Get User-Reported Emails

Last updated on 2025-02-26 19:02:48

This functionality is not available with the legacy Barracuda Email Protection Advanced plan. All other Email Protection Plans, including all current Email Protection Plans have this functionality. To upgrade to one of these plans, contact your Barracuda Networks Sales Representative.

Retrieves a list of user-reported emails for a Microsoft 365 tenant.

Endpoint

GET /beta/accounts/{accountId}/forensics/{tenantId}/user-reported-emails

Parameters

Name	Type	Required	Description
Path Parameters
accountId	string	*	The Barracuda Cloud Control account ID obtained from the Get Accounts API.
tenantId	string	*	The Microsoft 365 tenant ID obtained from the Get Tenants API.
Query Parameters
page	integer		The current page to return. Default value : 0
size	integer		The number of results to return. Default value : 10
states	array[string]		The states used to filter results: SUBMITTED: The administrator has not yet reviewed these items. REMEDIATED: These emails were potential threats that became the basis of new incidents. DISMISSED: The administrator determined these emails did not pose a threat and dismissed them. Available values : DISMISSED, REMEDIATED, SUBMITTED Default value : SUBMITTED
unit	string		The type of time unit to apply to unitAmount. Available values : days, hours Default value : days
unitAmount	integer		The amount of time units for returning results. Default value : 30

Response Codes

Code	Description
200	OK
401	Unauthorized: There is a missing or incorrect API token in header or the client did not have permission to access the requested resource.

Response

Entry

Description

Type

itemsTotal

The total number of items.

integer

pageNum

The current page number.

integer

pagesTotal

The total number of pages.

integer

results*

The list of objects that each represent information about an email that a user reported as suspicious.

Entry

Description

Type

deliveredDate

The date the suspicious email was delivered.

string

messageId

The Microsoft 365 messageID.

string

reportedBy

The email address of the user who reported the email.

string

reportedDate

The date the user reported the email.

string

searchCriteria

The search criteria for a user reported email, which can be used to create an incident.

Entry	Description	Type
senderEmail	The email address of the sender.	string
senderName	The name of the sender.	string
subjectQuery	The subject.	string

state

The state of the user reported email:

SUBMITTED: The administrator has not yet reviewed this item.
REMEDIATED: The email was a potential threat that became the basis of a new incident.
DISMISSED: The administrator determined the email did not pose a threat and dismissed it.

Possible values : DISMISSED, REMEDIATED, SUBMITTED

string

tenantId

The Microsoft 365 tenant ID.

string

Array

resultsCount

The number of items on the current page.

integer

Sample Request

curl -X GET "https://api.barracudanetworks.com/beta/accounts/{accountId}/forensics/{tenantId}/user-reported-emails" \
--header "Authorization: Bearer {access_token}"

Sample Response

{
    "resultsCount": 1,
    "pageNum": 0,
    "itemsTotal": 1,
    "pagesTotal": 1,
    "results": [
        {
            "messageId": "AAkALgAAAAAAHYQDEapmEc2byACqAC-EWg0A3GJ3eSIXUEGSD6mjKTCnzwABR5A8xAAA",
            "tenantId": "f571bbf9-114c-4759-9ecb-2f852065595a",
            "reportedBy": "jdoe@barracuda.com",
            "deliveredDate": "2021-04-05T10:00:00.000000Z",
            "reportedDate": "2021-04-05T10:30:00.000000Z",
            "searchCriteria": {
                "senderEmail": "attack@virus.com",
                "senderName": "",
                "subjectQuery": "Example Subject"
            },
            "state": "REMEDIATED"
        }
    ]
}