SUsublime
Message Groups

List message groups

Changed on

List message groups

get/v0/message-groups

Request

  • Base URL
    https://platform.sublime.security
  • URL
    https://platform.sublime.security/v0/message-groups
  • Auth
    HTTP bearer

Query parameters

attachment_name__isstring[]

Filters result to only message groups with the provided attachment name

attachment_sha256__isstring[]

Filters result to only message groups with the provided attachment SHA256

attack_score_verdict__isstring[]

Filters result to only message groups with the provided attack score verdict

attack_surface_reduction__filterstring bool nullable

Filters result to only message groups that have flagged (ONLY) rules with the 'Attack surface reduction' tag

canonical_id__isstring[]

Filters result to only message groups with the provided canonical ID

created_at__gtestring date-time nullable

Inclusive start datetime filter, in UTC using the ISO 8601 format (e.g., '2021-03-14T15:09:26Z'). Only message groups that contain a message processed at or after this time will be returned.

created_at__ltstring date-time nullable

Exclusive end datetime filter, in UTC using the ISO 8601 format (e.g., '2021-05-04T15:09:26Z'). Only message groups that contain a message processed before this time will be returned. Paired with created_at__gte this selects groups that were active at any point in the window, including groups that are still receiving messages after it. Note that this bounds a group's oldest message while created_at__gte bounds its newest, so the two cannot be served by a single index and the request may time out on high volume organizations or wide date ranges. If you only need groups whose newest message falls inside the window, prefer last_created_at__lt, which bounds the same field as created_at__gte.

first_message_reported_at[gte]string date-time nullable

DEPRECATED: Use first_message_reported_at__gte

first_message_reported_at__gtestring date-time nullable

Filters result to only message groups with a message first reported at or after the provided time. Datetime must be in UTC using the ISO 8601 format (e.g., '2021-03-14T15:09:26Z').

flaggedboolean nullable

Filters result to only message groups with at least one flagged message

flagged_rule_id__isstring[]

Filters result to only message groups with the provided flagged rule ID

flagged_rule_severity__isstring[]

Filters result to only message groups with the provided flagged rule severity

historically_flagged_rule_id__isstring[]

Filters result to only message groups with the provided historically flagged rule ID

historically_flagged_rule_severity__isstring[]

Filters result to only message groups with the provided historically flagged rule severity

last_created_at__gtestring date-time nullable

Inclusive start datetime filter, in UTC using the ISO 8601 format (e.g., '2021-03-14T15:09:26Z'). Only message groups whose newest message was processed at or after this time will be returned. Equivalent to created_at__gte.

last_created_at__ltstring date-time nullable

Exclusive end datetime filter, in UTC using the ISO 8601 format (e.g., '2021-05-04T15:09:26Z'). Only message groups whose newest message was processed before this time will be returned. Unlike created_at__lt, groups that are still receiving messages after this time are excluded. Prefer this over created_at__lt for historical lookbacks, since it bounds the same field as created_at__gte and both can then be served by a single index. High volume organizations may still need to request narrow time windows to avoid a timeout.

last_message_created_at[gte]string date-time nullable

DEPRECATED: Use created_at__gte instead

limitinteger nullable

The maximum number of message groups to return. If the value exceeds the maximum, then the maximum value will be used.

mailbox_email__isstring[]

Filters result to only message groups with the provided mailbox email

offsetinteger nullable

The (zero-based) offset of the message groups to return

recipient_email__isstring[]

Filters result to only message groups with the provided recipient email

reported_as_phish_by__isstring[]

Filters result to only message groups with the provided reporter

reviewedboolean nullable

Filters result to only message groups which have or have not been reviewed

sender_display_name__isstring[]

Filters result to only message groups with the provided sender display name

sender_domain__isstring[]

Filters result to only message groups with the provided sender domain

sender_email__isstring[]

Filters result to only message groups with the provided sender email

spam__isstring[]

Filters result to only message groups with the provided spam status

subject__isstring[]

Filters result to only message groups with the provided subject

user_reportedboolean nullable

Filters result to only message groups with at least one reported message

vendor_id__isstring[]

Filters result to only message groups with the provided vendor

verdict__is_notstring[]

Filters out message groups whose Sublime verdict is any of the provided values. Excluding a high-volume verdict such as graymail both shrinks the result set and lets the query use verdict-aware indexes, which can substantially speed up large flagged lookbacks.

Response

OK

countinteger required

Count of messages groups for this page

stats_limit_exceededboolean

Indicates if 'total' is a lower bound

totalinteger required

Total number of messages groups matching the search

Changes

  • 081203bd7147Revision changes
    • info

      added the new optional query request parameter last_created_at__gte

    • info

      added the new optional query request parameter last_created_at__lt

    • info

      added the new optional query request parameter verdict__is_not

    • info

      added the optional property // to the response with the status

    • info

      added the optional property // to the response with the status

    • info

      added the optional property // to the response with the status