It seems like your browser didn't download the required fonts. Please revise your security settings and try again.

Get User-Reported Emails

  • Last updated on

 

This functionality is available only with Barracuda Email Protection Premium and Premium Plus plans. To upgrade to one of these plans, contact your Barracuda Networks Sales Representative. 

Retrieves a list of user-reported emails for a Microsoft 365 tenant.

Endpoint

GET /beta/accounts/{accountId}/forensics/{tenantId}/user-reported-emails

Parameters

NameTypeRequiredDescription
Path Parameters
accountId string*The Barracuda Cloud Control account ID obtained from the Get Accounts API.
tenantId string*The Microsoft 365 tenant ID obtained from the Get Tenants API.
Query Parameters
pageinteger 

The current page to return.

Default value : 0

sizeinteger 

The number of results to return.

Default value : 10

statesarray[string] 

The states used to filter results:

  • SUBMITTED: The administrator has not yet reviewed these items.
  • REMEDIATED: These emails were potential threats that became the basis of new incidents.
  • DISMISSED: The administrator determined these emails did not pose a threat and dismissed them.

Available values : DISMISSED, REMEDIATED, SUBMITTED

Default value : SUBMITTED

unit string 

The type of time unit to apply to unitAmount.

Available values : days, hours

Default value : days

unitAmountinteger The amount of time units for returning results.

Default value : 30

Response Codes

Code
Description
200OK
401

Unauthorized: There is a missing or incorrect API token in header or the client did not have permission to access the requested resource.

Response

Entry
Description
Type
itemsTotalThe total number of items.integer
pageNum

The current page number.

integer
pagesTotal
The total number of pages.
integer
results*

The list of objects that each represent information about an email that a user reported as suspicious.

Entry
Description
Type
deliveredDate

The date the suspicious email was delivered.

string
messageIdThe Microsoft 365 messageID.string
reportedBy

The email address of the user who reported the email.

string
reportedDateThe date the user reported the email.

string

searchCriteria

The search criteria for a user reported email, which can be used to create an incident.

Entry
Description
Type
senderEmail

The email address of the sender.

string
senderName 

The name of the sender.

string
subjectQueryThe subject.string
 
state

The state of the user reported email:

  • SUBMITTED: The administrator has not yet reviewed this item.
  • REMEDIATED: The email was a potential threat that became the basis of a new incident.
  • DISMISSED: The administrator determined the email did not pose a threat and dismissed it.

Possible values : DISMISSED, REMEDIATED, SUBMITTED

string
tenantId

The Microsoft 365 tenant ID.

string
Array
resultsCount

The number of items on the current page.

integer


Sample Request

curl -X GET "https://api.barracudanetworks.com/beta/accounts/{accountId}/forensics/{tenantId}/user-reported-emails" \
--header "Authorization: Bearer {access_token}"

Sample Response

{
    "resultsCount": 1,
    "pageNum": 0,
    "itemsTotal": 1,
    "pagesTotal": 1,
    "results": [
        {
            "messageId": "AAkALgAAAAAAHYQDEapmEc2byACqAC-EWg0A3GJ3eSIXUEGSD6mjKTCnzwABR5A8xAAA",
            "tenantId": "f571bbf9-114c-4759-9ecb-2f852065595a",
            "reportedBy": "jdoe@barracuda.com",
            "deliveredDate": "2021-04-05T10:00:00.000000Z",
            "reportedDate": "2021-04-05T10:30:00.000000Z",
            "searchCriteria": {
                "senderEmail": "attack@virus.com",
                "senderName": "",
                "subjectQuery": "Example Subject"
            },
            "state": "REMEDIATED"
        }
    ]
}