Downstream message ID request

Retrieves the trace document for messages tagged with Downstream Message ID (added by the sender). The response includes both the downstream message ID and Email Security — Cloud message ID for each retrieved trace document.

GET https://<etp_instance_addr>/api/v1/messages?downstream_message_id="<downstream_message_id>"

Required header:

x-fireeye-api-key: <key>—Specifies your personal API key.

Options

downstream_message_id=<downstream_message_id>—(string) The message ID (the Downstream-Message-ID header, if present) logged when an email comes into the Email Security — Cloud stack. If there are special characters, such as +, #, whitespace, and so on in the downstream_message_id, then use the --data-urlencode option in the curl command. See the example below.
size=<number>—(integer) Number of messages to return. Default: 20. Optional.

Example request:

Values for ID and other fields are for illustration purposes only.

GET https://etp.us.fireeye.com/api/v1/messages?downstream_message_id="F00EBE600"

Example request with special characters in the downstream_message_id:

GET https://etp.us.fireeye.com/api/v1/messages/ --data-urlencode "downstream_message_id=<2019012214#2039041588@90-F21KG3QP-3QU>" -H "Content-Type: application/json" -H "x-fireeye-api-key:<APIKEY>"

Downstream message ID response

{
  "data": [
    {
      "attributes": {
        "acceptedDateTime": "2019-08-07T10:54:54.000",
        "countryCode": "us",
        "domain": "test1.ad.etp-testdomain5.com",
        "downStreamMsgID": "250 2.0.0 Ok: queued as F00EBE600",
        "emailSize": 0.52,
        "lastModifiedDateTime": "2019-08-07T11:05:15.774",
        "originalMessageID": "\u003c20190807162453.092921@JDEORE-MBP\u003e",
        "recipientHeader": [
          "avishek@test1.ad.etp-testdomain5.com"
        ],
        "recipientSMTP": [
          "avishek@test1.ad.etp-testdomain5.com"
        ],
        "senderHeader": "avishek@fireeyeqa.com",
        "senderSMTP": "avishek@fireeyeqa.com",
        "senderIP": "199.16.196.4",
        "status": "delivered",
        "subject": "clean-green -85",
        "verdicts": {
          "AS": "pass",
          "AV": "pass",
          "AT": "pass",
          "PV": "pass",
          "YARA": "pass",
          "ActionYARA": "no match"
        }
      },
      "included": [
        {
          "type": "domain",
          "attributes": {
            "name": "test1.ad.etp-testdomain5.com"
          }
        }
      ],
      "id": "6D1004243EFDAA4D55b90d4f3",
      "type": "trace"
    }
  ],
  "meta": {
    "total": 1,
    "size": 1,
    "copyright": "Copyright 2019 Fireeye Inc"
  }
}

cURL code example: downstream message ID

curl -X GET -H "Content-Type: application/json" -H "x-fireeye-api-key: xxxxxxxxxxxxxxxx" https://etp.us.fireeye.com/api/v1/messages?downstream_message_id=F00EBE600&size=5

This cURL sample includes the following options:

-X GET—This option changes the HTTP method to GET.
-H "Content-Type: application/json"—This header specifies that the server's response body is expected to be in JSON format.
-H 'x-fireeye-api-key: xxxxxxxxxxxxxxx'—This header specifies your personal API key.
https://etp.us.fireeye.com/v1/messages?downstream_message_id=F00EBE600&size=5—The message request URL. Replace etp.us.fireeye.com with the address of your Email Security — Cloud instance, and F00EBE600with your downstream message ID.