--- title: "Retrieve the message's Message Data Model" method: GET path: "/v0/messages/{id}/message_data_model" tags: ["Messages"] --- # Retrieve the message's Message Data Model `GET /v0/messages/{id}/message_data_model` Retrieve the message's Message Data Model. If there is no justification, it will be redacted. ## Path parameters - `id` string, uuid, required ## Query parameters - `recompute_mdm_from_raw` boolean, nullable — When true, recompute the MDM from the raw EML. For internal use only! - `remove_large_text_fields` boolean, nullable — When true, any text field over 1MB will be cleared before returning ## Response `200` OK - MdmServiceMessageDataModel — Full data model of the message - `_errors` object[] — Non-fatal errors while parsing MDM - `_meta` MdmServiceMetadata, required — Metadata - `canonical_id` string, required — A deterministic ID, generated from metadata such as Attachments, Body, Subject, Sender and is used to group similar messages/campaigns together - `created_at` string, date-time, required — Creation time of the data model - `effective_at` string, date-time, nullable — Effective time of the data model, used for evaluation against lists and historical functions such as sender profiles or whois. - `id` string, uuid — Message ID - `attachments` MdmServiceAttachment[] — Attachments - `content_id` string — Content-ID extracted from the MIME payload; is stripped of leading and trailing <> characters - `content_transfer_encoding` string — Content-Transfer-Encoding extracted from the MIME payload - `content_type` string — Content-Type extracted from the MIME payload - `file_extension` string — File extension from context such as headers - `file_name` string — File name - `file_type` '3gp' | '7z' | 'Z' | 'aac' | 'aiff' | 'amr' | 'ar' | 'avi' | 'bmp' | 'bz2' | 'cab' | 'cr2' | 'crx' | 'dcm' | 'deb' | 'dex' | 'dey' | 'doc' | 'docx' | 'dwg' | 'elf' | 'eot' | 'epub' | 'exe' | 'flac' | 'flv' | 'gif' | 'gz' | 'heif' | 'html' | 'ico' | 'ics' | 'iso' | 'jp2' | 'jpg' | 'jxr' | 'lz' | 'm4a' | 'm4v' | 'macho' | 'mid' | 'mkv' | 'mov' | 'mp3' | 'mp4' | 'mpg' | 'nes' | 'ogg' | 'otf' | 'pdf' | 'png' | 'ppt' | 'pptx' | 'ps' | 'psd' | 'rar' | 'rpm' | 'rtf' | 'sqlite' | 'svg' | 'swf' | 'tar' | 'tif' | 'ttf' | 'wasm' | 'wav' | 'webm' | 'webp' | 'wmv' | 'woff' | 'woff2' | 'xls' | 'xlsx' | 'xz' | 'zip' | 'zst' | 'unknown' — File type determined by looking at the magic bytes in the file - `md5` string — MD5 hash of the raw contents - `raw` string, base64, nullable — Base64 encoded source of the file - `sha1` string — SHA1 hash of the raw contents - `sha256` string — SHA256 hash of the raw contents - `size` integer, nullable — Size of the file in bytes - `body` MdmServiceBody — Body of the email - `current_thread` MdmServiceThread — The current text thread of the message - `banners` MdmServiceBanner[] — All warning banners found in the body of the message. - `links` MdmServiceLink[] — All links found in the banner, unique by the target and display text/url. - `display_text` string — The text of a hyperlink, if it's not a URL - `display_url` MdmServiceURL — URL details when QR code type is url - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - … - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - … - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - … - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `href_url` MdmServiceURL — URL details when QR code type is url - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - … - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - … - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - … - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `mismatched` boolean, nullable — Whether the display URL and href URL root domains are mismatched (i.e. .href_url.domain.root_domain != .display_url.domain.root_domain, where both are not null and valid domains) - `parser` 'plain' | 'hyperlink' — The parser that was used to derived the link - `visible` boolean, nullable — Whether the link is visible to a human when previewing an email or page - `text` string — The text content from the warning banner. - `links` MdmServiceLink[] — All links found in the given thread, unique by the target and display text/url. - `display_text` string — The text of a hyperlink, if it's not a URL - `display_url` MdmServiceURL — URL details when QR code type is url - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - … - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - `encoders` string[] — List of detected URL rewrite encoders while unraveling the URL - `original` string, required — Original URL without any unraveling URL rewrites - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `href_url` MdmServiceURL — URL details when QR code type is url - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - … - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - `encoders` string[] — List of detected URL rewrite encoders while unraveling the URL - `original` string, required — Original URL without any unraveling URL rewrites - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `mismatched` boolean, nullable — Whether the display URL and href URL root domains are mismatched (i.e. .href_url.domain.root_domain != .display_url.domain.root_domain, where both are not null and valid domains) - `parser` 'plain' | 'hyperlink' — The parser that was used to derived the link - `visible` boolean, nullable — Whether the link is visible to a human when previewing an email or page - `preamble` string — The preamble text from the thread, typically the headers of a reply or forward. Things like From, Sent, Subject, saved as one big multiline string. This doesn't include banners. - `text` string — The text content from the latest reply/forward in a message thread. This typically excludes content from forwarded messages and warning banners. - `html` MdmServiceBodyHTML — The body part containing content-type text/html - `charset` string — charset of the text/[subtype] - `content_transfer_encoding` string — Content-Transfer-Encoding of the text/[subtype] - `display_text` string, nullable — Visible text of the HTML document, with invisible characters removed and non-ASCII characters converted to ASCII spaces. - `inner_text` string, nullable — Inner text of the HTML document that doesn't include HTML tags. - `links` MdmServiceLink[] — All links found in the HTML part of the body of the message - `display_text` string — The text of a hyperlink, if it's not a URL - `display_url` MdmServiceURL — URL details when QR code type is url - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - … - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - `encoders` string[] — List of detected URL rewrite encoders while unraveling the URL - `original` string, required — Original URL without any unraveling URL rewrites - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `href_url` MdmServiceURL — URL details when QR code type is url - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - … - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - `encoders` string[] — List of detected URL rewrite encoders while unraveling the URL - `original` string, required — Original URL without any unraveling URL rewrites - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `mismatched` boolean, nullable — Whether the display URL and href URL root domains are mismatched (i.e. .href_url.domain.root_domain != .display_url.domain.root_domain, where both are not null and valid domains) - `parser` 'plain' | 'hyperlink' — The parser that was used to derived the link - `visible` boolean, nullable — Whether the link is visible to a human when previewing an email or page - `raw` string, nullable — Decoded raw content of a body text type (text/[subtype] section) - `ips` MdmServiceIP[] — IP Addresses located in the body - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - `original` string, nullable — The IP in its original format if it is an IPv4-mapped-IPv6 source address - `v4_to_v6` boolean — Whether 'Original' is IPv4-mapped-IPv6 - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `links` MdmServiceLink[] — All links found in the body of the message, unique by the target and display text/url. - `display_text` string — The text of a hyperlink, if it's not a URL - `display_url` MdmServiceURL — URL details when QR code type is url - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - `original` string, nullable — The IP in its original format if it is an IPv4-mapped-IPv6 source address - `v4_to_v6` boolean — Whether 'Original' is IPv4-mapped-IPv6 - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - `encoders` string[] — List of detected URL rewrite encoders while unraveling the URL - `original` string, required — Original URL without any unraveling URL rewrites - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `href_url` MdmServiceURL — URL details when QR code type is url - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - `original` string, nullable — The IP in its original format if it is an IPv4-mapped-IPv6 source address - `v4_to_v6` boolean — Whether 'Original' is IPv4-mapped-IPv6 - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - `encoders` string[] — List of detected URL rewrite encoders while unraveling the URL - `original` string, required — Original URL without any unraveling URL rewrites - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `mismatched` boolean, nullable — Whether the display URL and href URL root domains are mismatched (i.e. .href_url.domain.root_domain != .display_url.domain.root_domain, where both are not null and valid domains) - `parser` 'plain' | 'hyperlink' — The parser that was used to derived the link - `visible` boolean, nullable — Whether the link is visible to a human when previewing an email or page - `plain` MdmServicePlain — The body part containing content-type text/plain - `charset` string — charset of the text/[subtype] - `content_transfer_encoding` string — Content-Transfer-Encoding of the text/[subtype] - `links` MdmServiceLink[] — All links found in the plain part of the body of the message - `display_text` string — The text of a hyperlink, if it's not a URL - `display_url` MdmServiceURL — URL details when QR code type is url - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - … - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - `encoders` string[] — List of detected URL rewrite encoders while unraveling the URL - `original` string, required — Original URL without any unraveling URL rewrites - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `href_url` MdmServiceURL — URL details when QR code type is url - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - … - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - `encoders` string[] — List of detected URL rewrite encoders while unraveling the URL - `original` string, required — Original URL without any unraveling URL rewrites - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `mismatched` boolean, nullable — Whether the display URL and href URL root domains are mismatched (i.e. .href_url.domain.root_domain != .display_url.domain.root_domain, where both are not null and valid domains) - `parser` 'plain' | 'hyperlink' — The parser that was used to derived the link - `visible` boolean, nullable — Whether the link is visible to a human when previewing an email or page - `raw` string, nullable — Decoded raw content of a body text type (text/[subtype] section) - `previous_threads` MdmServicePreviousThread[] — The previous texts threads of the message' - `banners` MdmServiceBanner[] — All warning banners found in the body of the message. - `links` MdmServiceLink[] — All links found in the banner, unique by the target and display text/url. - `display_text` string — The text of a hyperlink, if it's not a URL - `display_url` MdmServiceURL — URL details when QR code type is url - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - … - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - … - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - … - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `href_url` MdmServiceURL — URL details when QR code type is url - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - … - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - … - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - … - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `mismatched` boolean, nullable — Whether the display URL and href URL root domains are mismatched (i.e. .href_url.domain.root_domain != .display_url.domain.root_domain, where both are not null and valid domains) - `parser` 'plain' | 'hyperlink' — The parser that was used to derived the link - `visible` boolean, nullable — Whether the link is visible to a human when previewing an email or page - `text` string — The text content from the warning banner. - `date` string, date-time, nullable — Date extracted from thread preamble - `index` integer — The index of the thread among all threads, sorted from most recent to oldest - `links` MdmServiceLink[] — All links found in the given thread, unique by the target and display text/url. - `display_text` string — The text of a hyperlink, if it's not a URL - `display_url` MdmServiceURL — URL details when QR code type is url - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - … - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - `encoders` string[] — List of detected URL rewrite encoders while unraveling the URL - `original` string, required — Original URL without any unraveling URL rewrites - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `href_url` MdmServiceURL — URL details when QR code type is url - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `fragment` string — Fragment identifier; the text following the # in the URL (also called the anchor tag) - `ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - … - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `password` string — The password specified before the domain name - `path` string — Everything after the TLD and before the query parameters - `port` integer, nullable — The port used for the URL. If no explicit port is set, the port will be inferred from the protocol - `query_params` string — The full query parameters of the URL - `query_params_decoded` object — The decoded query parameters of the URL - `rewrite` MdmServiceRewriteDetails — Information about an original URL that was unfurled from rewrite detection - `encoders` string[] — List of detected URL rewrite encoders while unraveling the URL - `original` string, required — Original URL without any unraveling URL rewrites - `scheme` string — Protocol for the URL request, e.g. http - `url` string, required — Full URL - `username` string — The username specified before the domain name of the URL - `mismatched` boolean, nullable — Whether the display URL and href URL root domains are mismatched (i.e. .href_url.domain.root_domain != .display_url.domain.root_domain, where both are not null and valid domains) - `parser` 'plain' | 'hyperlink' — The parser that was used to derived the link - `visible` boolean, nullable — Whether the link is visible to a human when previewing an email or page - `preamble` string — The preamble text from the thread, typically the headers of a reply or forward. Things like From, Sent, Subject, saved as one big multiline string. This doesn't include banners. - `recipients` MdmServiceThreadRecipients — Recipients extracted from thread preamble - `bcc` MdmServiceMailbox[] — List of 'bcc' Mailbox objects - `display_name` string — Display name - `email` MdmServiceEmailAddress, required — Email address object - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - … - `email` string, email — Full email address - `local_part` string — Local-part, i.e. before the @ - `cc` MdmServiceMailbox[] — List of 'cc' Mailbox objects - `display_name` string — Display name - `email` MdmServiceEmailAddress, required — Email address object - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - … - `email` string, email — Full email address - `local_part` string — Local-part, i.e. before the @ - `to` MdmServiceMailbox[] — List of 'to' Mailbox objects - `display_name` string — Display name - `email` MdmServiceEmailAddress, required — Email address object - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - … - `email` string, email — Full email address - `local_part` string — Local-part, i.e. before the @ - `sender` MdmServiceMailbox — Organizer mailbox with email and display name - `display_name` string — Display name - `email` MdmServiceEmailAddress, required — Email address object - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `email` string, email — Full email address - `local_part` string — Local-part, i.e. before the @ - `subject` MdmServiceSubject — Subject object - `base` string — Subject of the email with tags and reply/forward indicators removed - `is_forward` boolean, nullable — Indicates if the subject of the email is a forward - `is_reply` boolean, nullable — Indicates if the subject of the email is a reply - `subject` string — Subject of the email - `tags` string[] — Leading tags extracted from the subject, e.g. [External] or (Warning) - `text` string — The text content from the latest reply/forward in a message thread. This typically excludes content from forwarded messages and warning banners. - `external` MdmServiceExternal — Cloud API provider or other external source metadata - `created_at` string, date-time, nullable — The created time of the message as provided by the cloud API (G Suite or Office 365) or other external source. This is typically the time the external source received the message - `message_id` string — The message ID as provided by the cloud API (G Suite or Office 365) or other external source - `route_type` 'sent' | 'received' — whether the message was sent or received - `spam` boolean, nullable — The upstream mail gateway determined the message to be spam. For cloud API providers, this will be the same as spam_folder. For other implementation methods like transport rules, this will be determined by message header values (e.g. X-SPAM) if supported - `spam_folder` boolean, nullable — The message arrived in the user's spam folder. This only applies to cloud APIs (G Suite or Office 365) - `thread_id` string — The thread/conversation's unique ID as provided by the cloud API (G Suite or Office 365) - `headers` MdmServiceHeaders, required — The message headers - `auth_summary` MdmServiceAuthSummary — Summary of authentication results for the message - `dmarc` MdmServiceDMARCSummary — Summary of the DMARC check - `details` MdmServiceDMARC — Details of the Domain-based Message Authentication, Reporting & Conformance check - `action` string, nullable — Indicates the action taken by the spam filter based on the results of the DMARC check. For more information see https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spam-message-headers?view=o365-worldwide#authentication-results-message-header-fields - `disposition` string, nullable — Gmail-applied policy - `from` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `policy` string, nullable — Policy for the organizational domain - `sub_policy` string, nullable — Policy for the subdomain of the organizational domain - `verdict` string, nullable — Describes the results of the DMARC check for the message - `version` string, nullable — DMARC version - `error` boolean, nullable — Whether the DMARC check errored - `pass` boolean, nullable — Whether the DMARC check passed - `received_hop` integer — The lowest hop at which the DMARC check was made - `spf` MdmServiceSPFSummary — Summary of the SPF check - `details` MdmServiceSPF — Details of the Sender Policy Framework check. Supported fields include 'Received-SPF' and 'X-Received-SPF' - `client_ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - … - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `description` string, nullable — Verbose description of the SPF verdict - `designator` string, nullable — Email or domain of the designating body - `helo` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `server` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `verdict` string, nullable — Verdict of the SPF - `error` boolean, nullable — Whether the SPF check errored - `pass` boolean, nullable — Whether the SPF check passed - `received_hop` integer — The lowest hop at which the SPF check was made - `date` string, date-time, nullable — Date the email was sent in UTC. - `date_original_offset` string, nullable — UTC timezone offset of the sender - `delivered_to` MdmServiceEmailAddress — Email address object - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `email` string, email — Full email address - `local_part` string — Local-part, i.e. before the @ - `domains` MdmServiceDomain[] — All domains found in the Received headers - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `from` MdmServiceMailbox — Organizer mailbox with email and display name - `display_name` string — Display name - `email` MdmServiceEmailAddress, required — Email address object - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `email` string, email — Full email address - `local_part` string — Local-part, i.e. before the @ - `hops` MdmServiceHop[], required — List of hops the message took from Sender to Recipient - `authentication_results` MdmServiceAuthResults — Results of authentication. Supported fields include 'Authentication-Results', 'X-Original-Authentication-Results', 'X-MS-Exchange-Authentication-Results', 'X-Agari-Authentication-Results', 'Authentication-Results-Original', and 'ARC-Authentication-Results'. Specification details can be found at https://tools.ietf.org/html/rfc8601 - `compauth` MdmServiceCompAuth — Composite Authentication result, used by Microsoft O365 - `reason` string, required — Reason for the verdict - `verdict` string, required — Verdict of the compauth - `dkim` 'none' | 'pass' | 'fail' | 'policy' | 'neutral' | 'temperror' | 'permerror' — Verdict of the Domain Keys Identified Mail check - `dkim_details` MdmServiceSignature[] — List of details of the Domain Keys Identified Mail checks - `algorithm` string — Signing algorithm - `body_hash` string — Body Hash - `domain` string — Domain identified in the DKIM signature if any. This is the domain that's queried for the public key. - `headers` string — Header fields signed by the algorithm - `instance` string — Instance number of this signature (if ARC) - `selector` string — Selector - `signature` string — Signature of headers and body - `type` string — The type of signature, derived from the field name - `version` string — Version - `dmarc` 'none' | 'pass' | 'fail' | 'bestguesspass' — Verdict of the Domain-based Message Authentication, Reporting & Conformance check - `dmarc_details` MdmServiceDMARC — Details of the Domain-based Message Authentication, Reporting & Conformance check - `action` string, nullable — Indicates the action taken by the spam filter based on the results of the DMARC check. For more information see https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spam-message-headers?view=o365-worldwide#authentication-results-message-header-fields - `disposition` string, nullable — Gmail-applied policy - `from` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `policy` string, nullable — Policy for the organizational domain - `sub_policy` string, nullable — Policy for the subdomain of the organizational domain - `verdict` string, nullable — Describes the results of the DMARC check for the message - `version` string, nullable — DMARC version - `instance` string — Instance number of this auth result (if ARC) - `server` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `spf` 'none' | 'pass' | 'fail' | 'softfail' | 'policy' | 'neutral' | 'temperror' | 'permerror' — Verdict of the Sender Policy Framework - `spf_details` MdmServiceSPF — Details of the Sender Policy Framework check. Supported fields include 'Received-SPF' and 'X-Received-SPF' - `client_ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - … - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `description` string, nullable — Verbose description of the SPF verdict - `designator` string, nullable — Email or domain of the designating body - `helo` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `server` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `verdict` string, nullable — Verdict of the SPF - `type` string — The type of authentication result, derived from the field name - `fields` MdmServiceHopField[], required — List of all raw header fields contained within this hop - `name` string, required — The name of the field - `position` integer, required — This field's position along the entire list of header fields - `value` string — The value contained within the field - `index` integer, required — Index indicates the order in which a hop occurred from sender to recipient - `received` MdmServiceReceived — Details of the Received field - `additional` MdmServiceReceivedAdditional — The remaining additional clauses of the Received header - `raw` string — The raw string for remaining additional clauses, such as transport information - `id` MdmServiceReceivedID — The 'id' section of the Received header - `raw` string — The raw string of 'id' section - `link` MdmServiceReceivedVia — The 'via' section of the Received header, denoting transport - `raw` string — The raw string of 'via' section - `mailbox` MdmServiceReceivedFor — The 'for' section of the Received header, denoting the destination mailbox - `raw` string — The raw string of 'for' section - `protocol` MdmServiceReceivedWith — The 'with' section of the Received header, denoting the protocol used - `raw` string — The raw string of 'with' section - `server` MdmServiceReceivedBy — The 'by' section of the Received header, denoting the current server - `raw` string — The raw string of 'by' section - `source` MdmServiceReceivedFrom — The 'from' section of the Received header, relating to a server in a prior hop - `raw` string — The raw string of 'from' section - `time` string, date-time, nullable — Time parsed from the Received header - `zone_offset` string, nullable — Timezone offset parsed from the Received header - `received_spf` MdmServiceSPF — Details of the Sender Policy Framework check. Supported fields include 'Received-SPF' and 'X-Received-SPF' - `client_ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - `original` string, nullable — The IP in its original format if it is an IPv4-mapped-IPv6 source address - `v4_to_v6` boolean — Whether 'Original' is IPv4-mapped-IPv6 - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `description` string, nullable — Verbose description of the SPF verdict - `designator` string, nullable — Email or domain of the designating body - `helo` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `server` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `verdict` string, nullable — Verdict of the SPF - `signature` MdmServiceSignature — Details of a message signature. Supported fields include 'DKIM-Signature', 'DomainKey-Signature', 'X-Google-DKIM-Signature' and 'ARC-Message-Signature' - `algorithm` string — Signing algorithm - `body_hash` string — Body Hash - `domain` string — Domain identified in the DKIM signature if any. This is the domain that's queried for the public key. - `headers` string — Header fields signed by the algorithm - `instance` string — Instance number of this signature (if ARC) - `selector` string — Selector - `signature` string — Signature of headers and body - `type` string — The type of signature, derived from the field name - `version` string — Version - `in_reply_to` string, nullable — In-Reply-To header value which identifies its parent message if exists - `ips` MdmServiceIP[] — All IP addresses found in the Received headers - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - `original` string, nullable — The IP in its original format if it is an IPv4-mapped-IPv6 source address - `v4_to_v6` boolean — Whether 'Original' is IPv4-mapped-IPv6 - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `mailer` string, nullable — X-Mailer or User-Agent extracted from headers - `message_id` string, nullable — Message-ID extracted from the header - `references` string[] — The Message-IDs of the other messages within this chain - `reply_to` MdmServiceMailbox[] — Where replies should be delivered to - `display_name` string — Display name - `email` MdmServiceEmailAddress, required — Email address object - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `email` string, email — Full email address - `local_part` string — Local-part, i.e. before the @ - `return_path` MdmServiceEmailAddress — Email address object - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `email` string, email — Full email address - `local_part` string — Local-part, i.e. before the @ - `x_authenticated_domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `x_authenticated_sender` MdmServiceEmailAddress — Email address object - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `email` string, email — Full email address - `local_part` string — Local-part, i.e. before the @ - `x_client_ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - `original` string, nullable — The IP in its original format if it is an IPv4-mapped-IPv6 source address - `v4_to_v6` boolean — Whether 'Original' is IPv4-mapped-IPv6 - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `x_originating_ip` MdmServiceIP — X-Originating-IP header, which identifies the originating IP address of the sender client - `ip` string, required — The IP in canonical form - `translation` MdmServiceIPTranslation - `original` string, nullable — The IP in its original format if it is an IPv4-mapped-IPv6 source address - `v4_to_v6` boolean — Whether 'Original' is IPv4-mapped-IPv6 - `version` integer, nullable — The version of IP (i.e., 4 or 6), null for backward compatibility. - `x_secure_server_account` string, nullable — X-SecureServer-Acct header, which represents a unique identifier associated with the sender's email account on a secure server and can be used to trace the email back to a specific account or user. - `x_sender` MdmServiceEmailAddress — Email address object - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `email` string, email — Full email address - `local_part` string — Local-part, i.e. before the @ - `mailbox` MdmServiceMailboxExtended — The mailbox where the message was found - `display_name` string — Display name - `email` MdmServiceEmailAddress, required — Email address object - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `email` string, email — Full email address - `local_part` string — Local-part, i.e. before the @ - `first_name` string — First name (given name) of the mailbox owner - `last_name` string — Last name (surname) of the mailbox owner - `recipients` MdmServiceRecipients, required — Recipient objects - `bcc` MdmServiceMailbox[] — List of 'bcc' Mailbox objects - `display_name` string — Display name - `email` MdmServiceEmailAddress, required — Email address object - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `email` string, email — Full email address - `local_part` string — Local-part, i.e. before the @ - `cc` MdmServiceMailbox[] — List of 'cc' Mailbox objects - `display_name` string — Display name - `email` MdmServiceEmailAddress, required — Email address object - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `email` string, email — Full email address - `local_part` string — Local-part, i.e. before the @ - `to` MdmServiceMailbox[] — List of 'to' Mailbox objects - `display_name` string — Display name - `email` MdmServiceEmailAddress, required — Email address object - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `email` string, email — Full email address - `local_part` string — Local-part, i.e. before the @ - `sender` MdmServiceSenderMailbox, required — Sender object - `decoders` string[] — Decoders used to parse the email sender info, if any - `display_name` string — Display name - `email` MdmServiceEmailAddress, required — Email address object - `domain` MdmServiceDomain — Domain parsed from X-Authenticated-Domain or X-Authenticated-Sender headers, which represents the domain used for sender authentication, typically the domain of the sending organization. This field provides additional context for analyzing the legitimacy of the sender - `domain` string, hostname, required — The fully qualified domain name (FQDN). This may not *always* be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar - `punycode` string — Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com - `root_domain` string, hostname — The root domain, including the TLD - `sld` string — Second-level domain, e.g. 'windows' for the domain 'windows.net' - `subdomain` string — Subdomain, e.g. 'drive' for the domain 'drive.google.com' - `tld` string — The domain's top-level domain. E.g. the TLD of google.com is 'com' - `valid` boolean — Whether the domain is valid - `email` string, email — Full email address - `local_part` string — Local-part, i.e. before the @ - `subject` MdmServiceSubject — Subject object - `base` string — Subject of the email with tags and reply/forward indicators removed - `is_forward` boolean, nullable — Indicates if the subject of the email is a forward - `is_reply` boolean, nullable — Indicates if the subject of the email is a reply - `subject` string — Subject of the email - `tags` string[] — Leading tags extracted from the subject, e.g. [External] or (Warning) - `type` MdmServiceMessageType, required — Override on message types, defined from the perspective of your organization - `inbound` boolean — Message was sent from someone outside your organization, to *at least one* recipient inside your organization - `internal` boolean — Message was sent from someone inside your organization, to *at least one* recipient inside your organization. Messages *must be authenticated* by either SPF or DKIM to be treated as internal. - `outbound` boolean — Message was sent from someone inside your organization, to *at least one* recipient outside your organization --- [API](https://skmtc.net/sublime/apis/sublime-platform-api.md) · [All operations](https://skmtc.net/sublime/apis/sublime-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sublime/sublime-platform-api/versions/d5df82850357/schema)