Guide — Quarantine

{
    "beginDate": "2012-06-26T11:55:36.100Z", //Messages quarantined on or after this date will be included in the response. Used along with 'endDate' parameter.
    "endDate": "2012-06-26T11:55:36.100Z", //Messages quarantined on or before this date will be included in the response. Used along with 'beginDate' parameter.
    "fields": [  //The fields to return in a partial response.
        "reason"
    ],
    "pageFromKey": 1, //From where to start searching the records.
    "pageSize": 50, //The size of the page to fetch.
    "sort": [
      "forRecipient:DESC" //Defines how to sort the data.
    ],
    "filter": { //Filtering conditions.
      "id": "15a7f8ea-691c-4f03-862e-3cefb102818e", //ID from 'X-Sophos-Email-ID' header.
      "fromContains": "some text", //Return all rows which contains the provided text in from field.
      "toContains": "some text", //Return all rows which contains the provided text in to field.
      "subjectContains": "some text", //Return all rows which contains the provided text in subject field.
      "attachmentNameContains": "some text", //Return all rows which contains the provided text in attachment names.
      "sizeInMBGreaterThan": 1, //Return all rows where the message size in MB is greater than the provided value.
      "sizeInMBLowerThan": 2, //Return all rows where the message size in MB is less than the provided value.
      "productType": "mailflow", //Type of email product.
      "reason": ["malware"], //Return all rows where the reason matched the reason for quarantined
      "hasAnyAttachment": false //Return all rows where email has at least one attachment
    }
}

{
    "items": [
        {
            "id": "90323e39-c4fe-457a-819d-642c48c03e1f", // The value of ‘x-sophos-email-id’ MIME header.
            "mimeMessageId": "<1089064268.5.1660605924821@ip-10-104-116-115>", // The value of 'message-id' MIME header.
            "envelopeSender": {      //Email address using in 'MAIL FROM' command.
                "localAddress": "user1",
                "domainAddress": "test.com"
            },
            "envelopeRecipients": [   //List of email addresses from 'RCPT TO' command.
                {
                    "localAddress": "admin",
                    "domainAddress": "dev.euw.emailblr1.com"
                },
                {
                    "localAddress": "user_2",
                    "domainAddress": "dev.euw.emailblr1.com"
                },
                {
                    "localAddress": "neo_dl",
                    "domainAddress": "dev.euw.emailblr1.com"
                }
            ],
            "from": {    // Name and email address in the 'From' MIME header.
                "name": "user name",
                "localAddress": "user1",
                "domainAddress": "test.com"
            },
            "to": [     // Names and email addresses in the 'To' MIME header.
                {
                    "name": "user name",
                    "localAddress": "user_2",
                    "domainAddress": "dev.euw.emailblr1.com"
                }
            ],
            "cc": [ // Names and email addresses in the 'To' MIME header.
                {
                    "name": "user name",
                    "localAddress": "admin",
                    "domainAddress": "dev.euw.emailblr1.com"
                }
            ],
            "subject": "user name", //Subject of the message.
            "direction": "inbound",  // Direction of the message.
            "sizeInBytes": 70,  // Size of the message in bytes.
            "clientIp": "64.86.143.204", //IP address from which the message was sent.
            "sentAt": "2022-12-18T10:36:32.664Z", //Timestamp from the 'Date' MIME header.
            "receivedAt": "2022-12-18T10:36:32.664Z", //Timestamp the message was received by Sophos.
            "quarantinedAt": "2022-12-18T10:36:37.422Z", //Timestamp the message was quarantined.
            "productType": "gateway",  // Email product type. Either 'gateway' or 'mailflow'
            "attachments": {  // Information about the attachments in the message
                "total": 0,
                "size": 0
            },
            "forRecipient": "neo_dl@dev.euw.emailblr1.com", //Recipient for whom the message was quarantined.
            "reason": "maliciousUrl", //Reason for quarantining the message.
            "reasonDetail": "{\"urls\":[\"http://sophostest.com/malware/index.html#eeo0s8dgg4\"]}". // Additional details on why the message was quarantined.
        }
    ],
    "pages": {
        "nextKey": "MjAyMi0xMi0xOFQxMDozNjozNy4==", //The key to be used in 'pageFromKey' field for getting the next page
        "size": 1, // The page size. You can change this by passing
                   // pageSize=<number> as a query param.
        "total": 3, // Total number of pages.
        "items": 3, // The total number of items on all the pages.
        "maxSize": 100 // Maximum page size allowed
    }
}

{
    //Array listing each MIME header
    "headers": [
        "To: =?UTF-8?B?dXNlciBuYW1l?= user_bob@example.com<user_bob@example.com>",
        "From: =?UTF-8?B?RmxpcGthcnQ=?= <no-reply@ncp.example.com>",
        "Cc: =?UTF-8?B?dXNlciBuYW1l?= cc@recipient.com",
        "Subject: =?UTF-8?B?8J+HrvCfh7NJbmRpYSwgd2UgaGF2ZSB6YWJhcmRhc3QgbmV3cyE=?=",
        "Message-Id: <cdakca16596378617636312@ncp.example.com>",
        "MIME-Version: 1.0",
        "Content-Type: multipart/alternative;"
    ],
    //The HTML body part of the message
    "htmlBody": "\n\n   \n   \n   \n  <table class=\"body-wrapper\" align=\"center\"><tbody><tr></tbody></table> \n      \n     \n <p> <br /></p>\n\n",
    //The Text body part of the message
    "textBody": "We hope you enjoy emails from Example Inc. If you wish to\nunsubscribe, please click here .   "
}

{
    //Array listing each URL in message body.
    "items": [
        "delivery.ncp.flipkart.com/HCIPJTENG"
    ],
    "pages": {
        "current": 1, //The current page number.
        "size": 1, // The page size. You can change this by passing
                   // pageSize=<number> as a query param.
        "total": 1,  // Total number of pages.
        "items": 1, // The total number of items on all the pages.
        "maxSize": 500 // Maximum page size allowed
    }
}

{
    //Array of attachment object.
    "items": [
        {
            "name": "empty-file",  //Name of the attached file.
            "sizeInBytes": 1699,   //Size of the attachment in bytes.
            "stripped": false //Whether the attachment is stripped from the message.
        }
    ],
    "pages": {
        "current": 1, //The current page number.
        "size": 1, // The page size. You can change this by passing
                   // pageSize=<number> as a query param.
        "total": 1,  // Total number of pages.
        "items": 1, // The total number of items on all the pages.
        "maxSize": 500 // Maximum page size allowed
    }
}

{
    //Array of items to release.
    "items": [{
         //The ID of the message to release.
         //The message will be deleted for all recipients.
         "id": "6761806c-9a7d-4689-a63f-03f5da54d1e8"
    },
    {
        //The ID of the message to release.
        "id": "7ea38ef5-6608-4c92-a7f5-21f9eb3e698b",
        //Specific recipients for whom the message should be released.
        "forRecipients": ["user_1@dev.euw.emailblr1.com"]
    }],
    "allowSender" : true,  //After release, should the sender be added to allow list.
    "enforceSenderAuthentication" : true,  //Should sender authentication be done while enforcing allow list.
    "submitMessageToLabs": false //Should we send this message to Sophos Labs as a FP.
}

{
    //Messages which were released successfully.
    "items": [
        {
            //The ID of the message released.
            "id": "6761806c-9a7d-4689-a63f-03f5da54d1e8",
            //The recipient address for which the mail was released.
            "recipient": "user_2@dev.euw.emailblr1.com"
        },
        {
            "id": "7ea38ef5-6608-4c92-a7f5-21f9eb3e698b",
            "recipient": "user_1@dev.euw.emailblr1.com"
        }
    ],
    //Messages which were not released due to an error.
    "errors": [
        {
            //The ID of the message.
            "id": "6761806c-9a7d-4689-a63f-03f5da54d1e8",
            //The recipient address for which the release failed.
            "recipient": "user_@@dev.euw.emailblr1.com",
            //Error code indicating the reason for failure.
            "error": "alreadyReleased"
        }
    ]
}

{
    //Array of items to delete.
    "items": [{
        //The ID of the message to delete.
        //The message will be deleted for all recipients.
        "id": "6761806c-9a7d-4689-a63f-03f5da54d1e8"
    },
    {
        //The ID of the message to delete.
        "id": "7ea38ef5-6608-4c92-a7f5-21f9eb3e698b",
        //Optional. Specific recipients for whom the message should be deleted.
        "forRecipients": ["user_1@dev.euw.emailblr1.com"]
    }],
    "blockSender" : true,  //After release, should the sender be added to block list.
}

{
    //Messages which were deleted successfully.
    "items": [
        {
            //The ID of the message deleted.
            "id": "6761806c-9a7d-4689-a63f-03f5da54d1e8",
            //The recipient address for which the mail was deleted.
            "recipient": "user_2@dev.euw.emailblr1.com"
        },
        {
            "id": "7ea38ef5-6608-4c92-a7f5-21f9eb3e698b",
            "recipient": "user_1@dev.euw.emailblr1.com"
        }
    ],
    //Messages which were not deleted due to an error.
    "errors": [
        {
            //The ID of the message.
            "id": "6761806c-9a7d-4689-a63f-03f5da54d1e8",
            //The recipient address for which the delete failed.
            "recipient": "user_@@dev.euw.emailblr1.com",
            //Error code indicating the reason for failure.
            "error": "alreadyReleased"
        }
    ]
}

{
  //Names of attachments that needs to be stripped from the message.
  "attachments": [
    "SANDSTORM_MALICIOUS.doc",
    "invalid_name.doc"
  ],
  //Optional list of recipients. If specified, attachments are stripped only for these recipients.
  "forRecipients" : ["user_2@dev.euw.emailblr1.com", "admin@dev.euw.emailblr1.com"]
}

{
    //Attachments which were stripped successfully.
    "items": [
        {
            //Name of the attachment.
            "attachment": "SANDSTORM_MALICIOUS.doc",
            //Recipient for whom the attachment was stripped.
            "recipient": "admin@dev.euw.emailblr1.com"
        },
        {
            "attachment": "SANDSTORM_MALICIOUS.doc",
            "recipient": "user_2@dev.euw.emailblr1.com"
        }
    ],
    //Attachments which were not stripped due to errors.
    "errors": [
        {
            //Name of the attachment.
            "attachment": "invalid_name.doc",
            //Recipient for whom the attachment was not stripped.
            "recipient": "admin@dev.euw.emailblr1.com",
            //Error code indicating the reason for failure.
            "error": "notFound"
        },
        {
            "attachment": "invalid_name.doc",
            "recipient": "user_2@dev.euw.emailblr1.com",
            "error": "notFound"
        }
    ]
}

{
  //Names of attachments that needs to be reattached to the message.
  "attachments": [
    "SANDSTORM_MALICIOUS.doc",
    "invalid_name.doc"
  ],
  //Optional list of recipients. If specified, attachments are reattached only for these recipients.
  "forRecipients" : ["user_2@dev.euw.emailblr1.com", "admin@dev.euw.emailblr1.com"]
}

{
    //Attachments which were reattached successfully.
    "items": [
        {
            //Name of the attachment.
            "attachment": "SANDSTORM_MALICIOUS.doc",
            //Recipient for whom the attachment was reattached.
            "recipient": "admin@dev.euw.emailblr1.com"
        },
        {
            "attachment": "SANDSTORM_MALICIOUS.doc",
            "recipient": "user_2@dev.euw.emailblr1.com"
        }
    ],
    //Attachments which were not reattached due to errors.
    "errors": [
        {
            //Name of the attachment.
            "attachment": "invalid_name.doc",
            //Recipient for whom the attachment was not reattached.
            "recipient": "admin@dev.euw.emailblr1.com",
            //Error code indicating the reason for failure.
            "error": "notFound"
        },
        {
            "attachment": "invalid_name.doc",
            "recipient": "user_2@dev.euw.emailblr1.com",
            "error": "notFound"
        }
    ]
}

{
  //Optional array of attachment names. If not specified, all attachments will be downloaded
  "attachments": [
    "sandbox_virus_3.zip"
  ]
}

{
    // Id of the download job.
    "id": "0fa3ce67-02cf-4261-8940-04b57fd4d8d5",
    "status": "processing"
}

{
    //Id of the job.
    "id": "0fa3ce67-02cf-4261-8940-04b57fd4d8d5",
    //Status of the job
    "status": "completed",
    //Names of attachments included in the zip file.
    "attachments": [
        "sandbox_virus_3.zip"
    ],
    //URL from where the zip file can be downloaded.
    "url": "https://<bucket>.s3.<region>.amazonaws.com/downloads/attachments/<id>/<uuid>/<file-hash>.zip?X-Amz-Security-Token=<security-token>&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=<date>&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=<access-key-id>%2F<date>%2F<region>%2Fs3%2Faws4_request&X-Amz-Signature=<signature>",
    //Password to open the zip file.  Present only if any of the attachment was identified as virus.
    "password": "<zip-password>"
}