Skip to content

Search quarantine

POST/quarantine/messages/search

Email Management API · Quarantine

Summary of all the quarantined messages matching your search and filter conditions.

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.

Request body

Content type: application/json

Request body fields

beginDatestring (date-time)required
Messages quarantined on or after this date. Used with endDate.
endDatestring (date-time)required
Messages quarantined on or after this date. Used with beginDate.
fieldsarray of string
The fields to return in a partial response.
pageFromKeystring
From where to start searching the records.
pageSizeinteger
The size of the page requested.
Must be ≤ 100.
sortarray of string
Defines how to sort the data. Supported fields are from, forRecipient, quarantinedAt.
filterobject
Filtering conditions.
Show child attributesHide child attributes
idstring (uuid)
ID from 'X-Sophos-Email-ID' header.
fromContainsstring
Return all rows which contains the provided text in from field.
toContainsstring
Return all rows which contains the provided text in to field.
subjectContainsstring
Return all rows which contains the provided text in subject field.
attachmentNameContainsstring
Return all rows which contains the provided text in attachment names.
sizeInMBGreaterThannumber
Return all rows where the message size in MB is greater than the provided value.
sizeInMBLowerThannumber
Return all rows where the message size in MB is less than the provided value.
directionstring
Must be one of: inbound, outbound.
productTypestring
Email product.
Must be one of: mailflow, gateway, ems.
reasonarray of string
Return all rows which has the reason provided in the list.
Each item must be one of: bulk, dataControl, dkim, dmarc, headerAnomaly, domainAnomaly, impersonation, intelixMalicious, intelixSuspicious, intelixUnscannable, maliciousUrl, malware, s/mime, spam, spf, suspectedSpam, unscannable, countrySpam, languageSpam, batvSpam, nrdSpam.
hasAnyAttachmentboolean
Return all rows where email has at least one attachment.

Request samples

curl -X POST "https://api-<data-region>.central.sophos.com/email/v1/quarantine/messages/search" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"beginDate\": \"2012-06-26T11:55:36.100Z\",
  \"endDate\": \"2012-06-26T11:55:36.100Z\",
  \"fields\": [
    \"reason\"
  ],
  \"pageFromKey\": \"string\",
  \"pageSize\": 50,
  \"sort\": [
    \"quarantinedAt:DESC\"
  ],
  \"filter\": {
    \"id\": \"15a7f8ea-691c-4f03-862e-3cefb102818e\",
    \"fromContains\": \"some text\",
    \"toContains\": \"some text\",
    \"subjectContains\": \"some text\",
    \"attachmentNameContains\": \"some text\",
    \"sizeInMBGreaterThan\": 1,
    \"sizeInMBLowerThan\": 2,
    \"direction\": \"inbound\",
    \"productType\": \"mailflow\",
    \"reason\": [
      \"impersonation\"
    ],
    \"hasAnyAttachment\": false
  }
}"


import requests

response = requests.post(
    "https://api-<data-region>.central.sophos.com/email/v1/quarantine/messages/search",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={   'beginDate': '2012-06-26T11:55:36.100Z',
    'endDate': '2012-06-26T11:55:36.100Z',
    'fields': ['reason'],
    'pageFromKey': 'string',
    'pageSize': 50,
    'sort': ['quarantinedAt:DESC'],
    'filter': {   'id': '15a7f8ea-691c-4f03-862e-3cefb102818e',
                  'fromContains': 'some text',
                  'toContains': 'some text',
                  'subjectContains': 'some text',
                  'attachmentNameContains': 'some text',
                  'sizeInMBGreaterThan': 1,
                  'sizeInMBLowerThan': 2,
                  'direction': 'inbound',
                  'productType': 'mailflow',
                  'reason': ['impersonation'],
                  'hasAnyAttachment': False}},
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "beginDate": "2012-06-26T11:55:36.100Z",
  "endDate": "2012-06-26T11:55:36.100Z",
  "fields": [
    "reason"
  ],
  "pageFromKey": "string",
  "pageSize": 50,
  "sort": [
    "quarantinedAt:DESC"
  ],
  "filter": {
    "id": "15a7f8ea-691c-4f03-862e-3cefb102818e",
    "fromContains": "some text",
    "toContains": "some text",
    "subjectContains": "some text",
    "attachmentNameContains": "some text",
    "sizeInMBGreaterThan": 1,
    "sizeInMBLowerThan": 2,
    "direction": "inbound",
    "productType": "mailflow",
    "reason": [
      "impersonation"
    ],
    "hasAnyAttachment": false
  }
}'
Invoke-RestMethod -Method POST -Uri "https://api-<data-region>.central.sophos.com/email/v1/quarantine/messages/search" -Headers $headers -Body $body -ContentType "application/json"


package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("POST", "https://api-<data-region>.central.sophos.com/email/v1/quarantine/messages/search", strings.NewReader(`{
  "beginDate": "2012-06-26T11:55:36.100Z",
  "endDate": "2012-06-26T11:55:36.100Z",
  "fields": [
    "reason"
  ],
  "pageFromKey": "string",
  "pageSize": 50,
  "sort": [
    "quarantinedAt:DESC"
  ],
  "filter": {
    "id": "15a7f8ea-691c-4f03-862e-3cefb102818e",
    "fromContains": "some text",
    "toContains": "some text",
    "subjectContains": "some text",
    "attachmentNameContains": "some text",
    "sizeInMBGreaterThan": 1,
    "sizeInMBLowerThan": 2,
    "direction": "inbound",
    "productType": "mailflow",
    "reason": [
      "impersonation"
    ],
    "hasAnyAttachment": false
  }
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/email/v1/quarantine/messages/search", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "beginDate": "2012-06-26T11:55:36.100Z",
  "endDate": "2012-06-26T11:55:36.100Z",
  "fields": [
    "reason"
  ],
  "pageFromKey": "string",
  "pageSize": 50,
  "sort": [
    "quarantinedAt:DESC"
  ],
  "filter": {
    "id": "15a7f8ea-691c-4f03-862e-3cefb102818e",
    "fromContains": "some text",
    "toContains": "some text",
    "subjectContains": "some text",
    "attachmentNameContains": "some text",
    "sizeInMBGreaterThan": 1,
    "sizeInMBLowerThan": 2,
    "direction": "inbound",
    "productType": "mailflow",
    "reason": [
      "impersonation"
    ],
    "hasAnyAttachment": false
  }
}),
});
const data = await response.json();
console.log(data);

Responses

200 — Quarantined messages.

Response fields

pagesobjectrequired
Show child attributesHide child attributes
fromKeystring
The key of the first item in the returned page.
nextKeystring
The key to use when fetching the next page.
sizeintegerrequired
The size of the page being returned.
totalinteger
(Optional) The total number of pages that exist, if pageTotal=true in the request.
itemsinteger
(Optional) The total number of items on all the pages, if pageTotal=true was passed into the request.
maxSizeintegerrequired
The maximum page size that can be requested.
itemsarray of objectrequired
List of quarantined messages.
Must contain at most 100 items.
Why the message was quarantined.
Show child attributesHide child attributes
idstring (uuid)required
ID from 'X-Sophos-Email-ID' MIME header.
mimeMessageIdstring
ID from 'message-id' MIME header.
envelopeSenderobject
Email address and optional display name.
Show child attributesHide child attributes
namestring
Name of the sender or recipient.
localAddressstringrequired
Local part of the mail address of the sender or recipient.
domainAddressstringrequired
Domain part of the mail address of the sender or recipient.
envelopeRecipientsarray of object
List of envelope email addresses.
Email address and optional display name.
Show child attributesHide child attributes
namestring
Name of the sender or recipient.
localAddressstringrequired
Local part of the mail address of the sender or recipient.
domainAddressstringrequired
Domain part of the mail address of the sender or recipient.
fromobject
Email address and optional display name.
Show child attributesHide child attributes
namestring
Name of the sender or recipient.
localAddressstringrequired
Local part of the mail address of the sender or recipient.
domainAddressstringrequired
Domain part of the mail address of the sender or recipient.
toarray of object
List of email addresses listed in 'To' MIME header.
Email address and optional display name.
Show child attributesHide child attributes
namestring
Name of the sender or recipient.
localAddressstringrequired
Local part of the mail address of the sender or recipient.
domainAddressstringrequired
Domain part of the mail address of the sender or recipient.
ccarray of object
List of email addresses listed in 'Cc' MIME header.
Email address and optional display name.
Show child attributesHide child attributes
namestring
Name of the sender or recipient.
localAddressstringrequired
Local part of the mail address of the sender or recipient.
domainAddressstringrequired
Domain part of the mail address of the sender or recipient.
subjectstring
Message subject.
directionstringrequired
Must be one of: inbound, outbound.
sizeInBytesnumber
Message size, in bytes.
clientIpstring
IP address from where the message was sent.
sentAtstring (date-time)
Time from 'Date' MIME header.
receivedAtstring (date-time)
Time the message was received by Sophos Email.
quarantinedAtstring (date-time)
Time the message was quarantined.
productTypestring
Email product.
Must be one of: mailflow, gateway, ems.
attachmentsobject
Show child attributesHide child attributes
totalintegerrequired
Total number of attachments found in the message.
sizeintegerrequired
Number of attachments.
itemsarray of objectrequired
Must contain at most 100 items.
Attachment details.
Show child attributesHide child attributes
namestring
Attachment name.
sizeInBytesnumber
Attachment size, in bytes.
fileTypestring
Attachment type.
strippedboolean
Whether the attachment has been stripped from the message.
forRecipientstringrequired
Email address for the quarantined message.
reasonstringrequired
Reason for action.
Must be one of: bulk, dataControl, dkim, dmarc, headerAnomaly, domainAnomaly, impersonation, intelixMalicious, intelixSuspicious, intelixUnscannable, maliciousUrl, malware, s/mime, spam, spf, suspectedSpam, unscannable, countrySpam, languageSpam, batvSpam, nrdSpam.
reasonDetailstring
More information about the cause.

Errors

Status Meaning
400 Bad request.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "pages": {
    "fromKey": "string",
    "nextKey": "string",
    "size": 0,
    "total": 0,
    "items": 0,
    "maxSize": 0
  },
  "items": [
    {
      "id": "15a7f8ea-691c-4f03-862e-3cefb102818e",
      "mimeMessageId": "<15a7f8ea-691c-4f03-862e-3cefb102818e>",
      "envelopeSender": {
        "name": "Alice",
        "localAddress": "user_alice",
        "domainAddress": "example.com"
      },
      "envelopeRecipients": [
        {
          "name": "Alice",
          "localAddress": "user_alice",
          "domainAddress": "example.com"
        }
      ],
      "from": {
        "name": "Alice",
        "localAddress": "user_alice",
        "domainAddress": "example.com"
      },
      "to": [
        {
          "name": "Alice",
          "localAddress": "user_alice",
          "domainAddress": "example.com"
        }
      ],
      "cc": [
        {
          "name": "Alice",
          "localAddress": "user_alice",
          "domainAddress": "example.com"
        }
      ],
      "subject": "This is the subject of the email",
      "direction": "inbound",
      "sizeInBytes": "4134",
      "clientIp": "10.223.0.45",
      "sentAt": "2012-05-26T11:55:36.100Z",
      "receivedAt": "2012-05-26T11:55:36.100Z",
      "quarantinedAt": "2012-05-26T11:55:36.100Z",
      "productType": "mailflow",
      "attachments": {
        "total": 50,
        "size": 25,
        "items": [
          {
            "name": "photo.png",
            "sizeInBytes": 374427,
            "fileType": "image",
            "stripped": false
          }
        ]
      },
      "forRecipient": "user_alice@domain.com",
      "reason": "impersonation",
      "reasonDetail": "{\"impersonationType\" : \"BRAND\"}"
    }
  ]
}

See the guide for a narrative walkthrough of this API.