Original message ID request

Retrieves the trace document for messages tagged with Original Message ID (added by the sender). The response mentions both original message ID and Email Security — Cloud message ID for each retrieved trace document.

GET https://<etp_instance_addr>/api/v1/messages?original_message_id=<original_message_id>&size=<size>

GET https://<etp_instance_addr>/api/v1/messages?original_message_id=<original_message_id>&size=<size>&traffic_type=outbound

Required header:

x-fireeye-api-key: <key>—Specifies your personal API key.

Options

Use one of the following message ID options (required):

original_message_id=<original_message_id>—(string) The message ID (the Orig-Message-ID header, if present) logged when an email comes into the Email Security — Cloud stack. If there are special characters, such as +, #, whitespace, and so on in the original_message_id, then use the --data-urlencode option in the curl command. See the example below.
size=<number>—(integer) Number of messages to return (default; 20). Optional.
traffic_type—(inbound or outbound) Traffic type defaults to inbound. To handle outbound traffic, set the traffic_type parameter to outbound.

Example request:

Values for ID and other fields are for illustration purposes only.

GET https://etp.us.fireeye.com/api/v1/messages?original_message_id="<20181022111816.008377@90-F217G3QP-3AG>"

Example requests with special characters in the original_message_id:

GET https://etp.us.fireeye.com/api/v1/messages/ --data-urlencode "original_message_id=<2019012214#2057041555@90-F21KG3QP-3QU>"
GET'https://etp.us.fireeye.com/api/v1/messages?traffic_type=outbound' --data-urlencode "original_message_id=<20210105143240.006986@20L-F0STJGM-3E1>"

Original message ID response

{
  "data": [
    {
      "attributes": {
        "acceptedDateTime": "2018-10-22T05:48:21.000Z",
        "countryCode": "US",
        "domain": "musubi2.etp-testdomain5.com",
        "downStreamMsgID": "250 2.0.0 Ok: queued as 4507A5836",
        "emailSize": 3.72,
        "lastModifiedDateTime": "2018-10-22T05:48:23.315Z",
        "originalMessageID": "\u003c20181022111816.008377@90-F217G3QP-3AG\u003e",
        "recipientHeader": [
          "userc@musubi2.etp-testdomain5.com"
        ],
        "recipientSMTP": [
          "userc@musubi2.etp-testdomain5.com"
        ],
        "senderHeader": "swayam@outbound.swayam.etp-testdomain5.com",
        "senderSMTP": "swayam@outbound.swayam.etp-testdomain5.com",
        "senderIP": "209.135.212.148",
        "status": "delivered",
        "subject": "Rate Limit 16",
        "verdicts": {
          "AS": "pass",
          "AV": "pass",
          "AT": "pass",
          "PV": "pass"
        }
      },
      "included": [
        {
          "type": "domain",
          "id": 1111152,
          "attributes": {
            "name": "musubi2.etp-testdomain5.com"
          }
        }
      ],
      "id": "84CF557625A46DCB5ed800712",
      "type": "trace"
    }
  ],
  "meta": {
    "total": 1,
    "copyright": "Copyright 2018 Fireeye Inc",
    "fromLastModifiedOn": {
      "start": "2018-10-22T05:48:23.315Z",
      "end": "2018-10-22T05:48:23.315Z"
    }
  }
}

cURL code example: original message ID

curl -X GET -H "Content-Type: application/json" -H "x-fireeye-api-key: xxxxxxxxxxxxxxxx" https://etp.us.fireeye.com/api/v1/messages?original_ message_id=F00EBE600&size=5

This cURL sample includes the following options:

-X GET—This option changes the HTTP method to GET.
-H "Content-Type: application/json"—This header specifies that the server's response body is expected to be in JSON format.
-H 'x-fireeye-api-key: xxxxxxxxxxxxxxx'—This header specifies your personal API key.
https://etp.us.fireeye.com/v1/messages?original_message_id=250&size=5—The message request URL. Replace etp.us.fireeye.com with the address of your Email Security — Cloud instance, and 250with your original message ID.