Skip to content

Search quarantine

POST/post-delivery-quarantine/messages/search

Email Management API · Post-Delivery Quarantine

Summary of all the post-delivery quarantined messages matching your search and filter conditions.

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.

Request body

Content type: application/json

Request body fields

beginDatestring (date-time)required
Messages quarantined on or after this date. Used with endDate.
endDatestring (date-time)required
Messages quarantined on or after this date. Used with beginDate.
pageinteger
The 1-based index of the page to fetch.
pageSizeinteger
The size of the page requested.
Must be ≤ 100.
sortarray of string
Defines how to sort the data. Supported fields are from, quarantinedAt, forRecipient, and reason.
filterobject
Filtering conditions.
Show child attributesHide child attributes
idstring (uuid)
ID from 'X-Sophos-Email-ID' header.
fromContainsstring
Return all rows which contains the provided text in from field.
toContainsstring
Return all rows which contains the provided text in to field.
subjectContainsstring
Return all rows which contains the provided text in subject field.
attachmentNameContainsstring
Return all rows which contains the provided text in attachment names.
sizeInMBGreaterThannumber
Return all rows where the message size in MB is greater than the provided value.
sizeInMBLowerThannumber
Return all rows where the message size in MB is less than the provided value.
productTypestring
Email product.
Must be one of: mailflow, gateway, ems.
reasonarray of string
Each item must be one of: malware, maliciousUrl, onDemand.
hasAnyAttachmentboolean
Return all rows where email has at least one attachment.

Request samples

curl -X POST "https://api-<data-region>.central.sophos.com/email/v1/post-delivery-quarantine/messages/search" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"beginDate\": \"2012-06-26T11:55:36.100Z\",
  \"endDate\": \"2012-06-26T11:55:36.100Z\",
  \"page\": 1,
  \"pageSize\": 50,
  \"sort\": [
    \"forRecipient:DESC\"
  ],
  \"filter\": {
    \"id\": \"15a7f8ea-691c-4f03-862e-3cefb102818e\",
    \"fromContains\": \"some text\",
    \"toContains\": \"some text\",
    \"subjectContains\": \"some text\",
    \"attachmentNameContains\": \"some text\",
    \"sizeInMBGreaterThan\": 1,
    \"sizeInMBLowerThan\": 2,
    \"productType\": \"mailflow\",
    \"reason\": [
      \"malware\"
    ],
    \"hasAnyAttachment\": false
  }
}"


import requests

response = requests.post(
    "https://api-<data-region>.central.sophos.com/email/v1/post-delivery-quarantine/messages/search",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={   'beginDate': '2012-06-26T11:55:36.100Z',
    'endDate': '2012-06-26T11:55:36.100Z',
    'page': 1,
    'pageSize': 50,
    'sort': ['forRecipient:DESC'],
    'filter': {   'id': '15a7f8ea-691c-4f03-862e-3cefb102818e',
                  'fromContains': 'some text',
                  'toContains': 'some text',
                  'subjectContains': 'some text',
                  'attachmentNameContains': 'some text',
                  'sizeInMBGreaterThan': 1,
                  'sizeInMBLowerThan': 2,
                  'productType': 'mailflow',
                  'reason': ['malware'],
                  'hasAnyAttachment': False}},
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "beginDate": "2012-06-26T11:55:36.100Z",
  "endDate": "2012-06-26T11:55:36.100Z",
  "page": 1,
  "pageSize": 50,
  "sort": [
    "forRecipient:DESC"
  ],
  "filter": {
    "id": "15a7f8ea-691c-4f03-862e-3cefb102818e",
    "fromContains": "some text",
    "toContains": "some text",
    "subjectContains": "some text",
    "attachmentNameContains": "some text",
    "sizeInMBGreaterThan": 1,
    "sizeInMBLowerThan": 2,
    "productType": "mailflow",
    "reason": [
      "malware"
    ],
    "hasAnyAttachment": false
  }
}'
Invoke-RestMethod -Method POST -Uri "https://api-<data-region>.central.sophos.com/email/v1/post-delivery-quarantine/messages/search" -Headers $headers -Body $body -ContentType "application/json"


package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("POST", "https://api-<data-region>.central.sophos.com/email/v1/post-delivery-quarantine/messages/search", strings.NewReader(`{
  "beginDate": "2012-06-26T11:55:36.100Z",
  "endDate": "2012-06-26T11:55:36.100Z",
  "page": 1,
  "pageSize": 50,
  "sort": [
    "forRecipient:DESC"
  ],
  "filter": {
    "id": "15a7f8ea-691c-4f03-862e-3cefb102818e",
    "fromContains": "some text",
    "toContains": "some text",
    "subjectContains": "some text",
    "attachmentNameContains": "some text",
    "sizeInMBGreaterThan": 1,
    "sizeInMBLowerThan": 2,
    "productType": "mailflow",
    "reason": [
      "malware"
    ],
    "hasAnyAttachment": false
  }
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/email/v1/post-delivery-quarantine/messages/search", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "beginDate": "2012-06-26T11:55:36.100Z",
  "endDate": "2012-06-26T11:55:36.100Z",
  "page": 1,
  "pageSize": 50,
  "sort": [
    "forRecipient:DESC"
  ],
  "filter": {
    "id": "15a7f8ea-691c-4f03-862e-3cefb102818e",
    "fromContains": "some text",
    "toContains": "some text",
    "subjectContains": "some text",
    "attachmentNameContains": "some text",
    "sizeInMBGreaterThan": 1,
    "sizeInMBLowerThan": 2,
    "productType": "mailflow",
    "reason": [
      "malware"
    ],
    "hasAnyAttachment": false
  }
}),
});
const data = await response.json();
console.log(data);

Responses

200 — Post-Delivery quarantined messages.

Response fields

pagesobjectrequired
Show child attributesHide child attributes
currentintegerrequired
The 1-based page number being returned.
sizeintegerrequired
The size of the page being returned.
totalinteger
(Optional) The total number of pages that exist, if pageTotal=true in the request.
itemsinteger
(Optional) The total number of items across all pages.
maxSizeintegerrequired
The maximum page size that can be requested.
itemsarray of objectrequired
List of post-delivery-quarantined messages.
Show child attributesHide child attributes
idstring (uuid)required
ID from 'X-Sophos-Email-ID' header.
mimeMessageIdstring
ID from 'message-id' MIME header.
o365MessageIdstringrequired
O365 Message id.
envelopeSenderobject
Email address and optional display name.
Show child attributesHide child attributes
namestring
Name of the sender or recipient.
localAddressstringrequired
Local part of the mail address of the sender or recipient.
domainAddressstringrequired
Domain part of the mail address of the sender or recipient.
toarray of object
List of email addresses listed in 'To' header.
Email address and optional display name.
Show child attributesHide child attributes
namestring
Name of the sender or recipient.
localAddressstringrequired
Local part of the mail address of the sender or recipient.
domainAddressstringrequired
Domain part of the mail address of the sender or recipient.
ccarray of object
List of email addresses listed in 'Cc' header.
Email address and optional display name.
Show child attributesHide child attributes
namestring
Name of the sender or recipient.
localAddressstringrequired
Local part of the mail address of the sender or recipient.
domainAddressstringrequired
Domain part of the mail address of the sender or recipient.
subjectstring
Message subject.
sizeInBytesnumber
Message size, in bytes.
clientIpstring
IP address from where the message was sent.
sentAtstring (date-time)
Time from 'Date' MIME header.
quarantinedAtstring (date-time)required
Time the message was quarantined post-delivery.
productTypestring
Email product.
Must be one of: mailflow, gateway, ems.
attachmentsobject
Show child attributesHide child attributes
totalintegerrequired
Total number of attachments found in the message.
itemsarray of objectrequired
Must contain at most 100 items.
Attachment details.
Show child attributesHide child attributes
namestring
Attachment name.
sizeInBytesnumber
Attachment size, in bytes.
forRecipientstringrequired
Email address for the post-delivery quarantined message.
reasonstringrequired
Reason for clawback.
Must be one of: malware, maliciousUrl, onDemand.

Errors

Status Meaning
400 Bad request.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "pages": {
    "current": 0,
    "size": 0,
    "total": 0,
    "items": 0,
    "maxSize": 0
  },
  "items": [
    {
      "id": "15a7f8ea-691c-4f03-862e-3cefb102818e",
      "mimeMessageId": "<15a7f8ea-691c-4f03-862e-3cefb102818e>",
      "o365MessageId": "message id",
      "envelopeSender": {
        "name": "Alice",
        "localAddress": "user_alice",
        "domainAddress": "example.com"
      },
      "to": [
        {
          "name": "Alice",
          "localAddress": "user_alice",
          "domainAddress": "example.com"
        }
      ],
      "cc": [
        {
          "name": "Alice",
          "localAddress": "user_alice",
          "domainAddress": "example.com"
        }
      ],
      "subject": "This is the subject of the email",
      "sizeInBytes": "4134",
      "clientIp": "10.223.0.45",
      "sentAt": "2012-05-26T11:55:36.100Z",
      "quarantinedAt": "2012-05-26T11:55:36.100Z",
      "productType": "mailflow",
      "attachments": {
        "total": 50,
        "items": [
          {
            "name": "photo.png",
            "sizeInBytes": 374427
          }
        ]
      },
      "forRecipient": "user_alice@domain.com",
      "reason": "malware"
    }
  ]
}

See the guide for a narrative walkthrough of this API.