Skip to content

Quarantine release

POST/quarantine/messages/release

Email Management API · Quarantine

Queue one or more messages from quarantine for release.

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.

Request body

Content type: application/json

Request body fields

allowSenderboolean
Whether to add the sender to the allow list.
enforceSenderAuthenticationboolean
Whether to enforce authentication checks when allowing a sender.
submitMessageToLabsboolean
Whether the message needs to be submitted to Sophos Labs as a false positive. Applicable for Spam and Virus messages only.
itemsarray of objectrequired
Items to be released.
Must contain at most 50 items.
Show child attributesHide child attributes
idstring (uuid)required
ID from 'X-Sophos-Email-ID' MIME header.
forRecipientsarray of string
Target email addresses.
stripAttachmentsarray of string
Attachments that must be stripped before releasing the message.

Request samples

curl -X POST "https://api-<data-region>.central.sophos.com/email/v1/quarantine/messages/release" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"allowSender\": false,
  \"enforceSenderAuthentication\": false,
  \"submitMessageToLabs\": false,
  \"items\": [
    {
      \"id\": \"15a7f8ea-691c-4f03-862e-3cefb102818e\",
      \"forRecipients\": [
        \"user_bob@sophos.com\"
      ],
      \"stripAttachments\": [
        \"employee_details.xslx\"
      ]
    }
  ]
}"


import requests

response = requests.post(
    "https://api-<data-region>.central.sophos.com/email/v1/quarantine/messages/release",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={   'allowSender': False,
    'enforceSenderAuthentication': False,
    'submitMessageToLabs': False,
    'items': [   {   'id': '15a7f8ea-691c-4f03-862e-3cefb102818e',
                     'forRecipients': ['user_bob@sophos.com'],
                     'stripAttachments': ['employee_details.xslx']}]},
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "allowSender": false,
  "enforceSenderAuthentication": false,
  "submitMessageToLabs": false,
  "items": [
    {
      "id": "15a7f8ea-691c-4f03-862e-3cefb102818e",
      "forRecipients": [
        "user_bob@sophos.com"
      ],
      "stripAttachments": [
        "employee_details.xslx"
      ]
    }
  ]
}'
Invoke-RestMethod -Method POST -Uri "https://api-<data-region>.central.sophos.com/email/v1/quarantine/messages/release" -Headers $headers -Body $body -ContentType "application/json"


package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("POST", "https://api-<data-region>.central.sophos.com/email/v1/quarantine/messages/release", strings.NewReader(`{
  "allowSender": false,
  "enforceSenderAuthentication": false,
  "submitMessageToLabs": false,
  "items": [
    {
      "id": "15a7f8ea-691c-4f03-862e-3cefb102818e",
      "forRecipients": [
        "user_bob@sophos.com"
      ],
      "stripAttachments": [
        "employee_details.xslx"
      ]
    }
  ]
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/email/v1/quarantine/messages/release", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "allowSender": false,
  "enforceSenderAuthentication": false,
  "submitMessageToLabs": false,
  "items": [
    {
      "id": "15a7f8ea-691c-4f03-862e-3cefb102818e",
      "forRecipients": [
        "user_bob@sophos.com"
      ],
      "stripAttachments": [
        "employee_details.xslx"
      ]
    }
  ]
}),
});
const data = await response.json();
console.log(data);

Responses

202 — Messages accepted for release.

Response fields

itemsarray of object
List of items for which the requested action was successful.
Show child attributesHide child attributes
idstring (uuid)required
ID from 'X-Sophos-Email-ID' MIME header.
recipientstringrequired
Target email address.
errorsarray of object
List of items for which requested action failed.
Show child attributesHide child attributes
idstring (uuid)required
ID from 'X-Sophos-Email-ID' MIME header.
recipientstringrequired
Email address where there was an error in performing requested action.
errorstring
Reason for error.

Errors

Status Meaning
400 Bad request.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

202

{
  "items": [
    {
      "id": "15a7f8ea-691c-4f03-862e-3cefb102818e",
      "recipient": "user_bob@sophos.com"
    }
  ],
  "errors": [
    {
      "id": "15a7f8ea-691c-4f03-862e-3cefb102818e",
      "recipient": "user_bob@sophos.com",
      "error": "Already released"
    }
  ]
}

See the guide for a narrative walkthrough of this API.