---
title: "Process raw message"
method: POST
path: "/v0/live-flow/raw-messages/analyze"
tags: ["Live flow"]
---

# Process raw message

`POST /v0/live-flow/raw-messages/analyze`

Process a raw message

## Request body

- AnalyzeRawMessageLiveFlowInput
  - boolean
  - `analyze_async` boolean — Run analysis and finish ingestion async. flagged_rules will be empty on response.
  - `canonical_id` string, nullable — Known Canonical (message group) ID
  - `create_mailbox` boolean — Create mailbox if it doesn't exist. If true, message_source_id must also be set
  - `delivery_status` string, nullable — Override delivery status. Use 'undelivered' to simulate inline processing (e.g. for testing interdict actions).
  - `external_created_at` string, date-time, nullable — Timestamp the message created at according to the external source
  - `external_message_id` string, nullable — ID of the message according to the external source
  - `external_thread_id` string, nullable — ID of the thread the message belongs to according to the external source
  - `folder` string, nullable — The mailbox folder the message is in
  - `labels` string[] — Labels applied to the message by the mailbox
  - `mailbox_email_address` string, email, required — The email address of the mailbox containing this message
  - `message_source_id` string, uuid, required — API Message source ID associated with the mailbox.
  - `message_type` MdmServiceMessageType — Override on message types, defined from the perspective of your organization
    - `inbound` boolean — Message was sent from someone outside your organization, to *at least one* recipient inside your organization
    - `internal` boolean — Message was sent from someone inside your organization, to *at least one* recipient inside your organization. Messages *must be authenticated* by either SPF or DKIM to be treated as internal.
    - `outbound` boolean — Message was sent from someone inside your organization, to *at least one* recipient outside your organization
  - `raw_message` string, required — The full base64 encoded raw eml message
  - `route_type` string, nullable — The directional route type of the message

## Response `200`

OK

- HandlerTypesAnalyzeRawMessageLiveFlowResponse
  - `canonical_id` string — Canonical (message group) ID
  - `flagged_rules` TypesFlatSqar[] — Flagged rules
    - `actions` TypesSqarAction[] — Actions associated with the rule
      - `active` boolean
      - `id` string
      - `name` string
      - `type` string
    - `active` boolean — Whether the rule is active
    - `active_updated_at` string, date-time — When the Rule was last activated/deactivated
    - `asa_verdict_trigger` string, nullable — The ASA verdict that triggered this rule, if applicable
    - `attack_types` string[] — Rule attack types
    - `authors` TypesRuleAuthor[] — Authors and contributors of a rule
      - `name` string — Name of a rule author
      - `twitter` string — Twitter handle for a rule author
    - `auto_review_auto_share` boolean — Whether auto-reviewed messages will be shared
    - `auto_review_classification` string, nullable — The classification auto-reviewed messages will have, when an auto-review action is associated with the rule
    - `child_ids` string[] — IDs of any child sqars, if any
    - `created_at` string, date-time, nullable, required — Rule creation time
    - `created_by_api_request_id` string, uuid, nullable — Created by API Request ID
    - `created_by_org_id` string, uuid, nullable — Original rule creator org ID
    - `created_by_org_name` string, nullable — Original rule creator org name
    - `created_by_user_id` string, uuid, nullable — Original rule creator user ID
    - `created_by_user_name` string, nullable — Original rule creator user name
    - `description` string, nullable — Description of rule
    - `detection_methods` string[] — Rule detection technologies
    - `false_positives` string[] — Descriptions of known false positives that could occur
    - `feed_external_rule_id` string, nullable — External rule ID of a rule from a feed
    - `feed_id` string, nullable — Feed ID for a rule from a feed
    - `full_type` 'detection_rule' | 'dlp_rule' | 'triage_rule' | 'insight_query' | 'signal_query' — Sqar type (rule or query) and subtype
    - `id` string, uuid, required — Rule ID
    - `immutable` boolean — Whether changes to the source or metadata are permitted
    - `internal_type` string, nullable — Unique internal type for rule
    - `label` string, nullable — Rule label
    - `maturity` string, nullable — Rule maturity
    - `name` string, required — Rule name
    - `org_id` string, uuid — Org ID
    - `parent_id` string, nullable — ID of the parent sqar, if there is one
    - `passive` boolean — Whether the rule is in passive mode
    - `references` string[] — URL references
    - `run_triage_on_excluded_messages` boolean — For Triage rules only, whether this rule will run even if the message matched a global exclusion.
    - `severity` string, nullable — Rule severity
    - `source` string, required — Source
    - `source_md5` string, required — MD5 hash of source
    - `tactics_and_techniques` string[] — Rule tactics and techniques
    - `tags` string[] — Tags
    - `triage_abuse_reports` boolean — For Triage rules only, whether this rule will run for reported messages
    - `triage_ade_complete` boolean — For Triage rules only, whether this rule will run as triggered by ADE processing completing
    - `triage_asa_complete` boolean — For Triage rules only, whether this rule will run as triggered by ASA processing completing
    - `triage_classification_changes` boolean — For Triage rules only, whether this rule will run when a reported message has a classification change
    - `triage_dlp_rule_matched` boolean — For Triage rules only, whether this rule will run for messages that matched a DLP rule
    - `triage_email_bomb` boolean — For Triage rules only, whether this rule will run for messages found in an email bomb
    - `triage_flagged_messages` boolean — For Triage rules only, whether this rule will run for messages which flagged
    - `type` string, nullable — Rule type
    - `updated_at` string, date-time, nullable, required — Rule last updated time
    - `user_can_delete` boolean — Whether the rule can be deleted by a user
    - `user_provided_tags` string[] — User-provided tags
  - `message_id` string, uuid, nullable — Message ID
  - `raw_message_id` string, uuid, nullable — Raw message ID

---

[API](https://skmtc.net/sublime/apis/sublime-platform-api.md) · [All operations](https://skmtc.net/sublime/apis/sublime-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sublime/sublime-platform-api/revisions/d5df82850357/schema)