Get PhishGuard reports

GET/accounts/{account_id}/email-security/phishguard/reports

Retrieves PhishGuard security alert reports for a specified date range. Reports include detected threats, dispositions, and contextual information. Use for security monitoring and threat analysis.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

Accepted Permissions (at least one required)

Cloud Email Security: WriteCloud Email Security: Read

Path ParametersExpand Collapse

account_id: string

Identifier.

maxLength32

Query ParametersExpand Collapse

end: optional string

End of the time range (RFC3339). Takes precedence over to_date.

formatdate-time

from_date: optional string

Deprecated, use start instead. Start date in YYYY-MM-DD format.

formatdate

start: optional string

Start of the time range (RFC3339). Takes precedence over from_date.

formatdate-time

to_date: optional string

Deprecated, use end instead. End date in YYYY-MM-DD format.

formatdate

ReturnsExpand Collapse

errors: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

messages: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

result: array of object { id, content, disposition, 7 more }

id: number

content: string

disposition: "MALICIOUS" or "MALICIOUS-BEC" or "SUSPICIOUS" or 7 more

One of the following:

"MALICIOUS"

"MALICIOUS-BEC"

"SUSPICIOUS"

"SPOOF"

"SPAM"

"BULK"

"ENCRYPTED"

"EXTERNAL"

"UNKNOWN"

"NONE"

fields: object { to, from, occurred_at, 2 more }

to: array of string

from: optional string

occurred_at: optional string

formatdate-time

postfix_id: optional string

Deprecatedts: optional string

Deprecated, use occurred_at instead

formatdate-time

priority: string

title: string

created_at: optional string

formatdate-time

tags: optional array of object { category, value }

category: string

value: string

Deprecatedts: optional string

Deprecated, use created_at instead

formatdate-time

updated_at: optional string

formatdate-time

success: true

Whether the API call was successful.

Get PhishGuard reports

curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/email-security/phishguard/reports \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "result": [
    {
      "id": 0,
      "content": "content",
      "disposition": "MALICIOUS",
      "fields": {
        "to": [
          "string"
        ],
        "from": "from",
        "occurred_at": "2019-12-27T18:11:19.117Z",
        "postfix_id": "postfix_id",
        "ts": "2019-12-27T18:11:19.117Z"
      },
      "priority": "priority",
      "title": "title",
      "created_at": "2019-12-27T18:11:19.117Z",
      "tags": [
        {
          "category": "category",
          "value": "value"
        }
      ],
      "ts": "2019-12-27T18:11:19.117Z",
      "updated_at": "2019-12-27T18:11:19.117Z"
    }
  ],
  "success": true
}

Returns Examples

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "result": [
    {
      "id": 0,
      "content": "content",
      "disposition": "MALICIOUS",
      "fields": {
        "to": [
          "string"
        ],
        "from": "from",
        "occurred_at": "2019-12-27T18:11:19.117Z",
        "postfix_id": "postfix_id",
        "ts": "2019-12-27T18:11:19.117Z"
      },
      "priority": "priority",
      "title": "title",
      "created_at": "2019-12-27T18:11:19.117Z",
      "tags": [
        {
          "category": "category",
          "value": "value"
        }
      ],
      "ts": "2019-12-27T18:11:19.117Z",
      "updated_at": "2019-12-27T18:11:19.117Z"
    }
  ],
  "success": true
}