---
title: "List security events"
method: GET
path: "/v2/email-security/security-events"
tags: ["Email Security"]
---

# List security events

`GET /v2/email-security/security-events`

## Request

- Base URL: `https://api.adaptivesecurity.com`
- URL: `https://api.adaptivesecurity.com/v2/email-security/security-events`
- Auth: HTTP bearer

Retrieve Email Security detections, newest first. Each item is a security event without the fields that need a read per event: message attachments, headers and links, similar_security_event_ids, last_remediation_actor, remediation_error and the integration's display_name. Get a security event by its id for those. Filters combine with AND. Spam events are listed only when spam detection is enabled for the company.

**Required permission:** `email_security:read`

## Query parameters

- `page_after` string
- `page_size` integer
- `classification` string[]
- `review_status` string[]
- `source` string[]
- `start_date` string, date-time
- `end_date` string, date-time

## Response `200`

Successfully retrieved security events

- SecurityEventListResponseDto: Paginated list of security events, newest first
  - `page_after` string, nullable: Cursor for the next page of results. Null if this is the last page
  - `security_events` SecurityEventSummaryDto[]: Security events on this page
    - `adaptive_url` string: Link to view this security event in Adaptive
    - `analysis` SecurityEventAnalysisSummaryDto: What Adaptive's analysis concluded about the message
      - `attack_tactics` string[]: Tactics observed in the message
      - `attack_type` 'CALENDAR_PHISHING' | 'CREDENTIAL_PHISHING' | 'DENYLISTED' | 'FINANCIAL_FRAUD' | 'MALWARE_RANSOMWARE' | 'OFF_CHANNEL_PHISHING' | 'PENDING' | 'SAFE_IN_MALICIOUS_GROUP' | 'SCAM' | 'SPAM', nullable: Kind of attack detected. Null when no attack type was assigned, for example on a user-reported message the analysis judged safe
      - `classification` 'GRAYMAIL' | 'MALICIOUS' | 'SAFE' | 'SPAM': How the message was classified
      - `confidence` integer, nullable: Detection confidence, 0-100
      - `explanation` SecurityEventExplanationDto: Why the message was classified the way it was
        - `reasons` SecurityEventReasonDto[]: Individual reasons behind the classification
          - `detail` string: Full explanation of the reason
          - `evidence` SecurityEventEvidenceDto[]: Evidence supporting this reason
            - `label` string, nullable: What the evidence refers to
            - `value` string: The evidence itself
          - `headline` string: Short summary of the reason
        - `summary` string: One-paragraph summary of the detection
      - `same_message_count` integer: Copies of this message across recipients
    - `created` string, date-time: When the event was created
    - `delivery` SecurityEventDeliveryDto: How and where the message was delivered
      - `category` 'INBOX' | 'SPAM': Where the provider originally delivered the message
      - `direction` 'INBOUND' | 'INTERNAL': Whether the message originated outside the company
      - `message_location` 'ORIGINAL_DELIVERY_LOCATION' | 'QUARANTINE' | 'SPAM' | 'TRASH': Where the message sits now
      - `opened_status` SecurityEventOpenedStatusDto: Whether recipients have opened the message, as of the last poll
        - `first_seen_opened_at` string, date-time, nullable: When the message was first seen opened
        - `is_opened` boolean, nullable: Whether the message has been opened
        - `last_checked_at` string, date-time, nullable: When open-tracking last polled
        - `opened_count` integer: Recipients who opened the message
        - `poll_status` 'POLLING' | 'DONE' | 'EXPIRED' | 'FAILED': State of open-tracking polling
      - `recipient_mailboxes` string[]: Mailboxes the message currently occupies across all recipients
    - `id` string, uuid: Unique identifier for the security event
    - `integration` SecurityEventIntegrationSummaryDto: The email integration the message was delivered to
      - `id` string, uuid: Integration identifier
      - `provider` 'GOOGLE' | 'MICROSOFT': Email provider
    - `message` SecurityEventMessageSummaryDto: The email message behind the security event
      - `all_recipients` string[]: Every addressed recipient (to, cc and bcc)
      - `message_timestamp` string, date-time, nullable: When the provider received the message
      - `recipient` string: Mailbox this event belongs to
      - `rfc_2392_message_id` string, nullable: RFC 2392 Message-ID of the message
      - `sender` string: Sender address
      - `subject` string, nullable: Message subject
    - `reports` SecurityEventReportsDto: Users who reported the message behind the event
      - `count` integer: Number of reports. Each report counts, also when one user reports more than once
      - `first_reported_at` string, date-time, nullable: When the first report was made, or null when the message has no reports
      - `last_reported_at` string, date-time, nullable: When the latest report was made, or null when the message has no reports
      - `reported_by` SecurityEventReport[]: One entry per report, oldest first
        - `method` 'PHISH_ALERT_BUTTON' | 'EMAIL_FORWARDING' | 'EMAIL_FORWARDING_IN_LINE' | 'BANNER': How the user reported the message
        - `reported_at` string, date-time: When the user reported the message
        - `reporter` SecurityEventReporter: The user who reported the message
          - `email_address` string: Email address of the user who reported the message
          - `name` string, nullable: Display name of the reporter, when known
          - `user_id` string, uuid, nullable: Adaptive user id of the reporter, when the report is linked to an Adaptive user
    - `review` SecurityEventReviewSummaryDto: Where the event sits in the admin review workflow
      - `status` 'NEEDS_REVIEW' | 'REMEDIATING' | 'RESOLVED': Review state
    - `source` 'DETECTION' | 'USER_REPORT' | 'SIMILAR_FETCH' | 'DENYLIST' | 'ADMIN_REPORT': What caused the event to be created
    - `version` integer: DTO version, incremented when the shape changes

## Other responses

- `400`: Invalid page cursor, page size or filter value
- `401`: Unauthorized - Invalid or missing authentication token
- `403`: Email Security is not available for this company
- `429`: Too many requests - Rate limit exceeded
- `500`: Internal server error

## Changes

- **2026-11-03** `c367e8f673f3`: 1 breaking, 1 warning, 2 info
  - the response property `security_events/items/analysis/attack_type` became nullable for the status `200`
  - added the new `ADMIN_REPORT` enum value to the `security_events/items/source` response property for the response status `200`
  - added the enum value `ADMIN_REPORT` to the property `items/` of the `query` request parameter `source`
  - added the optional property `security_events/items/reports` to the response with the `200` status
- **2026-10-29** `415bfaebfcdf`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/changes/v2/email-security/security-events/get.md)

---

[API](https://skmtc.dev/adaptivesecurity/apis/adaptive-api.md) - [All operations](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/revisions/c367e8f673f3?raw)