---
title: "Get a security event"
method: GET
path: "/v2/email-security/security-events/{eventId}"
tags: ["Email Security"]
---

# Get a security event

`GET /v2/email-security/security-events/{eventId}`

## Request

- Base URL: `https://api.adaptivesecurity.com`
- URL: `https://api.adaptivesecurity.com/v2/email-security/security-events/{eventId}`
- Auth: HTTP bearer

Retrieve a single Email Security detection by its identifier.

**Required permission:** `email_security:read`

## Path parameters

- `eventId` string, uuid, required

## Response `200`

Successfully retrieved the security event

- SecurityEventDto: An Email Security detection an admin may need to action
  - `adaptive_url` string: Link to view this security event in Adaptive
  - `analysis` SecurityEventAnalysisDto: What Adaptive's analysis concluded about the message
    - `attack_tactics` string[]: Tactics observed in the message
    - `attack_type` 'CALENDAR_PHISHING' | 'CREDENTIAL_PHISHING' | 'DENYLISTED' | 'FINANCIAL_FRAUD' | 'MALWARE_RANSOMWARE' | 'OFF_CHANNEL_PHISHING' | 'PENDING' | 'SAFE_IN_MALICIOUS_GROUP' | 'SCAM' | 'SPAM', nullable: Kind of attack detected. Null when no attack type was assigned, for example on a user-reported message the analysis judged safe
    - `classification` 'GRAYMAIL' | 'MALICIOUS' | 'SAFE' | 'SPAM': How the message was classified
    - `confidence` integer, nullable: Detection confidence, 0-100
    - `explanation` SecurityEventExplanationDto: Why the message was classified the way it was
      - `reasons` SecurityEventReasonDto[]: Individual reasons behind the classification
        - `detail` string: Full explanation of the reason
        - `evidence` SecurityEventEvidenceDto[]: Evidence supporting this reason
          - `label` string, nullable: What the evidence refers to
          - `value` string: The evidence itself
        - `headline` string: Short summary of the reason
      - `summary` string: One-paragraph summary of the detection
    - `same_message_count` integer: Copies of this message across recipients
    - `similar_security_event_ids` string[]: Sibling security events in the same similar-message campaign
  - `created` string, date-time: When the event was created
  - `delivery` SecurityEventDeliveryDto: How and where the message was delivered
    - `category` 'INBOX' | 'SPAM': Where the provider originally delivered the message
    - `direction` 'INBOUND' | 'INTERNAL': Whether the message originated outside the company
    - `message_location` 'ORIGINAL_DELIVERY_LOCATION' | 'QUARANTINE' | 'SPAM' | 'TRASH': Where the message sits now
    - `opened_status` SecurityEventOpenedStatusDto: Whether recipients have opened the message, as of the last poll
      - `first_seen_opened_at` string, date-time, nullable: When the message was first seen opened
      - `is_opened` boolean, nullable: Whether the message has been opened
      - `last_checked_at` string, date-time, nullable: When open-tracking last polled
      - `opened_count` integer: Recipients who opened the message
      - `poll_status` 'POLLING' | 'DONE' | 'EXPIRED' | 'FAILED': State of open-tracking polling
    - `recipient_mailboxes` string[]: Mailboxes the message currently occupies across all recipients
  - `id` string, uuid: Unique identifier for the security event
  - `integration` SecurityEventIntegrationDto: The email integration the message was delivered to
    - `display_name` string, nullable: Name the admin gave the integration
    - `id` string, uuid: Integration identifier
    - `provider` 'GOOGLE' | 'MICROSOFT': Email provider
  - `message` SecurityEventMessageDto: The email message behind the security event
    - `all_recipients` string[]: Every addressed recipient (to, cc and bcc)
    - `attachments` SecurityEventAttachmentDto[]: Attachments recorded when the message was scanned
      - `content_type` string: MIME type
      - `file_extension` string, nullable: Extension parsed from the file name
      - `name` string: File name
      - `scan_result` 'SAFE' | 'MALICIOUS' | 'UNDETERMINED': Malware scan outcome
      - `sha256` string: SHA-256 of the file contents
      - `size_bytes` integer: Size in bytes
    - `headers` SecurityEventHeaderDto[]: Security-relevant headers from the raw message, in their original order. Repeated headers such as 'Received' appear as separate entries.
      - `name` string: Header name as it appears in the message
      - `value` string: Header value
    - `links` SecurityEventLinkDto[]: Links found in the message body
      - `display_text` string, nullable: Anchor text shown to the recipient
      - `source` 'EMAIL_BODY' | 'PDF_ATTACHMENT': Where the link was found in the email
      - `type` 'HYPERLINK' | 'PLAIN_TEXT' | 'QR_CODE': The type of link
      - `url` string: Target URL
    - `message_timestamp` string, date-time, nullable: When the provider received the message
    - `recipient` string: Mailbox this event belongs to
    - `rfc_2392_message_id` string, nullable: RFC 2392 Message-ID of the message
    - `sender` string: Sender address
    - `subject` string, nullable: Message subject
  - `reports` SecurityEventReportsDto: Users who reported the message behind the event
    - `count` integer: Number of reports. Each report counts, also when one user reports more than once
    - `first_reported_at` string, date-time, nullable: When the first report was made, or null when the message has no reports
    - `last_reported_at` string, date-time, nullable: When the latest report was made, or null when the message has no reports
    - `reported_by` SecurityEventReport[]: One entry per report, oldest first
      - `method` 'PHISH_ALERT_BUTTON' | 'EMAIL_FORWARDING' | 'EMAIL_FORWARDING_IN_LINE' | 'BANNER': How the user reported the message
      - `reported_at` string, date-time: When the user reported the message
      - `reporter` SecurityEventReporter: The user who reported the message
        - `email_address` string: Email address of the user who reported the message
        - `name` string, nullable: Display name of the reporter, when known
        - `user_id` string, uuid, nullable: Adaptive user id of the reporter, when the report is linked to an Adaptive user
  - `review` SecurityEventReviewDto: Where the event sits in the admin review workflow
    - `last_remediation_actor` 'ADMIN' | 'AUTO_GROUP_REMEDIATION' | 'MODEL' | 'PUBLIC_API_TOKEN', nullable: Who performed the most recent remediation
    - `remediation_error` SecurityEventRemediationErrorDto: How the most recent remediation turned out across the message's recipients
      - `error_type` 'FAILED' | 'WARNING': Whether the remediation failed outright or completed with caveats
      - `message` string: Explanation of the outcome
      - `title` string: Short headline for the outcome
    - `status` 'NEEDS_REVIEW' | 'REMEDIATING' | 'RESOLVED': Review state
  - `source` 'DETECTION' | 'USER_REPORT' | 'SIMILAR_FETCH' | 'DENYLIST' | 'ADMIN_REPORT': What caused the event to be created
  - `version` integer: DTO version, incremented when the shape changes

## Other responses

- `401`: Unauthorized - Invalid or missing authentication token
- `403`: Email Security is not available for this company
- `404`: Security event not found
- `500`: Internal server error

## Changes

- **2026-11-03** `c367e8f673f3`: 1 breaking, 1 warning, 1 info
  - the response property `analysis/attack_type` became nullable for the status `200`
  - added the new `ADMIN_REPORT` enum value to the `source` response property for the response status `200`
  - added the optional property `reports` to the response with the `200` status
- **2026-10-09** `1e527b1a2d31`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/changes/v2/email-security/security-events/:eventId/get.md)

---

[API](https://skmtc.dev/adaptivesecurity/apis/adaptive-api.md) - [All operations](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/revisions/c367e8f673f3?raw)