Email Security

Get a security event

Changed on

Retrieve a single Email Security detection by its identifier.

Required permission: email_security:read

get/v2/email-security/security-events/{eventId}

Request

  • Base URL
    https://api.adaptivesecurity.com
  • URL
    https://api.adaptivesecurity.com/v2/email-security/security-events/{eventId}
  • Auth
    HTTP bearer

Path parameters

eventIdstring uuid required

Security event ID

Response

Successfully retrieved the security event

adaptive_urlstring

Link to view this security event in Adaptive

createdstring date-time

When the event was created

idstring uuid

Unique identifier for the security event

source'DETECTION' | 'USER_REPORT' | 'SIMILAR_FETCH' | 'DENYLIST' | 'ADMIN_REPORT'

What caused the event to be created

versioninteger

DTO version, incremented when the shape changes

Example response

{
  "adaptive_url": "https://admin.adaptivesecurity.com/email-security/security-events/a8f2947c-3aef-4f5a-981f-08be76fde32f",
  "analysis": {
    "attack_tactics": [
      "vendor_impersonation"
    ],
    "attack_type": "CREDENTIAL_PHISHING",
    "classification": "MALICIOUS",
    "confidence": 62,
    "explanation": {
      "reasons": [
        {
          "evidence": [
            {
              "label": "Body excerpt",
              "value": "would you like to See What is the price?"
            }
          ],
          "headline": "Conference attendee list sales lure"
        }
      ]
    },
    "same_message_count": 1
  },
  "created": "2026-09-15T22:19:04.212168Z",
  "delivery": {
    "category": "INBOX",
    "direction": "INBOUND",
    "message_location": "QUARANTINE",
    "opened_status": {
      "first_seen_opened_at": "2026-09-15T22:19:05.019434Z",
      "last_checked_at": "2026-09-15T22:19:05.019434Z",
      "poll_status": "DONE"
    }
  },
  "id": "a8f2947c-3aef-4f5a-981f-08be76fde32f",
  "integration": {
    "display_name": "Acme Google Workspace",
    "id": "72f66c91-6aec-4561-9395-3b5b7d3b2b70",
    "provider": "GOOGLE"
  },
  "message": {
    "attachments": [
      {
        "content_type": "application/pdf",
        "file_extension": "pdf",
        "name": "invoice.pdf",
        "scan_result": "SAFE",
        "size_bytes": 24576
      }
    ],
    "headers": [
      {
        "name": "Received",
        "value": "from mail.example.com (mail.example.com [203.0.113.50])"
      }
    ],
    "links": [
      {
        "display_text": "WWW.CLICK-THIS-LINK.COM",
        "source": "EMAIL_BODY",
        "type": "HYPERLINK",
        "url": "http://www.click-this-link.com/"
      }
    ],
    "message_timestamp": "2026-09-15T22:15:25Z",
    "recipient": "recipient@example.com",
    "rfc_2392_message_id": "<CAF1x2y3z4@mail.example.com>",
    "sender": "sender@example.com",
    "subject": "RSVP Required"
  },
  "reports": {
    "count": 1,
    "first_reported_at": "2026-09-15T22:19:04Z",
    "last_reported_at": "2026-09-16T08:02:11Z",
    "reported_by": [
      {
        "method": "PHISH_ALERT_BUTTON",
        "reported_at": "2026-09-15T22:19:04Z",
        "reporter": {
          "email_address": "jordan.lee@example.com",
          "name": "Jordan Lee",
          "user_id": "5d0b6c1e-8f3a-4b7e-9c2d-1a4e6f8b0c3d"
        }
      }
    ]
  },
  "review": {
    "last_remediation_actor": "ADMIN",
    "remediation_error": {
      "error_type": "WARNING",
      "message": "The email was already deleted by the recipient. There was nothing left to move.",
      "title": "Email was already deleted"
    },
    "status": "RESOLVED"
  },
  "source": "DETECTION",
  "version": 1
}

Changes

    • breaking

      the response property / became nullable for the status

    • warning

      added the new ADMIN_REPORT enum value to the response property for the response status

    • info

      added the optional property to the response with the status

    • info

      endpoint added