List Blocked Messages

Get a list of blocked messages.

External Documentation

To learn more, visit the Proofpoint TAP documentation.

​

Basic Parameters

Parameter	Description
Starting Time	The starting time of the search interval. End time is the current server time.
Threat Status	Returns only chosen threat status.
Threat Type	Returns only chosen threat types.

​

Advanced Parameters

Parameter	Description
Interval	The interval of the events returned. Maximum interval is 1 hour. For example: 2016-05-01T12:00:00Z/2016-05-01T13:00:00Z.
Seconds Since	The size of the search interval in seconds starting from the current server time. Valid range: 30-3600

​

Example Output

{
	"queryEndTime": "<string>",
	"messagesBlocked": [
		{
			"spamScore": "<integer>",
			"phishScore": "<integer>",
			"threatsInfoMap": [
				{
					"threatID": "<string>",
					"threatStatus": "<string>",
					"classification": "<string>",
					"detectionType": "<string>",
					"threatUrl": "<string>",
					"threatTime": "<string>",
					"threat": "<string>",
					"campaignID": "<string>",
					"actors": [],
					"threatType": "<string>"
				}
			],
			"messageTime": "<string>",
			"impostorScore": "<integer>",
			"malwareScore": "<integer>",
			"cluster": "<string>",
			"subject": "<string>",
			"quarantineFolder": "<string>",
			"quarantineRule": "<string>",
			"policyRoutes": [
				"<string>",
				"<string>",
				"<string>"
			],
			"modulesRun": [
				"<string>",
				"<string>",
				"<string>",
				"<string>",
				"<string>",
				"<string>",
				"<string>",
				"<string>"
			],
			"messageSize": "<integer>",
			"headerFrom": "<string>",
			"headerReplyTo": "<string>",
			"fromAddress": [
				"<string>"
			],
			"ccAddresses": [],
			"replyToAddress": [],
			"toAddresses": [
				"<string>"
			],
			"xmailer": "<string>",
			"messageParts": [
				{
					"disposition": "<string>",
					"sha256": "<string>",
					"md5": "<string>",
					"filename": "<string>",
					"sandboxStatus": "<string>",
					"oContentType": "<string>",
					"contentType": "<string>"
				}
			],
			"completelyRewritten": "<boolean>",
			"id": "<string>",
			"QID": "<string>",
			"GUID": "<string>",
			"sender": "<string>",
			"recipient": [
				"<string>"
			],
			"senderIP": "<string>",
			"messageID": "<string>"
		},
		{
			"spamScore": "<integer>",
			"phishScore": "<integer>",
			"threatsInfoMap": [
				{
					"threatID": "<string>",
					"threatStatus": "<string>",
					"classification": "<string>",
					"detectionType": "<string>",
					"threatUrl": "<string>",
					"threatTime": "<string>",
					"threat": "<string>",
					"campaignID": "<string>",
					"actors": [],
					"threatType": "<string>"
				}
			],
			"messageTime": "<string>",
			"impostorScore": "<integer>",
			"malwareScore": "<integer>",
			"cluster": "<string>",
			"subject": "<string>",
			"quarantineFolder": "<string>",
			"quarantineRule": "<string>",
			"policyRoutes": [
				"<string>",
				"<string>",
				"<string>"
			],
			"modulesRun": [
				"<string>",
				"<string>",
				"<string>",
				"<string>",
				"<string>",
				"<string>",
				"<string>",
				"<string>"
			],
			"messageSize": "<integer>",
			"headerFrom": "<string>",
			"headerReplyTo": "<string>",
			"fromAddress": [
				"<string>"
			],
			"ccAddresses": [],
			"replyToAddress": [],
			"toAddresses": [
				"<string>"
			],
			"xmailer": "<string>",
			"messageParts": [
				{
					"disposition": "<string>",
					"sha256": "<string>",
					"md5": "<string>",
					"filename": "<string>",
					"sandboxStatus": "<string>",
					"oContentType": "<string>",
					"contentType": "<string>"
				}
			],
			"completelyRewritten": "<boolean>",
			"id": "<string>",
			"QID": "<string>",
			"GUID": "<string>",
			"sender": "<string>",
			"recipient": [
				"<string>"
			],
			"senderIP": "<string>",
			"messageID": "<string>"
		}
	]
}