{"command":{"effect":"read","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Returns information for each email that matches the provided search parameters.","properties":{"path":{"type":"object","properties":{"account_id":{"$ref":"#/definitions/email-security_identifier","description":"Account identifier tag."}},"required":["account_id"],"additionalProperties":false},"query":{"type":"object","properties":{"start":{"type":"string","format":"date-time","examples":["2022-06-25T14:30:00Z"],"description":"The beginning of the search date range. Defaults to `now - 30 days`. Must not be in the future."},"end":{"type":"string","format":"date-time","examples":["2022-07-25T14:30:00Z"],"description":"The end of the search date range. Defaults to `now`."},"query":{"type":"string","examples":["bob jones"],"description":"Space-delimited term matched case-insensitively against message metadata — sender, recipient, subject, attachment names and hashes, and message ID."},"detections_only":{"type":"boolean","default":true,"description":"Whether to include only detections in search results."},"final_disposition":{"type":"string","enum":["MALICIOUS","SUSPICIOUS","SPOOF","SPAM","BULK","NONE"],"description":"Dispositions to filter by."},"metric":{"type":"string","description":"Metric to aggregate the results by."},"message_action":{"type":"string","enum":["PREVIEW","QUARANTINE_RELEASED","MOVED"],"description":"Message actions to filter by."},"recipient":{"type":"string","examples":["me@example.com"],"description":"Filter by recipient. Matches an email address or a domain."},"sender":{"type":"string","examples":["noreply@example.com"],"description":"Filter by sender. Matches an email address or a domain."},"smtp_helo_ip":{"type":"string","examples":["192.0.2.1"],"description":"Matches messages whose SMTP HELO server IP address equals this value."},"alert_id":{"type":"string","description":"Filter by alert ID."},"domain":{"type":"string","examples":["example.com"],"description":"Filter by a domain found in the email — sender domain, recipient domain, or a domain in a link."},"message_id":{"type":"string","description":"Filter by the RFC 5322 Message-ID header."},"subject":{"type":"string","description":"Search for messages containing individual keywords in any order within the subject."},"delivery_status":{"$ref":"#/definitions/email-security_MessageDeliveryStatus","description":"Delivery status to filter by."},"cursor":{"type":"string","description":"Pagination cursor from the previous response's `result_info`."},"per_page":{"type":"integer","default":20,"maximum":1000,"minimum":1,"examples":[20],"description":"The number of results per page. Maximum value is 1000."},"page":{"type":["integer","null"],"default":1,"minimum":1,"description":"Deprecated: Use cursor pagination instead. End of life: November 1, 2026."}},"required":[],"additionalProperties":false}},"required":["path"],"additionalProperties":false,"definitions":{"email-security_identifier":{"description":"Identifier.","type":"string","maxLength":32,"examples":["023e105f4ecef8ad9ca31a8372d0c353"]},"email-security_MessageDeliveryStatus":{"description":"Delivery status of the message.","type":"string","enum":["delivered","moved","quarantined","rejected","deferred","bounced","queued","move_failed"]}}},"name":"Search email messages","id":"cloudflare.email_security_investigate","example":{"path":{"account_id":"023e105f4ecef8ad9ca31a8372d0c353"}},"maxRequests":1,"summary":false}}