field[string]` Body param ### Returns - `type InvestigateReclassifyNewResponse interface{…}` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) reclassify, err := client.EmailSecurity.Investigate.Reclassify.New( context.TODO(), "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", email_security.InvestigateReclassifyNewParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), ExpectedDisposition: cloudflare.F(email_security.InvestigateReclassifyNewParamsExpectedDispositionNone), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", reclassify) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": {}, "success": true } ``` # Release ## Release messages from quarantine `client.EmailSecurity.Investigate.Release.Bulk(ctx, params) (*SinglePage[InvestigateReleaseBulkResponse], error)` **post** `/accounts/{account_id}/email-security/investigate/release` Releases one or more quarantined messages, delivering them to the intended recipients. Use when a message was incorrectly quarantined. Returns delivery status for each recipient. ### Parameters - `params InvestigateReleaseBulkParams` - `AccountID param.Field[string]` Path param: Identifier. - `Body param.Field[[]string]` Body param ### Returns - `type InvestigateReleaseBulkResponse struct{…}` - `ID string` Unique identifier for a message retrieved from investigation - `Delivered []string` - `Failed []string` - `PostfixID string` Deprecated, use `id` instead. End of life: November 1, 2026. - `Undelivered []string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) page, err := client.EmailSecurity.Investigate.Release.Bulk(context.TODO(), email_security.InvestigateReleaseBulkParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), Body: []string{"4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678"}, }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "id": "4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678", "delivered": [ "string" ], "failed": [ "string" ], "postfix_id": "4Njp3P0STMz2c02Q", "undelivered": [ "string" ] } ], "success": true } ``` # Bulk ## List bulk action jobs `client.EmailSecurity.Investigate.Bulk.List(ctx, params) (*V4PagePaginationArray[InvestigateBulkListResponse], error)` **get** `/accounts/{account_id}/email-security/investigate/bulk` Returns a paginated list of bulk action jobs for the account. ### Parameters - `params InvestigateBulkListParams` - `AccountID param.Field[string]` Path param: Identifier. - `ActionType param.Field[InvestigateBulkListParamsActionType]` Query param - `const InvestigateBulkListParamsActionTypeMove InvestigateBulkListParamsActionType = "MOVE"` - `const InvestigateBulkListParamsActionTypeRelease InvestigateBulkListParamsActionType = "RELEASE"` - `Page param.Field[int64]` Query param: Current page within paginated list of results. - `PerPage param.Field[int64]` Query param: The number of results per page. Maximum value is 1000. - `Status param.Field[InvestigateBulkListParamsStatus]` Query param - `const InvestigateBulkListParamsStatusPending InvestigateBulkListParamsStatus = "PENDING"` - `const InvestigateBulkListParamsStatusDiscovering InvestigateBulkListParamsStatus = "DISCOVERING"` - `const InvestigateBulkListParamsStatusProcessing InvestigateBulkListParamsStatus = "PROCESSING"` - `const InvestigateBulkListParamsStatusCompleted InvestigateBulkListParamsStatus = "COMPLETED"` - `const InvestigateBulkListParamsStatusFailed InvestigateBulkListParamsStatus = "FAILED"` - `const InvestigateBulkListParamsStatusCancelled InvestigateBulkListParamsStatus = "CANCELLED"` - `const InvestigateBulkListParamsStatusSkipped InvestigateBulkListParamsStatus = "SKIPPED"` ### Returns - `type InvestigateBulkListResponse struct{…}` - `ActionParams InvestigateBulkListResponseActionParams` - `type InvestigateBulkListResponseActionParamsMove struct{…}` - `Destination InvestigateBulkListResponseActionParamsMoveDestination` - `const InvestigateBulkListResponseActionParamsMoveDestinationInbox InvestigateBulkListResponseActionParamsMoveDestination = "Inbox"` - `const InvestigateBulkListResponseActionParamsMoveDestinationJunkEmail InvestigateBulkListResponseActionParamsMoveDestination = "JunkEmail"` - `const InvestigateBulkListResponseActionParamsMoveDestinationDeletedItems InvestigateBulkListResponseActionParamsMoveDestination = "DeletedItems"` - `const InvestigateBulkListResponseActionParamsMoveDestinationRecoverableItemsDeletions InvestigateBulkListResponseActionParamsMoveDestination = "RecoverableItemsDeletions"` - `const InvestigateBulkListResponseActionParamsMoveDestinationRecoverableItemsPurges InvestigateBulkListResponseActionParamsMoveDestination = "RecoverableItemsPurges"` - `Type InvestigateBulkListResponseActionParamsMoveType` - `const InvestigateBulkListResponseActionParamsMoveTypeMove InvestigateBulkListResponseActionParamsMoveType = "MOVE"` - `ExpectedDisposition InvestigateBulkListResponseActionParamsMoveExpectedDisposition` - `const InvestigateBulkListResponseActionParamsMoveExpectedDispositionMalicious InvestigateBulkListResponseActionParamsMoveExpectedDisposition = "MALICIOUS"` - `const InvestigateBulkListResponseActionParamsMoveExpectedDispositionMaliciousBec InvestigateBulkListResponseActionParamsMoveExpectedDisposition = "MALICIOUS-BEC"` - `const InvestigateBulkListResponseActionParamsMoveExpectedDispositionSuspicious InvestigateBulkListResponseActionParamsMoveExpectedDisposition = "SUSPICIOUS"` - `const InvestigateBulkListResponseActionParamsMoveExpectedDispositionSpoof InvestigateBulkListResponseActionParamsMoveExpectedDisposition = "SPOOF"` - `const InvestigateBulkListResponseActionParamsMoveExpectedDispositionSpam InvestigateBulkListResponseActionParamsMoveExpectedDisposition = "SPAM"` - `const InvestigateBulkListResponseActionParamsMoveExpectedDispositionBulk InvestigateBulkListResponseActionParamsMoveExpectedDisposition = "BULK"` - `const InvestigateBulkListResponseActionParamsMoveExpectedDispositionEncrypted InvestigateBulkListResponseActionParamsMoveExpectedDisposition = "ENCRYPTED"` - `const InvestigateBulkListResponseActionParamsMoveExpectedDispositionExternal InvestigateBulkListResponseActionParamsMoveExpectedDisposition = "EXTERNAL"` - `const InvestigateBulkListResponseActionParamsMoveExpectedDispositionUnknown InvestigateBulkListResponseActionParamsMoveExpectedDisposition = "UNKNOWN"` - `const InvestigateBulkListResponseActionParamsMoveExpectedDispositionNone InvestigateBulkListResponseActionParamsMoveExpectedDisposition = "NONE"` - `type InvestigateBulkListResponseActionParamsRelease struct{…}` - `Type InvestigateBulkListResponseActionParamsReleaseType` - `const InvestigateBulkListResponseActionParamsReleaseTypeRelease InvestigateBulkListResponseActionParamsReleaseType = "RELEASE"` - `ActionType InvestigateBulkListResponseActionType` - `const InvestigateBulkListResponseActionTypeMove InvestigateBulkListResponseActionType = "MOVE"` - `const InvestigateBulkListResponseActionTypeRelease InvestigateBulkListResponseActionType = "RELEASE"` - `CreatedAt Time` - `JobID string` - `MessagesFailed int64` - `MessagesPending int64` - `MessagesSuccessful int64` - `SearchParams InvestigateBulkListResponseSearchParams` - `ActionLog bool` Deprecated, use `GET /investigate/{investigate_id}/action_log` instead. End of life: November 1, 2026. - `AlertID string` - `DeliveryStatus InvestigateBulkListResponseSearchParamsDeliveryStatus` Delivery status of the message. - `const InvestigateBulkListResponseSearchParamsDeliveryStatusDelivered InvestigateBulkListResponseSearchParamsDeliveryStatus = "delivered"` - `const InvestigateBulkListResponseSearchParamsDeliveryStatusMoved InvestigateBulkListResponseSearchParamsDeliveryStatus = "moved"` - `const InvestigateBulkListResponseSearchParamsDeliveryStatusQuarantined InvestigateBulkListResponseSearchParamsDeliveryStatus = "quarantined"` - `const InvestigateBulkListResponseSearchParamsDeliveryStatusRejected InvestigateBulkListResponseSearchParamsDeliveryStatus = "rejected"` - `const InvestigateBulkListResponseSearchParamsDeliveryStatusDeferred InvestigateBulkListResponseSearchParamsDeliveryStatus = "deferred"` - `const InvestigateBulkListResponseSearchParamsDeliveryStatusBounced InvestigateBulkListResponseSearchParamsDeliveryStatus = "bounced"` - `const InvestigateBulkListResponseSearchParamsDeliveryStatusQueued InvestigateBulkListResponseSearchParamsDeliveryStatus = "queued"` - `DetectionsOnly bool` - `Domain string` - `End Time` End of search date range - `ExactSubject string` - `FinalDisposition InvestigateBulkListResponseSearchParamsFinalDisposition` - `const InvestigateBulkListResponseSearchParamsFinalDispositionMalicious InvestigateBulkListResponseSearchParamsFinalDisposition = "MALICIOUS"` - `const InvestigateBulkListResponseSearchParamsFinalDispositionMaliciousBec InvestigateBulkListResponseSearchParamsFinalDisposition = "MALICIOUS-BEC"` - `const InvestigateBulkListResponseSearchParamsFinalDispositionSuspicious InvestigateBulkListResponseSearchParamsFinalDisposition = "SUSPICIOUS"` - `const InvestigateBulkListResponseSearchParamsFinalDispositionSpoof InvestigateBulkListResponseSearchParamsFinalDisposition = "SPOOF"` - `const InvestigateBulkListResponseSearchParamsFinalDispositionSpam InvestigateBulkListResponseSearchParamsFinalDisposition = "SPAM"` - `const InvestigateBulkListResponseSearchParamsFinalDispositionBulk InvestigateBulkListResponseSearchParamsFinalDisposition = "BULK"` - `const InvestigateBulkListResponseSearchParamsFinalDispositionEncrypted InvestigateBulkListResponseSearchParamsFinalDisposition = "ENCRYPTED"` - `const InvestigateBulkListResponseSearchParamsFinalDispositionExternal InvestigateBulkListResponseSearchParamsFinalDisposition = "EXTERNAL"` - `const InvestigateBulkListResponseSearchParamsFinalDispositionUnknown InvestigateBulkListResponseSearchParamsFinalDisposition = "UNKNOWN"` - `const InvestigateBulkListResponseSearchParamsFinalDispositionNone InvestigateBulkListResponseSearchParamsFinalDisposition = "NONE"` - `MessageAction InvestigateBulkListResponseSearchParamsMessageAction` - `const InvestigateBulkListResponseSearchParamsMessageActionPreview InvestigateBulkListResponseSearchParamsMessageAction = "PREVIEW"` - `const InvestigateBulkListResponseSearchParamsMessageActionQuarantineReleased InvestigateBulkListResponseSearchParamsMessageAction = "QUARANTINE_RELEASED"` - `const InvestigateBulkListResponseSearchParamsMessageActionMoved InvestigateBulkListResponseSearchParamsMessageAction = "MOVED"` - `MessageID string` - `Metric string` - `Query string` - `Recipient string` - `Sender string` - `Start Time` Beginning of search date range - `Subject string` - `Submissions bool` - `Status InvestigateBulkListResponseStatus` - `const InvestigateBulkListResponseStatusPending InvestigateBulkListResponseStatus = "PENDING"` - `const InvestigateBulkListResponseStatusDiscovering InvestigateBulkListResponseStatus = "DISCOVERING"` - `const InvestigateBulkListResponseStatusProcessing InvestigateBulkListResponseStatus = "PROCESSING"` - `const InvestigateBulkListResponseStatusCompleted InvestigateBulkListResponseStatus = "COMPLETED"` - `const InvestigateBulkListResponseStatusFailed InvestigateBulkListResponseStatus = "FAILED"` - `const InvestigateBulkListResponseStatusCancelled InvestigateBulkListResponseStatus = "CANCELLED"` - `const InvestigateBulkListResponseStatusSkipped InvestigateBulkListResponseStatus = "SKIPPED"` - `TotalMessagesDiscovered int64` - `Comment string` - `CompletedAt Time` - `StartedAt Time` - `StatusMessage string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) page, err := client.EmailSecurity.Investigate.Bulk.List(context.TODO(), email_security.InvestigateBulkListParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "action_params": { "destination": "Inbox", "type": "MOVE", "expected_disposition": "MALICIOUS" }, "action_type": "MOVE", "created_at": "2019-12-27T18:11:19.117Z", "job_id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "messages_failed": 0, "messages_pending": 0, "messages_successful": 0, "search_params": { "action_log": true, "alert_id": "alert_id", "delivery_status": "delivered", "detections_only": true, "domain": "domain", "end": "2022-07-25T14:30:00Z", "exact_subject": "exact_subject", "final_disposition": "MALICIOUS", "message_action": "PREVIEW", "message_id": "message_id", "metric": "metric", "query": "query", "recipient": "recipient", "sender": "sender", "start": "2022-06-25T14:30:00Z", "subject": "subject", "submissions": true }, "status": "PENDING", "total_messages_discovered": 0, "comment": "comment", "completed_at": "2019-12-27T18:11:19.117Z", "started_at": "2019-12-27T18:11:19.117Z", "status_message": "status_message" } ], "result_info": { "count": 0, "per_page": 0, "total_count": 0, "next": "next", "page": 0, "previous": "previous" }, "success": true } ``` ## Create a bulk action job `client.EmailSecurity.Investigate.Bulk.New(ctx, params) (*InvestigateBulkNewResponse, error)` **post** `/accounts/{account_id}/email-security/investigate/bulk` Creates a new bulk action job to move or release messages that match the provided search parameters. ### Parameters - `params InvestigateBulkNewParams` - `AccountID param.Field[string]` Path param: Identifier. - `Action param.Field[InvestigateBulkNewParamsAction]` Body param - `const InvestigateBulkNewParamsActionMove InvestigateBulkNewParamsAction = "MOVE"` - `const InvestigateBulkNewParamsActionRelease InvestigateBulkNewParamsAction = "RELEASE"` - `SearchParams param.Field[InvestigateBulkNewParamsSearchParams]` Body param - `ActionLog bool` Deprecated, use `GET /investigate/{investigate_id}/action_log` instead. End of life: November 1, 2026. - `AlertID string` - `DeliveryStatus InvestigateBulkNewParamsSearchParamsDeliveryStatus` Delivery status of the message. - `const InvestigateBulkNewParamsSearchParamsDeliveryStatusDelivered InvestigateBulkNewParamsSearchParamsDeliveryStatus = "delivered"` - `const InvestigateBulkNewParamsSearchParamsDeliveryStatusMoved InvestigateBulkNewParamsSearchParamsDeliveryStatus = "moved"` - `const InvestigateBulkNewParamsSearchParamsDeliveryStatusQuarantined InvestigateBulkNewParamsSearchParamsDeliveryStatus = "quarantined"` - `const InvestigateBulkNewParamsSearchParamsDeliveryStatusRejected InvestigateBulkNewParamsSearchParamsDeliveryStatus = "rejected"` - `const InvestigateBulkNewParamsSearchParamsDeliveryStatusDeferred InvestigateBulkNewParamsSearchParamsDeliveryStatus = "deferred"` - `const InvestigateBulkNewParamsSearchParamsDeliveryStatusBounced InvestigateBulkNewParamsSearchParamsDeliveryStatus = "bounced"` - `const InvestigateBulkNewParamsSearchParamsDeliveryStatusQueued InvestigateBulkNewParamsSearchParamsDeliveryStatus = "queued"` - `DetectionsOnly bool` - `Domain string` - `End Time` End of search date range - `ExactSubject string` - `FinalDisposition InvestigateBulkNewParamsSearchParamsFinalDisposition` - `const InvestigateBulkNewParamsSearchParamsFinalDispositionMalicious InvestigateBulkNewParamsSearchParamsFinalDisposition = "MALICIOUS"` - `const InvestigateBulkNewParamsSearchParamsFinalDispositionMaliciousBec InvestigateBulkNewParamsSearchParamsFinalDisposition = "MALICIOUS-BEC"` - `const InvestigateBulkNewParamsSearchParamsFinalDispositionSuspicious InvestigateBulkNewParamsSearchParamsFinalDisposition = "SUSPICIOUS"` - `const InvestigateBulkNewParamsSearchParamsFinalDispositionSpoof InvestigateBulkNewParamsSearchParamsFinalDisposition = "SPOOF"` - `const InvestigateBulkNewParamsSearchParamsFinalDispositionSpam InvestigateBulkNewParamsSearchParamsFinalDisposition = "SPAM"` - `const InvestigateBulkNewParamsSearchParamsFinalDispositionBulk InvestigateBulkNewParamsSearchParamsFinalDisposition = "BULK"` - `const InvestigateBulkNewParamsSearchParamsFinalDispositionEncrypted InvestigateBulkNewParamsSearchParamsFinalDisposition = "ENCRYPTED"` - `const InvestigateBulkNewParamsSearchParamsFinalDispositionExternal InvestigateBulkNewParamsSearchParamsFinalDisposition = "EXTERNAL"` - `const InvestigateBulkNewParamsSearchParamsFinalDispositionUnknown InvestigateBulkNewParamsSearchParamsFinalDisposition = "UNKNOWN"` - `const InvestigateBulkNewParamsSearchParamsFinalDispositionNone InvestigateBulkNewParamsSearchParamsFinalDisposition = "NONE"` - `MessageAction InvestigateBulkNewParamsSearchParamsMessageAction` - `const InvestigateBulkNewParamsSearchParamsMessageActionPreview InvestigateBulkNewParamsSearchParamsMessageAction = "PREVIEW"` - `const InvestigateBulkNewParamsSearchParamsMessageActionQuarantineReleased InvestigateBulkNewParamsSearchParamsMessageAction = "QUARANTINE_RELEASED"` - `const InvestigateBulkNewParamsSearchParamsMessageActionMoved InvestigateBulkNewParamsSearchParamsMessageAction = "MOVED"` - `MessageID string` - `Metric string` - `Query string` - `Recipient string` - `Sender string` - `Start Time` Beginning of search date range - `Subject string` - `Submissions bool` - `Comment param.Field[string]` Body param - `Destination param.Field[InvestigateBulkNewParamsDestination]` Body param - `const InvestigateBulkNewParamsDestinationInbox InvestigateBulkNewParamsDestination = "Inbox"` - `const InvestigateBulkNewParamsDestinationJunkEmail InvestigateBulkNewParamsDestination = "JunkEmail"` - `const InvestigateBulkNewParamsDestinationDeletedItems InvestigateBulkNewParamsDestination = "DeletedItems"` - `const InvestigateBulkNewParamsDestinationRecoverableItemsDeletions InvestigateBulkNewParamsDestination = "RecoverableItemsDeletions"` - `const InvestigateBulkNewParamsDestinationRecoverableItemsPurges InvestigateBulkNewParamsDestination = "RecoverableItemsPurges"` - `ExpectedDisposition param.Field[InvestigateBulkNewParamsExpectedDisposition]` Body param - `const InvestigateBulkNewParamsExpectedDispositionMalicious InvestigateBulkNewParamsExpectedDisposition = "MALICIOUS"` - `const InvestigateBulkNewParamsExpectedDispositionMaliciousBec InvestigateBulkNewParamsExpectedDisposition = "MALICIOUS-BEC"` - `const InvestigateBulkNewParamsExpectedDispositionSuspicious InvestigateBulkNewParamsExpectedDisposition = "SUSPICIOUS"` - `const InvestigateBulkNewParamsExpectedDispositionSpoof InvestigateBulkNewParamsExpectedDisposition = "SPOOF"` - `const InvestigateBulkNewParamsExpectedDispositionSpam InvestigateBulkNewParamsExpectedDisposition = "SPAM"` - `const InvestigateBulkNewParamsExpectedDispositionBulk InvestigateBulkNewParamsExpectedDisposition = "BULK"` - `const InvestigateBulkNewParamsExpectedDispositionEncrypted InvestigateBulkNewParamsExpectedDisposition = "ENCRYPTED"` - `const InvestigateBulkNewParamsExpectedDispositionExternal InvestigateBulkNewParamsExpectedDisposition = "EXTERNAL"` - `const InvestigateBulkNewParamsExpectedDispositionUnknown InvestigateBulkNewParamsExpectedDisposition = "UNKNOWN"` - `const InvestigateBulkNewParamsExpectedDispositionNone InvestigateBulkNewParamsExpectedDisposition = "NONE"` ### Returns - `type InvestigateBulkNewResponse struct{…}` - `ActionParams InvestigateBulkNewResponseActionParams` - `type InvestigateBulkNewResponseActionParamsMove struct{…}` - `Destination InvestigateBulkNewResponseActionParamsMoveDestination` - `const InvestigateBulkNewResponseActionParamsMoveDestinationInbox InvestigateBulkNewResponseActionParamsMoveDestination = "Inbox"` - `const InvestigateBulkNewResponseActionParamsMoveDestinationJunkEmail InvestigateBulkNewResponseActionParamsMoveDestination = "JunkEmail"` - `const InvestigateBulkNewResponseActionParamsMoveDestinationDeletedItems InvestigateBulkNewResponseActionParamsMoveDestination = "DeletedItems"` - `const InvestigateBulkNewResponseActionParamsMoveDestinationRecoverableItemsDeletions InvestigateBulkNewResponseActionParamsMoveDestination = "RecoverableItemsDeletions"` - `const InvestigateBulkNewResponseActionParamsMoveDestinationRecoverableItemsPurges InvestigateBulkNewResponseActionParamsMoveDestination = "RecoverableItemsPurges"` - `Type InvestigateBulkNewResponseActionParamsMoveType` - `const InvestigateBulkNewResponseActionParamsMoveTypeMove InvestigateBulkNewResponseActionParamsMoveType = "MOVE"` - `ExpectedDisposition InvestigateBulkNewResponseActionParamsMoveExpectedDisposition` - `const InvestigateBulkNewResponseActionParamsMoveExpectedDispositionMalicious InvestigateBulkNewResponseActionParamsMoveExpectedDisposition = "MALICIOUS"` - `const InvestigateBulkNewResponseActionParamsMoveExpectedDispositionMaliciousBec InvestigateBulkNewResponseActionParamsMoveExpectedDisposition = "MALICIOUS-BEC"` - `const InvestigateBulkNewResponseActionParamsMoveExpectedDispositionSuspicious InvestigateBulkNewResponseActionParamsMoveExpectedDisposition = "SUSPICIOUS"` - `const InvestigateBulkNewResponseActionParamsMoveExpectedDispositionSpoof InvestigateBulkNewResponseActionParamsMoveExpectedDisposition = "SPOOF"` - `const InvestigateBulkNewResponseActionParamsMoveExpectedDispositionSpam InvestigateBulkNewResponseActionParamsMoveExpectedDisposition = "SPAM"` - `const InvestigateBulkNewResponseActionParamsMoveExpectedDispositionBulk InvestigateBulkNewResponseActionParamsMoveExpectedDisposition = "BULK"` - `const InvestigateBulkNewResponseActionParamsMoveExpectedDispositionEncrypted InvestigateBulkNewResponseActionParamsMoveExpectedDisposition = "ENCRYPTED"` - `const InvestigateBulkNewResponseActionParamsMoveExpectedDispositionExternal InvestigateBulkNewResponseActionParamsMoveExpectedDisposition = "EXTERNAL"` - `const InvestigateBulkNewResponseActionParamsMoveExpectedDispositionUnknown InvestigateBulkNewResponseActionParamsMoveExpectedDisposition = "UNKNOWN"` - `const InvestigateBulkNewResponseActionParamsMoveExpectedDispositionNone InvestigateBulkNewResponseActionParamsMoveExpectedDisposition = "NONE"` - `type InvestigateBulkNewResponseActionParamsRelease struct{…}` - `Type InvestigateBulkNewResponseActionParamsReleaseType` - `const InvestigateBulkNewResponseActionParamsReleaseTypeRelease InvestigateBulkNewResponseActionParamsReleaseType = "RELEASE"` - `ActionType InvestigateBulkNewResponseActionType` - `const InvestigateBulkNewResponseActionTypeMove InvestigateBulkNewResponseActionType = "MOVE"` - `const InvestigateBulkNewResponseActionTypeRelease InvestigateBulkNewResponseActionType = "RELEASE"` - `CreatedAt Time` - `JobID string` - `MessagesFailed int64` - `MessagesPending int64` - `MessagesSuccessful int64` - `SearchParams InvestigateBulkNewResponseSearchParams` - `ActionLog bool` Deprecated, use `GET /investigate/{investigate_id}/action_log` instead. End of life: November 1, 2026. - `AlertID string` - `DeliveryStatus InvestigateBulkNewResponseSearchParamsDeliveryStatus` Delivery status of the message. - `const InvestigateBulkNewResponseSearchParamsDeliveryStatusDelivered InvestigateBulkNewResponseSearchParamsDeliveryStatus = "delivered"` - `const InvestigateBulkNewResponseSearchParamsDeliveryStatusMoved InvestigateBulkNewResponseSearchParamsDeliveryStatus = "moved"` - `const InvestigateBulkNewResponseSearchParamsDeliveryStatusQuarantined InvestigateBulkNewResponseSearchParamsDeliveryStatus = "quarantined"` - `const InvestigateBulkNewResponseSearchParamsDeliveryStatusRejected InvestigateBulkNewResponseSearchParamsDeliveryStatus = "rejected"` - `const InvestigateBulkNewResponseSearchParamsDeliveryStatusDeferred InvestigateBulkNewResponseSearchParamsDeliveryStatus = "deferred"` - `const InvestigateBulkNewResponseSearchParamsDeliveryStatusBounced InvestigateBulkNewResponseSearchParamsDeliveryStatus = "bounced"` - `const InvestigateBulkNewResponseSearchParamsDeliveryStatusQueued InvestigateBulkNewResponseSearchParamsDeliveryStatus = "queued"` - `DetectionsOnly bool` - `Domain string` - `End Time` End of search date range - `ExactSubject string` - `FinalDisposition InvestigateBulkNewResponseSearchParamsFinalDisposition` - `const InvestigateBulkNewResponseSearchParamsFinalDispositionMalicious InvestigateBulkNewResponseSearchParamsFinalDisposition = "MALICIOUS"` - `const InvestigateBulkNewResponseSearchParamsFinalDispositionMaliciousBec InvestigateBulkNewResponseSearchParamsFinalDisposition = "MALICIOUS-BEC"` - `const InvestigateBulkNewResponseSearchParamsFinalDispositionSuspicious InvestigateBulkNewResponseSearchParamsFinalDisposition = "SUSPICIOUS"` - `const InvestigateBulkNewResponseSearchParamsFinalDispositionSpoof InvestigateBulkNewResponseSearchParamsFinalDisposition = "SPOOF"` - `const InvestigateBulkNewResponseSearchParamsFinalDispositionSpam InvestigateBulkNewResponseSearchParamsFinalDisposition = "SPAM"` - `const InvestigateBulkNewResponseSearchParamsFinalDispositionBulk InvestigateBulkNewResponseSearchParamsFinalDisposition = "BULK"` - `const InvestigateBulkNewResponseSearchParamsFinalDispositionEncrypted InvestigateBulkNewResponseSearchParamsFinalDisposition = "ENCRYPTED"` - `const InvestigateBulkNewResponseSearchParamsFinalDispositionExternal InvestigateBulkNewResponseSearchParamsFinalDisposition = "EXTERNAL"` - `const InvestigateBulkNewResponseSearchParamsFinalDispositionUnknown InvestigateBulkNewResponseSearchParamsFinalDisposition = "UNKNOWN"` - `const InvestigateBulkNewResponseSearchParamsFinalDispositionNone InvestigateBulkNewResponseSearchParamsFinalDisposition = "NONE"` - `MessageAction InvestigateBulkNewResponseSearchParamsMessageAction` - `const InvestigateBulkNewResponseSearchParamsMessageActionPreview InvestigateBulkNewResponseSearchParamsMessageAction = "PREVIEW"` - `const InvestigateBulkNewResponseSearchParamsMessageActionQuarantineReleased InvestigateBulkNewResponseSearchParamsMessageAction = "QUARANTINE_RELEASED"` - `const InvestigateBulkNewResponseSearchParamsMessageActionMoved InvestigateBulkNewResponseSearchParamsMessageAction = "MOVED"` - `MessageID string` - `Metric string` - `Query string` - `Recipient string` - `Sender string` - `Start Time` Beginning of search date range - `Subject string` - `Submissions bool` - `Status InvestigateBulkNewResponseStatus` - `const InvestigateBulkNewResponseStatusPending InvestigateBulkNewResponseStatus = "PENDING"` - `const InvestigateBulkNewResponseStatusDiscovering InvestigateBulkNewResponseStatus = "DISCOVERING"` - `const InvestigateBulkNewResponseStatusProcessing InvestigateBulkNewResponseStatus = "PROCESSING"` - `const InvestigateBulkNewResponseStatusCompleted InvestigateBulkNewResponseStatus = "COMPLETED"` - `const InvestigateBulkNewResponseStatusFailed InvestigateBulkNewResponseStatus = "FAILED"` - `const InvestigateBulkNewResponseStatusCancelled InvestigateBulkNewResponseStatus = "CANCELLED"` - `const InvestigateBulkNewResponseStatusSkipped InvestigateBulkNewResponseStatus = "SKIPPED"` - `TotalMessagesDiscovered int64` - `Comment string` - `CompletedAt Time` - `StartedAt Time` - `StatusMessage string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) bulk, err := client.EmailSecurity.Investigate.Bulk.New(context.TODO(), email_security.InvestigateBulkNewParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), Action: cloudflare.F(email_security.InvestigateBulkNewParamsActionMove), SearchParams: cloudflare.F(email_security.InvestigateBulkNewParamsSearchParams{ }), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", bulk.JobID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "action_params": { "destination": "Inbox", "type": "MOVE", "expected_disposition": "MALICIOUS" }, "action_type": "MOVE", "created_at": "2019-12-27T18:11:19.117Z", "job_id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "messages_failed": 0, "messages_pending": 0, "messages_successful": 0, "search_params": { "action_log": true, "alert_id": "alert_id", "delivery_status": "delivered", "detections_only": true, "domain": "domain", "end": "2022-07-25T14:30:00Z", "exact_subject": "exact_subject", "final_disposition": "MALICIOUS", "message_action": "PREVIEW", "message_id": "message_id", "metric": "metric", "query": "query", "recipient": "recipient", "sender": "sender", "start": "2022-06-25T14:30:00Z", "subject": "subject", "submissions": true }, "status": "PENDING", "total_messages_discovered": 0, "comment": "comment", "completed_at": "2019-12-27T18:11:19.117Z", "started_at": "2019-12-27T18:11:19.117Z", "status_message": "status_message" }, "success": true } ``` ## Get bulk action job details `client.EmailSecurity.Investigate.Bulk.Get(ctx, jobID, query) (*InvestigateBulkGetResponse, error)` **get** `/accounts/{account_id}/email-security/investigate/bulk/{job_id}` Returns the status and details of a specific bulk action job. ### Parameters - `jobID string` - `query InvestigateBulkGetParams` - `AccountID param.Field[string]` Identifier. ### Returns - `type InvestigateBulkGetResponse struct{…}` - `ActionParams InvestigateBulkGetResponseActionParams` - `type InvestigateBulkGetResponseActionParamsMove struct{…}` - `Destination InvestigateBulkGetResponseActionParamsMoveDestination` - `const InvestigateBulkGetResponseActionParamsMoveDestinationInbox InvestigateBulkGetResponseActionParamsMoveDestination = "Inbox"` - `const InvestigateBulkGetResponseActionParamsMoveDestinationJunkEmail InvestigateBulkGetResponseActionParamsMoveDestination = "JunkEmail"` - `const InvestigateBulkGetResponseActionParamsMoveDestinationDeletedItems InvestigateBulkGetResponseActionParamsMoveDestination = "DeletedItems"` - `const InvestigateBulkGetResponseActionParamsMoveDestinationRecoverableItemsDeletions InvestigateBulkGetResponseActionParamsMoveDestination = "RecoverableItemsDeletions"` - `const InvestigateBulkGetResponseActionParamsMoveDestinationRecoverableItemsPurges InvestigateBulkGetResponseActionParamsMoveDestination = "RecoverableItemsPurges"` - `Type InvestigateBulkGetResponseActionParamsMoveType` - `const InvestigateBulkGetResponseActionParamsMoveTypeMove InvestigateBulkGetResponseActionParamsMoveType = "MOVE"` - `ExpectedDisposition InvestigateBulkGetResponseActionParamsMoveExpectedDisposition` - `const InvestigateBulkGetResponseActionParamsMoveExpectedDispositionMalicious InvestigateBulkGetResponseActionParamsMoveExpectedDisposition = "MALICIOUS"` - `const InvestigateBulkGetResponseActionParamsMoveExpectedDispositionMaliciousBec InvestigateBulkGetResponseActionParamsMoveExpectedDisposition = "MALICIOUS-BEC"` - `const InvestigateBulkGetResponseActionParamsMoveExpectedDispositionSuspicious InvestigateBulkGetResponseActionParamsMoveExpectedDisposition = "SUSPICIOUS"` - `const InvestigateBulkGetResponseActionParamsMoveExpectedDispositionSpoof InvestigateBulkGetResponseActionParamsMoveExpectedDisposition = "SPOOF"` - `const InvestigateBulkGetResponseActionParamsMoveExpectedDispositionSpam InvestigateBulkGetResponseActionParamsMoveExpectedDisposition = "SPAM"` - `const InvestigateBulkGetResponseActionParamsMoveExpectedDispositionBulk InvestigateBulkGetResponseActionParamsMoveExpectedDisposition = "BULK"` - `const InvestigateBulkGetResponseActionParamsMoveExpectedDispositionEncrypted InvestigateBulkGetResponseActionParamsMoveExpectedDisposition = "ENCRYPTED"` - `const InvestigateBulkGetResponseActionParamsMoveExpectedDispositionExternal InvestigateBulkGetResponseActionParamsMoveExpectedDisposition = "EXTERNAL"` - `const InvestigateBulkGetResponseActionParamsMoveExpectedDispositionUnknown InvestigateBulkGetResponseActionParamsMoveExpectedDisposition = "UNKNOWN"` - `const InvestigateBulkGetResponseActionParamsMoveExpectedDispositionNone InvestigateBulkGetResponseActionParamsMoveExpectedDisposition = "NONE"` - `type InvestigateBulkGetResponseActionParamsRelease struct{…}` - `Type InvestigateBulkGetResponseActionParamsReleaseType` - `const InvestigateBulkGetResponseActionParamsReleaseTypeRelease InvestigateBulkGetResponseActionParamsReleaseType = "RELEASE"` - `ActionType InvestigateBulkGetResponseActionType` - `const InvestigateBulkGetResponseActionTypeMove InvestigateBulkGetResponseActionType = "MOVE"` - `const InvestigateBulkGetResponseActionTypeRelease InvestigateBulkGetResponseActionType = "RELEASE"` - `CreatedAt Time` - `JobID string` - `MessagesFailed int64` - `MessagesPending int64` - `MessagesSuccessful int64` - `SearchParams InvestigateBulkGetResponseSearchParams` - `ActionLog bool` Deprecated, use `GET /investigate/{investigate_id}/action_log` instead. End of life: November 1, 2026. - `AlertID string` - `DeliveryStatus InvestigateBulkGetResponseSearchParamsDeliveryStatus` Delivery status of the message. - `const InvestigateBulkGetResponseSearchParamsDeliveryStatusDelivered InvestigateBulkGetResponseSearchParamsDeliveryStatus = "delivered"` - `const InvestigateBulkGetResponseSearchParamsDeliveryStatusMoved InvestigateBulkGetResponseSearchParamsDeliveryStatus = "moved"` - `const InvestigateBulkGetResponseSearchParamsDeliveryStatusQuarantined InvestigateBulkGetResponseSearchParamsDeliveryStatus = "quarantined"` - `const InvestigateBulkGetResponseSearchParamsDeliveryStatusRejected InvestigateBulkGetResponseSearchParamsDeliveryStatus = "rejected"` - `const InvestigateBulkGetResponseSearchParamsDeliveryStatusDeferred InvestigateBulkGetResponseSearchParamsDeliveryStatus = "deferred"` - `const InvestigateBulkGetResponseSearchParamsDeliveryStatusBounced InvestigateBulkGetResponseSearchParamsDeliveryStatus = "bounced"` - `const InvestigateBulkGetResponseSearchParamsDeliveryStatusQueued InvestigateBulkGetResponseSearchParamsDeliveryStatus = "queued"` - `DetectionsOnly bool` - `Domain string` - `End Time` End of search date range - `ExactSubject string` - `FinalDisposition InvestigateBulkGetResponseSearchParamsFinalDisposition` - `const InvestigateBulkGetResponseSearchParamsFinalDispositionMalicious InvestigateBulkGetResponseSearchParamsFinalDisposition = "MALICIOUS"` - `const InvestigateBulkGetResponseSearchParamsFinalDispositionMaliciousBec InvestigateBulkGetResponseSearchParamsFinalDisposition = "MALICIOUS-BEC"` - `const InvestigateBulkGetResponseSearchParamsFinalDispositionSuspicious InvestigateBulkGetResponseSearchParamsFinalDisposition = "SUSPICIOUS"` - `const InvestigateBulkGetResponseSearchParamsFinalDispositionSpoof InvestigateBulkGetResponseSearchParamsFinalDisposition = "SPOOF"` - `const InvestigateBulkGetResponseSearchParamsFinalDispositionSpam InvestigateBulkGetResponseSearchParamsFinalDisposition = "SPAM"` - `const InvestigateBulkGetResponseSearchParamsFinalDispositionBulk InvestigateBulkGetResponseSearchParamsFinalDisposition = "BULK"` - `const InvestigateBulkGetResponseSearchParamsFinalDispositionEncrypted InvestigateBulkGetResponseSearchParamsFinalDisposition = "ENCRYPTED"` - `const InvestigateBulkGetResponseSearchParamsFinalDispositionExternal InvestigateBulkGetResponseSearchParamsFinalDisposition = "EXTERNAL"` - `const InvestigateBulkGetResponseSearchParamsFinalDispositionUnknown InvestigateBulkGetResponseSearchParamsFinalDisposition = "UNKNOWN"` - `const InvestigateBulkGetResponseSearchParamsFinalDispositionNone InvestigateBulkGetResponseSearchParamsFinalDisposition = "NONE"` - `MessageAction InvestigateBulkGetResponseSearchParamsMessageAction` - `const InvestigateBulkGetResponseSearchParamsMessageActionPreview InvestigateBulkGetResponseSearchParamsMessageAction = "PREVIEW"` - `const InvestigateBulkGetResponseSearchParamsMessageActionQuarantineReleased InvestigateBulkGetResponseSearchParamsMessageAction = "QUARANTINE_RELEASED"` - `const InvestigateBulkGetResponseSearchParamsMessageActionMoved InvestigateBulkGetResponseSearchParamsMessageAction = "MOVED"` - `MessageID string` - `Metric string` - `Query string` - `Recipient string` - `Sender string` - `Start Time` Beginning of search date range - `Subject string` - `Submissions bool` - `Status InvestigateBulkGetResponseStatus` - `const InvestigateBulkGetResponseStatusPending InvestigateBulkGetResponseStatus = "PENDING"` - `const InvestigateBulkGetResponseStatusDiscovering InvestigateBulkGetResponseStatus = "DISCOVERING"` - `const InvestigateBulkGetResponseStatusProcessing InvestigateBulkGetResponseStatus = "PROCESSING"` - `const InvestigateBulkGetResponseStatusCompleted InvestigateBulkGetResponseStatus = "COMPLETED"` - `const InvestigateBulkGetResponseStatusFailed InvestigateBulkGetResponseStatus = "FAILED"` - `const InvestigateBulkGetResponseStatusCancelled InvestigateBulkGetResponseStatus = "CANCELLED"` - `const InvestigateBulkGetResponseStatusSkipped InvestigateBulkGetResponseStatus = "SKIPPED"` - `TotalMessagesDiscovered int64` - `Comment string` - `CompletedAt Time` - `StartedAt Time` - `StatusMessage string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) bulk, err := client.EmailSecurity.Investigate.Bulk.Get( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", email_security.InvestigateBulkGetParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", bulk.JobID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "action_params": { "destination": "Inbox", "type": "MOVE", "expected_disposition": "MALICIOUS" }, "action_type": "MOVE", "created_at": "2019-12-27T18:11:19.117Z", "job_id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "messages_failed": 0, "messages_pending": 0, "messages_successful": 0, "search_params": { "action_log": true, "alert_id": "alert_id", "delivery_status": "delivered", "detections_only": true, "domain": "domain", "end": "2022-07-25T14:30:00Z", "exact_subject": "exact_subject", "final_disposition": "MALICIOUS", "message_action": "PREVIEW", "message_id": "message_id", "metric": "metric", "query": "query", "recipient": "recipient", "sender": "sender", "start": "2022-06-25T14:30:00Z", "subject": "subject", "submissions": true }, "status": "PENDING", "total_messages_discovered": 0, "comment": "comment", "completed_at": "2019-12-27T18:11:19.117Z", "started_at": "2019-12-27T18:11:19.117Z", "status_message": "status_message" }, "success": true } ``` ## Delete a bulk action job `client.EmailSecurity.Investigate.Bulk.Delete(ctx, jobID, body) (*InvestigateBulkDeleteResponse, error)` **delete** `/accounts/{account_id}/email-security/investigate/bulk/{job_id}` Deletes the job, removing it from all list and detail endpoints. Only jobs in a terminal state (`COMPLETED`, `CANCELLED`, `FAILED`, or `SKIPPED`) can be deleted. To stop an in-progress job without removing it, use the cancel endpoint instead. ### Parameters - `jobID string` - `body InvestigateBulkDeleteParams` - `AccountID param.Field[string]` Identifier. ### Returns - `type InvestigateBulkDeleteResponse struct{…}` - `ID string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) bulk, err := client.EmailSecurity.Investigate.Bulk.Delete( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", email_security.InvestigateBulkDeleteParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", bulk.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" }, "success": true } ``` # Cancel ## Cancel a bulk action job `client.EmailSecurity.Investigate.Bulk.Cancel.New(ctx, jobID, body) (*InvestigateBulkCancelNewResponse, error)` **post** `/accounts/{account_id}/email-security/investigate/bulk/{job_id}/cancel` Marks the job as cancelled and stops any pending message processing. The job record remains visible in list and detail endpoints. ### Parameters - `jobID string` - `body InvestigateBulkCancelNewParams` - `AccountID param.Field[string]` Identifier. ### Returns - `type InvestigateBulkCancelNewResponse struct{…}` - `ActionParams InvestigateBulkCancelNewResponseActionParams` - `type InvestigateBulkCancelNewResponseActionParamsMove struct{…}` - `Destination InvestigateBulkCancelNewResponseActionParamsMoveDestination` - `const InvestigateBulkCancelNewResponseActionParamsMoveDestinationInbox InvestigateBulkCancelNewResponseActionParamsMoveDestination = "Inbox"` - `const InvestigateBulkCancelNewResponseActionParamsMoveDestinationJunkEmail InvestigateBulkCancelNewResponseActionParamsMoveDestination = "JunkEmail"` - `const InvestigateBulkCancelNewResponseActionParamsMoveDestinationDeletedItems InvestigateBulkCancelNewResponseActionParamsMoveDestination = "DeletedItems"` - `const InvestigateBulkCancelNewResponseActionParamsMoveDestinationRecoverableItemsDeletions InvestigateBulkCancelNewResponseActionParamsMoveDestination = "RecoverableItemsDeletions"` - `const InvestigateBulkCancelNewResponseActionParamsMoveDestinationRecoverableItemsPurges InvestigateBulkCancelNewResponseActionParamsMoveDestination = "RecoverableItemsPurges"` - `Type InvestigateBulkCancelNewResponseActionParamsMoveType` - `const InvestigateBulkCancelNewResponseActionParamsMoveTypeMove InvestigateBulkCancelNewResponseActionParamsMoveType = "MOVE"` - `ExpectedDisposition InvestigateBulkCancelNewResponseActionParamsMoveExpectedDisposition` - `const InvestigateBulkCancelNewResponseActionParamsMoveExpectedDispositionMalicious InvestigateBulkCancelNewResponseActionParamsMoveExpectedDisposition = "MALICIOUS"` - `const InvestigateBulkCancelNewResponseActionParamsMoveExpectedDispositionMaliciousBec InvestigateBulkCancelNewResponseActionParamsMoveExpectedDisposition = "MALICIOUS-BEC"` - `const InvestigateBulkCancelNewResponseActionParamsMoveExpectedDispositionSuspicious InvestigateBulkCancelNewResponseActionParamsMoveExpectedDisposition = "SUSPICIOUS"` - `const InvestigateBulkCancelNewResponseActionParamsMoveExpectedDispositionSpoof InvestigateBulkCancelNewResponseActionParamsMoveExpectedDisposition = "SPOOF"` - `const InvestigateBulkCancelNewResponseActionParamsMoveExpectedDispositionSpam InvestigateBulkCancelNewResponseActionParamsMoveExpectedDisposition = "SPAM"` - `const InvestigateBulkCancelNewResponseActionParamsMoveExpectedDispositionBulk InvestigateBulkCancelNewResponseActionParamsMoveExpectedDisposition = "BULK"` - `const InvestigateBulkCancelNewResponseActionParamsMoveExpectedDispositionEncrypted InvestigateBulkCancelNewResponseActionParamsMoveExpectedDisposition = "ENCRYPTED"` - `const InvestigateBulkCancelNewResponseActionParamsMoveExpectedDispositionExternal InvestigateBulkCancelNewResponseActionParamsMoveExpectedDisposition = "EXTERNAL"` - `const InvestigateBulkCancelNewResponseActionParamsMoveExpectedDispositionUnknown InvestigateBulkCancelNewResponseActionParamsMoveExpectedDisposition = "UNKNOWN"` - `const InvestigateBulkCancelNewResponseActionParamsMoveExpectedDispositionNone InvestigateBulkCancelNewResponseActionParamsMoveExpectedDisposition = "NONE"` - `type InvestigateBulkCancelNewResponseActionParamsRelease struct{…}` - `Type InvestigateBulkCancelNewResponseActionParamsReleaseType` - `const InvestigateBulkCancelNewResponseActionParamsReleaseTypeRelease InvestigateBulkCancelNewResponseActionParamsReleaseType = "RELEASE"` - `ActionType InvestigateBulkCancelNewResponseActionType` - `const InvestigateBulkCancelNewResponseActionTypeMove InvestigateBulkCancelNewResponseActionType = "MOVE"` - `const InvestigateBulkCancelNewResponseActionTypeRelease InvestigateBulkCancelNewResponseActionType = "RELEASE"` - `CreatedAt Time` - `JobID string` - `MessagesFailed int64` - `MessagesPending int64` - `MessagesSuccessful int64` - `SearchParams InvestigateBulkCancelNewResponseSearchParams` - `ActionLog bool` Deprecated, use `GET /investigate/{investigate_id}/action_log` instead. End of life: November 1, 2026. - `AlertID string` - `DeliveryStatus InvestigateBulkCancelNewResponseSearchParamsDeliveryStatus` Delivery status of the message. - `const InvestigateBulkCancelNewResponseSearchParamsDeliveryStatusDelivered InvestigateBulkCancelNewResponseSearchParamsDeliveryStatus = "delivered"` - `const InvestigateBulkCancelNewResponseSearchParamsDeliveryStatusMoved InvestigateBulkCancelNewResponseSearchParamsDeliveryStatus = "moved"` - `const InvestigateBulkCancelNewResponseSearchParamsDeliveryStatusQuarantined InvestigateBulkCancelNewResponseSearchParamsDeliveryStatus = "quarantined"` - `const InvestigateBulkCancelNewResponseSearchParamsDeliveryStatusRejected InvestigateBulkCancelNewResponseSearchParamsDeliveryStatus = "rejected"` - `const InvestigateBulkCancelNewResponseSearchParamsDeliveryStatusDeferred InvestigateBulkCancelNewResponseSearchParamsDeliveryStatus = "deferred"` - `const InvestigateBulkCancelNewResponseSearchParamsDeliveryStatusBounced InvestigateBulkCancelNewResponseSearchParamsDeliveryStatus = "bounced"` - `const InvestigateBulkCancelNewResponseSearchParamsDeliveryStatusQueued InvestigateBulkCancelNewResponseSearchParamsDeliveryStatus = "queued"` - `DetectionsOnly bool` - `Domain string` - `End Time` End of search date range - `ExactSubject string` - `FinalDisposition InvestigateBulkCancelNewResponseSearchParamsFinalDisposition` - `const InvestigateBulkCancelNewResponseSearchParamsFinalDispositionMalicious InvestigateBulkCancelNewResponseSearchParamsFinalDisposition = "MALICIOUS"` - `const InvestigateBulkCancelNewResponseSearchParamsFinalDispositionMaliciousBec InvestigateBulkCancelNewResponseSearchParamsFinalDisposition = "MALICIOUS-BEC"` - `const InvestigateBulkCancelNewResponseSearchParamsFinalDispositionSuspicious InvestigateBulkCancelNewResponseSearchParamsFinalDisposition = "SUSPICIOUS"` - `const InvestigateBulkCancelNewResponseSearchParamsFinalDispositionSpoof InvestigateBulkCancelNewResponseSearchParamsFinalDisposition = "SPOOF"` - `const InvestigateBulkCancelNewResponseSearchParamsFinalDispositionSpam InvestigateBulkCancelNewResponseSearchParamsFinalDisposition = "SPAM"` - `const InvestigateBulkCancelNewResponseSearchParamsFinalDispositionBulk InvestigateBulkCancelNewResponseSearchParamsFinalDisposition = "BULK"` - `const InvestigateBulkCancelNewResponseSearchParamsFinalDispositionEncrypted InvestigateBulkCancelNewResponseSearchParamsFinalDisposition = "ENCRYPTED"` - `const InvestigateBulkCancelNewResponseSearchParamsFinalDispositionExternal InvestigateBulkCancelNewResponseSearchParamsFinalDisposition = "EXTERNAL"` - `const InvestigateBulkCancelNewResponseSearchParamsFinalDispositionUnknown InvestigateBulkCancelNewResponseSearchParamsFinalDisposition = "UNKNOWN"` - `const InvestigateBulkCancelNewResponseSearchParamsFinalDispositionNone InvestigateBulkCancelNewResponseSearchParamsFinalDisposition = "NONE"` - `MessageAction InvestigateBulkCancelNewResponseSearchParamsMessageAction` - `const InvestigateBulkCancelNewResponseSearchParamsMessageActionPreview InvestigateBulkCancelNewResponseSearchParamsMessageAction = "PREVIEW"` - `const InvestigateBulkCancelNewResponseSearchParamsMessageActionQuarantineReleased InvestigateBulkCancelNewResponseSearchParamsMessageAction = "QUARANTINE_RELEASED"` - `const InvestigateBulkCancelNewResponseSearchParamsMessageActionMoved InvestigateBulkCancelNewResponseSearchParamsMessageAction = "MOVED"` - `MessageID string` - `Metric string` - `Query string` - `Recipient string` - `Sender string` - `Start Time` Beginning of search date range - `Subject string` - `Submissions bool` - `Status InvestigateBulkCancelNewResponseStatus` - `const InvestigateBulkCancelNewResponseStatusPending InvestigateBulkCancelNewResponseStatus = "PENDING"` - `const InvestigateBulkCancelNewResponseStatusDiscovering InvestigateBulkCancelNewResponseStatus = "DISCOVERING"` - `const InvestigateBulkCancelNewResponseStatusProcessing InvestigateBulkCancelNewResponseStatus = "PROCESSING"` - `const InvestigateBulkCancelNewResponseStatusCompleted InvestigateBulkCancelNewResponseStatus = "COMPLETED"` - `const InvestigateBulkCancelNewResponseStatusFailed InvestigateBulkCancelNewResponseStatus = "FAILED"` - `const InvestigateBulkCancelNewResponseStatusCancelled InvestigateBulkCancelNewResponseStatus = "CANCELLED"` - `const InvestigateBulkCancelNewResponseStatusSkipped InvestigateBulkCancelNewResponseStatus = "SKIPPED"` - `TotalMessagesDiscovered int64` - `Comment string` - `CompletedAt Time` - `StartedAt Time` - `StatusMessage string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) cancel, err := client.EmailSecurity.Investigate.Bulk.Cancel.New( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", email_security.InvestigateBulkCancelNewParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", cancel.JobID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "action_params": { "destination": "Inbox", "type": "MOVE", "expected_disposition": "MALICIOUS" }, "action_type": "MOVE", "created_at": "2019-12-27T18:11:19.117Z", "job_id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "messages_failed": 0, "messages_pending": 0, "messages_successful": 0, "search_params": { "action_log": true, "alert_id": "alert_id", "delivery_status": "delivered", "detections_only": true, "domain": "domain", "end": "2022-07-25T14:30:00Z", "exact_subject": "exact_subject", "final_disposition": "MALICIOUS", "message_action": "PREVIEW", "message_id": "message_id", "metric": "metric", "query": "query", "recipient": "recipient", "sender": "sender", "start": "2022-06-25T14:30:00Z", "subject": "subject", "submissions": true }, "status": "PENDING", "total_messages_discovered": 0, "comment": "comment", "completed_at": "2019-12-27T18:11:19.117Z", "started_at": "2019-12-27T18:11:19.117Z", "status_message": "status_message" }, "success": true } ``` # Messages ## List messages for a bulk action job `client.EmailSecurity.Investigate.Bulk.Messages.List(ctx, jobID, params) (*V4PagePaginationArray[InvestigateBulkMessageListResponse], error)` **get** `/accounts/{account_id}/email-security/investigate/bulk/{job_id}/messages` Returns the individual messages associated with a bulk action job, including their processing status. ### Parameters - `jobID string` - `params InvestigateBulkMessageListParams` - `AccountID param.Field[string]` Path param: Identifier. - `Page param.Field[int64]` Query param: Current page within paginated list of results. - `PerPage param.Field[int64]` Query param: The number of results per page. Maximum value is 1000. - `Status param.Field[InvestigateBulkMessageListParamsStatus]` Query param - `const InvestigateBulkMessageListParamsStatusPending InvestigateBulkMessageListParamsStatus = "PENDING"` - `const InvestigateBulkMessageListParamsStatusDiscovering InvestigateBulkMessageListParamsStatus = "DISCOVERING"` - `const InvestigateBulkMessageListParamsStatusProcessing InvestigateBulkMessageListParamsStatus = "PROCESSING"` - `const InvestigateBulkMessageListParamsStatusCompleted InvestigateBulkMessageListParamsStatus = "COMPLETED"` - `const InvestigateBulkMessageListParamsStatusFailed InvestigateBulkMessageListParamsStatus = "FAILED"` - `const InvestigateBulkMessageListParamsStatusCancelled InvestigateBulkMessageListParamsStatus = "CANCELLED"` - `const InvestigateBulkMessageListParamsStatusSkipped InvestigateBulkMessageListParamsStatus = "SKIPPED"` ### Returns - `type InvestigateBulkMessageListResponse struct{…}` - `ActionParams InvestigateBulkMessageListResponseActionParams` - `type InvestigateBulkMessageListResponseActionParamsMove struct{…}` - `ClientRecipient string` - `Destination InvestigateBulkMessageListResponseActionParamsMoveDestination` - `const InvestigateBulkMessageListResponseActionParamsMoveDestinationInbox InvestigateBulkMessageListResponseActionParamsMoveDestination = "Inbox"` - `const InvestigateBulkMessageListResponseActionParamsMoveDestinationJunkEmail InvestigateBulkMessageListResponseActionParamsMoveDestination = "JunkEmail"` - `const InvestigateBulkMessageListResponseActionParamsMoveDestinationDeletedItems InvestigateBulkMessageListResponseActionParamsMoveDestination = "DeletedItems"` - `const InvestigateBulkMessageListResponseActionParamsMoveDestinationRecoverableItemsDeletions InvestigateBulkMessageListResponseActionParamsMoveDestination = "RecoverableItemsDeletions"` - `const InvestigateBulkMessageListResponseActionParamsMoveDestinationRecoverableItemsPurges InvestigateBulkMessageListResponseActionParamsMoveDestination = "RecoverableItemsPurges"` - `Type InvestigateBulkMessageListResponseActionParamsMoveType` - `const InvestigateBulkMessageListResponseActionParamsMoveTypeMove InvestigateBulkMessageListResponseActionParamsMoveType = "MOVE"` - `ExpectedDisposition InvestigateBulkMessageListResponseActionParamsMoveExpectedDisposition` - `const InvestigateBulkMessageListResponseActionParamsMoveExpectedDispositionMalicious InvestigateBulkMessageListResponseActionParamsMoveExpectedDisposition = "MALICIOUS"` - `const InvestigateBulkMessageListResponseActionParamsMoveExpectedDispositionMaliciousBec InvestigateBulkMessageListResponseActionParamsMoveExpectedDisposition = "MALICIOUS-BEC"` - `const InvestigateBulkMessageListResponseActionParamsMoveExpectedDispositionSuspicious InvestigateBulkMessageListResponseActionParamsMoveExpectedDisposition = "SUSPICIOUS"` - `const InvestigateBulkMessageListResponseActionParamsMoveExpectedDispositionSpoof InvestigateBulkMessageListResponseActionParamsMoveExpectedDisposition = "SPOOF"` - `const InvestigateBulkMessageListResponseActionParamsMoveExpectedDispositionSpam InvestigateBulkMessageListResponseActionParamsMoveExpectedDisposition = "SPAM"` - `const InvestigateBulkMessageListResponseActionParamsMoveExpectedDispositionBulk InvestigateBulkMessageListResponseActionParamsMoveExpectedDisposition = "BULK"` - `const InvestigateBulkMessageListResponseActionParamsMoveExpectedDispositionEncrypted InvestigateBulkMessageListResponseActionParamsMoveExpectedDisposition = "ENCRYPTED"` - `const InvestigateBulkMessageListResponseActionParamsMoveExpectedDispositionExternal InvestigateBulkMessageListResponseActionParamsMoveExpectedDisposition = "EXTERNAL"` - `const InvestigateBulkMessageListResponseActionParamsMoveExpectedDispositionUnknown InvestigateBulkMessageListResponseActionParamsMoveExpectedDisposition = "UNKNOWN"` - `const InvestigateBulkMessageListResponseActionParamsMoveExpectedDispositionNone InvestigateBulkMessageListResponseActionParamsMoveExpectedDisposition = "NONE"` - `type InvestigateBulkMessageListResponseActionParamsRelease struct{…}` - `ClientRecipient string` - `Type InvestigateBulkMessageListResponseActionParamsReleaseType` - `const InvestigateBulkMessageListResponseActionParamsReleaseTypeRelease InvestigateBulkMessageListResponseActionParamsReleaseType = "RELEASE"` - `ActionType InvestigateBulkMessageListResponseActionType` - `const InvestigateBulkMessageListResponseActionTypeMove InvestigateBulkMessageListResponseActionType = "MOVE"` - `const InvestigateBulkMessageListResponseActionTypeRelease InvestigateBulkMessageListResponseActionType = "RELEASE"` - `CreatedAt Time` - `MessageID string` - `PostfixID string` - `RetryCount int64` - `Status InvestigateBulkMessageListResponseStatus` - `const InvestigateBulkMessageListResponseStatusPending InvestigateBulkMessageListResponseStatus = "PENDING"` - `const InvestigateBulkMessageListResponseStatusDiscovering InvestigateBulkMessageListResponseStatus = "DISCOVERING"` - `const InvestigateBulkMessageListResponseStatusProcessing InvestigateBulkMessageListResponseStatus = "PROCESSING"` - `const InvestigateBulkMessageListResponseStatusCompleted InvestigateBulkMessageListResponseStatus = "COMPLETED"` - `const InvestigateBulkMessageListResponseStatusFailed InvestigateBulkMessageListResponseStatus = "FAILED"` - `const InvestigateBulkMessageListResponseStatusCancelled InvestigateBulkMessageListResponseStatus = "CANCELLED"` - `const InvestigateBulkMessageListResponseStatusSkipped InvestigateBulkMessageListResponseStatus = "SKIPPED"` - `AlertID string` - `EmailMessageID string` - `ProcessedAt Time` - `RetryAfter Time` When to retry the action if it failed - `StatusMessage string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/email_security" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) page, err := client.EmailSecurity.Investigate.Bulk.Messages.List( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", email_security.InvestigateBulkMessageListParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "action_params": { "client_recipient": "client_recipient", "destination": "Inbox", "type": "MOVE", "expected_disposition": "MALICIOUS" }, "action_type": "MOVE", "created_at": "2019-12-27T18:11:19.117Z", "message_id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "postfix_id": "postfix_id", "retry_count": 0, "status": "PENDING", "alert_id": "alert_id", "email_message_id": "email_message_id", "processed_at": "2019-12-27T18:11:19.117Z", "retry_after": "2019-12-27T18:11:19.117Z", "status_message": "status_message" } ], "result_info": { "count": 0, "per_page": 0, "total_count": 0, "next": "next", "page": 0, "previous": "previous" }, "success": true } ```