{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Creates a new bulk action job to move or release messages that match the provided search parameters. To move or release an explicit list of known messages instead of a search, use the move or release endpoints.","properties":{"path":{"type":"object","properties":{"account_id":{"$ref":"#/definitions/email-security_identifier","description":"Account identifier tag."}},"required":["account_id"],"additionalProperties":false},"body":{"$ref":"#/definitions/email-security_BulkActionRequest"}},"required":["path","body"],"additionalProperties":false,"definitions":{"email-security_identifier":{"description":"Identifier.","type":"string","maxLength":32,"examples":["023e105f4ecef8ad9ca31a8372d0c353"]},"email-security_BulkActionRequest":{"type":"object","properties":{"action":{"description":"The action the job performs on every message matching the search parameters.","type":"string","enum":["MOVE","RELEASE"]},"comment":{"description":"Optional note describing the job.","type":["string","null"]},"destination":{"description":"Required when action is 'MOVE'.","allOf":[{"$ref":"#/definitions/email-security_MailboxDestination"}]},"expected_disposition":{"description":"Nonfunctional field. End of life: December 1, 2026.","type":["string","null"],"allOf":[{"$ref":"#/definitions/email-security_DispositionLabel"}]},"search_params":{"$ref":"#/definitions/email-security_BulkSearchParams"}},"required":["action","search_params"]},"email-security_MailboxDestination":{"description":"The mailbox folder to move messages to.","type":"string","enum":["Inbox","JunkEmail","DeletedItems","RecoverableItemsDeletions","RecoverableItemsPurges"]},"email-security_DispositionLabel":{"description":"The verdict Email Security assigns to a message.","type":"string","enum":["MALICIOUS","MALICIOUS-BEC","SUSPICIOUS","SPOOF","SPAM","BULK","ENCRYPTED","EXTERNAL","UNKNOWN","NONE"]},"email-security_BulkSearchParams":{"type":"object","properties":{"action_log":{"description":"Deprecated, use `GET /investigate/{investigate_id}/action_log` instead. End of life: November 1, 2026.","type":"boolean","default":false},"alert_id":{"description":"Alert ID of the detection to filter by.","type":["string","null"]},"delivery_status":{"description":"Delivery status to filter by.","type":["string","null"],"allOf":[{"$ref":"#/definitions/email-security_MessageDeliveryStatus"}]},"detections_only":{"description":"Whether to include only detections in search results.","type":"boolean","default":true},"domain":{"description":"Match messages that mention this domain — sender domain, recipient domain, or a domain in a link.","type":["string","null"]},"end":{"description":"End of search date range.","type":"string","format":"date-time","examples":["2022-07-25T14:30:00Z"]},"exact_subject":{"description":"Match messages whose subject line equals this value exactly.","type":["string","null"]},"final_disposition":{"description":"Dispositions to filter by.","type":["string","null"],"allOf":[{"$ref":"#/definitions/email-security_DispositionLabel"}]},"message_action":{"description":"Message actions to filter by.","type":["string","null"],"enum":["PREVIEW","QUARANTINE_RELEASED","MOVED"]},"message_id":{"description":"Message-ID header value to filter by.","type":["string","null"]},"metric":{"description":"Metric name to filter the search by.","type":["string","null"]},"query":{"description":"Space-delimited search term. Case-insensitive.","type":["string","null"]},"recipient":{"description":"Match messages whose recipient is this email address or domain.","type":["string","null"]},"sender":{"description":"Match messages whose sender is this email address or domain.","type":["string","null"]},"smtp_helo_ip":{"description":"Matches messages whose SMTP HELO server IP address equals this value.","type":["string","null"]},"start":{"description":"Beginning of search date range.","type":"string","format":"date-time","examples":["2022-06-25T14:30:00Z"]},"subject":{"description":"Match messages whose subject contains these keywords, in any order.","type":["string","null"]},"submissions":{"description":"Whether to search reclassification submissions instead of original messages.","type":"boolean","default":false}}},"email-security_MessageDeliveryStatus":{"description":"Delivery status of the message.","type":"string","enum":["delivered","moved","quarantined","rejected","deferred","bounced","queued","move_failed"]}}},"name":"Create a bulk action job","id":"cloudflare.email_security_create_bulk_job","example":{"path":{"account_id":"023e105f4ecef8ad9ca31a8372d0c353"},"body":{"action":"MOVE","search_params":{}}},"maxRequests":1,"summary":false}}