---
title: "email_security.security_event.created"
method: POST
path: "email_security.security_event.created"
tags: ["Webhooks"]
---

# email_security.security_event.created

`POST email_security.security_event.created` (webhook)

An Email Security event at creation, including the review decision from the same ingest pass.

**Subscription filters**

- `classification` — one of: `MALICIOUS`, `SPAM`
- `review_status` — one of: `NEEDS_REVIEW`, `RESOLVED`
- `source` — one of: `DENYLIST`, `DETECTION`, `SIMILAR_FETCH`, `USER_REPORT`

## Payload

- WebhookEnvelopeSecurityEventCreatedPayload: The CloudEvents envelope wrapping every webhook event
  - `data` WebhookEnvelopeDataSecurityEventCreatedPayload: The data member of the CloudEvents envelope: the event payload plus the subscription's custom data
    - `customdata` unknown
    - `payload` SecurityEventCreatedPayload: An Email Security event at creation, including the review decision from the same ingest pass.
      - `adaptive_url` string: Link to view this security event in Adaptive.
      - `analysis` SecurityEventAnalysis: What Adaptive's analysis concluded about the email message.
        - `attack_tactics` string[]: Tactics observed in the message. Empty for denylist events.
        - `attack_type` 'CALENDAR_PHISHING' | 'CREDENTIAL_PHISHING' | 'DENYLISTED' | 'FINANCIAL_FRAUD' | 'MALWARE_RANSOMWARE' | 'OFF_CHANNEL_PHISHING' | 'PENDING' | 'SAFE_IN_MALICIOUS_GROUP' | 'SCAM' | 'SPAM': Kind of attack detected.
        - `confidence` integer: Detection confidence from 0 to 100. Absent when unavailable.
        - `explanation` SecurityEventExplanation: Why the email message was classified the way it was.
          - `reasons` SecurityEventReason[]: Individual reasons behind the classification.
            - `detail` string: Full explanation of the reason.
            - `evidence` SecurityEventEvidence[]: Evidence supporting this reason.
              - …
            - `headline` string: Short summary of the reason.
          - `summary` string: Summary of the detection.
      - `auto_remediation_action` 'DELETE' | 'MOVE_TO_SPAM' | 'QUARANTINE': Automatic remediation action started during ingestion, not a confirmation of completion. Absent when no action was decided or applying the decision failed.
      - `classification` 'MALICIOUS' | 'SPAM': How the security event was classified at creation.
      - `created` string, date-time: When the security event was created (ISO-8601).
      - `delivery` SecurityEventDelivery: How and where the email message was delivered at event creation.
        - `category` 'INBOX' | 'SPAM': Where the provider originally delivered the message.
        - `direction` 'INBOUND' | 'INTERNAL': Whether the message originated outside the company.
        - `message_location` 'ORIGINAL_DELIVERY_LOCATION' | 'QUARANTINE' | 'SPAM' | 'TRASH': Message location at event creation, before any asynchronous remediation completes.
      - `id` string, uuid: Unique identifier for the security event.
      - `integration` SecurityEventIntegration: The email integration the message was delivered to.
        - `display_name` string: Name the admin gave the integration. Absent when unavailable.
        - `id` string, uuid: Integration identifier.
        - `provider` 'GOOGLE' | 'MICROSOFT': Email provider.
      - `message` SecurityEventMessage: The email message behind the security event.
        - `all_recipients` string[]: Every addressed recipient, including To, Cc and Bcc.
        - `attachments` SecurityEventAttachment[]: Attachments recorded during scanning. Empty for denylist events or when none were persisted.
          - `content_type` string: MIME type.
          - `file_extension` string: Extension parsed from the file name. Absent when the name has no extension.
          - `name` string: File name.
          - `scan_result` 'SAFE' | 'MALICIOUS' | 'UNDETERMINED': Malware scan outcome at event creation.
          - `sha256` string: SHA-256 of the file contents.
          - `size_bytes` integer: Size in bytes.
        - `headers` SecurityEventHeader[]: Security-relevant headers in their original order. Repeated headers remain separate entries.
          - `name` string: Header name as it appears in the message.
          - `value` string: Header value.
        - `links` SecurityEventLink[]: Links found in the message body. Empty when none are available.
          - `display_text` string: Anchor text shown to the recipient. Absent for links without display text.
          - `source` 'EMAIL_BODY' | 'PDF_ATTACHMENT': Where the link was found in the email.
          - `type` 'HYPERLINK' | 'PLAIN_TEXT' | 'QR_CODE': The type of link.
          - `url` string: Target URL.
        - `message_timestamp` string, date-time: When the provider received the message (ISO-8601). Absent when unavailable.
        - `recipient` string: Mailbox of the primary copy that created this event.
        - `rfc_2392_message_id` string: RFC 2392 Message-ID. Absent when unavailable.
        - `sender` string: Sender address.
        - `subject` string: Message subject. Absent when unavailable.
      - `review_status` 'NEEDS_REVIEW' | 'RESOLVED': Review status decided during ingestion, not the transient remediation workflow state.
      - `source` 'DETECTION' | 'USER_REPORT' | 'SIMILAR_FETCH' | 'DENYLIST': What caused the security event to be created.
  - `datacontenttype` string: media type of `data`
  - `id` string: unique id for event
  - `source` string: the event source; always `/adaptive`
  - `specversion` string: CloudEvents spec version
  - `subject` string: reserved for the event's primary entity id; currently never set, so always omitted
  - `time` string, date-time: when the event occurred
  - `type` 'email_security.security_event.created': the event type

## Acknowledgement `2XX`

Return any 2xx status to acknowledge the delivery. Timeouts, 408, 429, and 5xx responses other than 501 are retried; any other status is a permanent failure.

---

[API](https://skmtc.dev/adaptivesecurity/apis/adaptive-api.md) - [All operations](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/revisions/c367e8f673f3?raw)