--- title: "Security Events" method: GET path: "/api/v1/events" tags: ["Endpoints", "Events"] --- # Security Events `GET /api/v1/events` This endpoint provides security events from Defender, Guardian, and Architect. ## Query parameters - `created_after` string, date-time - `limit` integer - `after_checkpoint` string ## Response `200` Success - object - `checkpoint` string, required — This value can be provided to a subsequent request via the `after_checkpoint` query parameter to ensure that events from this request are not returned in future responses. This allows clients to paginate through results. - `additional_results` boolean, required — True if there may be more events that can be immediately retrieved. Note that there may be times when `additional_results` is true, but when you make a subsequent call you receive back zero results. - `results` Event[], required — Tessian security events. - union - GuardianEvent — Properties that all events have. - `id` string, required — A unique identifier for the event. - `type` string, required — The type of event. - `created_at` string, date-time, required — When the event was created in UTC. - `updated_at` string, date-time, required — When the event was last updated in UTC. Creation is counted as an update. - `portal_link` string, url, nullable, required — A HTTP link to the Tessian portal where further information about to this event can be viewed. - `outbound_email_details` object, required — Details about an email. - `send_time` string, date-time, required — The time that the email was sent or a send attempt was made in UTC. - `tessian_action` 'WARN' | 'BLOCK' | 'SILENTLY_TRACK', required — The action Tessian took when the user tried to send the email. If multiple modules triggered, the action might be the result of another module (i.e. not the module described by this event). - `message_id` string, nullable, required — The email's Message-ID. This field is `null` if no Message-ID was ever assigned to the email (for example if the Tessian outlook addin prevented the email from ever being sent). - `tessian_id` string, required — A unique identifier assigned to the email by Tessian. Similar in concept to an email's Message-ID except it is guaranteed to always be assigned (even if the email was never sent). - `from` union, required — The email address the email was from. - string, email - string, x.400 - `transmitter` union, required — The email address that transmitted the email. In most cases this will be the same as `from` but may differ if someone sent an email on behalf of someone else. - string, email - string, x.400 - `reply_to` union[], required — The email's reply-to addresses. May be empty if there are no reply-to addresses, which implies replies will be sent to the `from` address. - union - … - `recipients` object, required — The recipients of the email. - `to` union[], required — The email addresses listed in the emails `TO` field. - … - `cc` union[], required — The email addresses listed in the emails `CC` field. - … - `bcc` union[], required — The email addresses listed in the emails `BCC` field. - … - `all` union[], required — The email addresses listed in the emails `TO`, `CC` and `BCC` fields. - … - `count` integer, required — The total number of recipients in the email. In this context, we treat a recipient as an email address in the `TO`, `CC` or `BCC` field. Specifically, distribution lists are not expanded. - `subject` string, required — The subject of the email. - `attachments` object, required — Details about the email attachments. - `names` string[], required — The names of all the email attachments. - `count` integer, required — The number of attachments the email has. - `bytes` integer, required — The total size of all attachments in bytes. - `guardian_details` object, required — Details about the Guardian trigger. - `triggered_filter_ids` string[], required — The IDs of all the Guardian filters that triggered. - `type` 'MISDIRECTED_EMAIL' | 'MISATTACHED_FILE', required — The type of Guardian event. - `triggered_filter_names` string[], required — The names of all of the Guardian filters that triggered (at the time the event was retrieved). - `breach_prevented` boolean, required — True if Guardian prevented this email from being sent. - `anomalous_recipients` union[], required — The recipient email addresses that Guardian has identified as being possible mistakes. - union - … - `suggested_recipients` union[], required — The email addresses that Guardian thinks the user should be sending the email to. - union - … - `anomalous_attachments` string[], required — The name(s) of the email attachment(s) Guardian identified as misattached. - `final_outcome` 'null' | 'NOT_SENT' | 'SENT_WITH_CHANGES' | 'SENT_WITHOUT_CHANGES', nullable, required — The final outcome of the email or `null` if the final outcome is not yet known. - `user_responses` string[], required — How the user responded to the Tessian warnings associated with this event. - `justifications` string[], required — Any justifications the user wrote when choosing to send the email. - `user_shown_message` boolean, required — `true` if the user was shown a message for this event, `false` if not. - ArchitectEvent — Properties that all events have. - `id` string, required — A unique identifier for the event. - `type` string, required — The type of event. - `created_at` string, date-time, required — When the event was created in UTC. - `updated_at` string, date-time, required — When the event was last updated in UTC. Creation is counted as an update. - `portal_link` string, url, nullable, required — A HTTP link to the Tessian portal where further information about to this event can be viewed. - `outbound_email_details` object, required — Details about an email. - `send_time` string, date-time, required — The time that the email was sent or a send attempt was made in UTC. - `tessian_action` 'WARN' | 'BLOCK' | 'SILENTLY_TRACK', required — The action Tessian took when the user tried to send the email. If multiple modules triggered, the action might be the result of another module (i.e. not the module described by this event). - `message_id` string, nullable, required — The email's Message-ID. This field is `null` if no Message-ID was ever assigned to the email (for example if the Tessian outlook addin prevented the email from ever being sent). - `tessian_id` string, required — A unique identifier assigned to the email by Tessian. Similar in concept to an email's Message-ID except it is guaranteed to always be assigned (even if the email was never sent). - `from` union, required — The email address the email was from. - string, email - string, x.400 - `transmitter` union, required — The email address that transmitted the email. In most cases this will be the same as `from` but may differ if someone sent an email on behalf of someone else. - string, email - string, x.400 - `reply_to` union[], required — The email's reply-to addresses. May be empty if there are no reply-to addresses, which implies replies will be sent to the `from` address. - union - … - `recipients` object, required — The recipients of the email. - `to` union[], required — The email addresses listed in the emails `TO` field. - … - `cc` union[], required — The email addresses listed in the emails `CC` field. - … - `bcc` union[], required — The email addresses listed in the emails `BCC` field. - … - `all` union[], required — The email addresses listed in the emails `TO`, `CC` and `BCC` fields. - … - `count` integer, required — The total number of recipients in the email. In this context, we treat a recipient as an email address in the `TO`, `CC` or `BCC` field. Specifically, distribution lists are not expanded. - `subject` string, required — The subject of the email. - `attachments` object, required — Details about the email attachments. - `names` string[], required — The names of all the email attachments. - `count` integer, required — The number of attachments the email has. - `bytes` integer, required — The total size of all attachments in bytes. - `architect_details` object, required — Details about the Architect trigger. - `triggered_policy_ids` string[], required — The IDs of all the architect policies that triggered. - `triggered_policy_names` string[], required — The names of all the architect policies (at the time the event was created) that triggered. - `triggered_logic_types` string[], required — The types of conditions and exceptions that triggered across all architect policies. If multiple conditions or exceptions of the same type triggered, the type is only listed once here. - `breach_prevented` boolean, nullable, required — True if Architect prevented this email from being sent. `null` if it has not yet been determined. - `final_outcome` 'NOT_SENT' | 'SENT_WITH_CHANGES' | 'SENT_WITHOUT_CHANGES', nullable, required — The final outcome of the email. `null` if it has not yet been determined. - `user_responses` string[], required — How the user responded to the Tessian warnings associated with this event. - `is_sensitive` boolean, required — Indicates if the email is considered sensitive. - `justifications` string[], required — Any justifications the user wrote when choosing to send the email. - `user_shown_message` boolean, required — `true` if the user was shown a message for this event, `false` if not. - DefenderEvent — Properties that all events have. - `id` string, required — A unique identifier for the event. - `type` string, required — The type of event. - `created_at` string, date-time, required — When the event was created in UTC. - `updated_at` string, date-time, required — When the event was last updated in UTC. Creation is counted as an update. - `portal_link` string, url, nullable, required — A HTTP link to the Tessian portal where further information about to this event can be viewed. - `inbound_email_details` object, required — Details about an email. - `received_time` string, date-time, required — The time that the email was received by the delivering mail server in UTC. - `urls` string[], required — The URLs extracted from the email. - `message_id` string, nullable, required — The email's Message-ID. This field is `null` if no Message-ID was ever assigned to the email (for example if the Tessian outlook addin prevented the email from ever being sent). - `tessian_id` string, required — A unique identifier assigned to the email by Tessian. Similar in concept to an email's Message-ID except it is guaranteed to always be assigned (even if the email was never sent). - `from` union, required — The email address the email was from. - string, email - string, x.400 - `transmitter` union, required — The email address that transmitted the email. In most cases this will be the same as `from` but may differ if someone sent an email on behalf of someone else. - string, email - string, x.400 - `reply_to` union[], required — The email's reply-to addresses. May be empty if there are no reply-to addresses, which implies replies will be sent to the `from` address. - union - … - `recipients` object, required — The recipients of the email. - `to` union[], required — The email addresses listed in the emails `TO` field. - … - `cc` union[], required — The email addresses listed in the emails `CC` field. - … - `bcc` union[], required — The email addresses listed in the emails `BCC` field. - … - `all` union[], required — The email addresses listed in the emails `TO`, `CC` and `BCC` fields. - … - `count` integer, required — The total number of recipients in the email. In this context, we treat a recipient as an email address in the `TO`, `CC` or `BCC` field. Specifically, distribution lists are not expanded. - `subject` string, required — The subject of the email. - `attachments` object, required — Details about the email attachments. - `names` string[], required — The names of all the email attachments. - `count` integer, required — The number of attachments the email has. - `bytes` integer, required — The total size of all attachments in bytes. - `defender_details` object, required — Details about the Defender trigger. - `burst_attack_id` string, required — An identifier for the burst attack this event is part of. - `intent_types` string[], required — The intent types that indicate phishing that Defender found in the email. - `threat_signal_types` string[], required — The types of threat signals that Defender found in the email. - `threat_types` string[], required — The types of attacks detected by Defender. - `spf_result` 'PASSED' | 'FAILED' | 'null', nullable, required — The result of SPF or `null` if the result is not known. - `dkim_result` 'PASSED' | 'FAILED' | 'null', nullable, required — The result of DKIM or `null` if the result is not known. - `dmarc_result` 'PASSED' | 'FAILED' | 'null', nullable, required — The result of DMARC or `null` if the result is not known. - `sender_location` string, nullable, required — A human readable description of the geographical location the email was sent from or `null` if the location is not known. - `users_responded` object, required — How the end users interacted with the email. - `malicious` integer, required — The number of users who indicated that they thought this email was malicious using the buttons in the Tessian warning. - `safe` integer, required — The number of users who indicated that they thought this email was safe using the buttons in the Tessian warning. - `unsure` integer, required — The number of users who indicated that they were not sure if this email was malicious or safe using the buttons in the Tessian warning. - `deleted` integer, required — The number of users who deleted the email without otherwise indicating if they thought the email was malicious or safe. - `number_protected_users` integer, required — The number of recipients of this email that are included in a filter that is actively protecting them (e.g. not only silently tracked). - `confidence` 'VERY_HIGH' | 'HIGH' | 'MEDIUM' | 'LOW', required — How sure Defender is that this email is phishing. - `impersonation_type` 'INTERNAL' | 'EXTERNAL' | 'null', nullable, required — `INTERNAL` if Defender believes your organization's domain is being impersonated. `EXTERNAL` if Defender believes your external counterparties or suppliers are being impersonated. If Defender has not identified the email as an impersonation this field will be `null`. - `impersonated_domain` string, nullable, required — The domain that Defender believes is being impersonated or `null` if no domain is being impersonated. - `impersonated_address` string, nullable, required — The email address that Defender believes is being impersonated or `null` if no address is being impersonated. ## Other responses - `400` — There was a problem with the request - `401` — There was a problem with the request - `403` — Invalid token or API is not enabled - `429` — Rate limited - wait a few seconds and try again - `500` — Server error - `503` — Server error - `504` — Server error --- [API](https://skmtc.net/tessian/apis/tessian-api.md) · [All operations](https://skmtc.net/tessian/apis/tessian-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tessian/tessian-api/revisions/08762fb51cf0/schema)