Log Search

Use log search to query filtering and delivery activity directly from the logging data.

• Incoming filter: GET /api-v1/log/delivery/
• Outgoing filter: GET /api-v1/log/submission/

Use a token with Audit Logs read permission for the relevant filter direction.
Both endpoints require q with a fields list.
Only records accessible to your token are returned.

Example: quarantined mail in a time window

This example returns quarantined messages between 09:00 and 10:00 UTC on 15 January 2026.
Replace the datetime literals with the period you want to search.

curl -sS --get \
  -H "HTTP-X-AUTH-TOKEN: $API_TOKEN" \
  --data-urlencode 'q={"filters":[{"name":"status","op":"in","val":["quarantined"]},{"name":"datetime","op":">=","val":"2026-01-15 09:00:00"},{"name":"datetime","op":"<","val":"2026-01-15 10:00:00"}],"fields":[{"field":"domain"},{"field":"datetime"},{"field":"message_id"},{"field":"status"}],"order_by":[{"field":"datetime","direction":"desc"}]}' \
  "$BASE_URL/api-v1/log/delivery/"

To run the same query for outgoing traffic, use /api-v1/log/submission/.
The fields selected above are available on both endpoints.
Submission logs also expose outgoing-specific fields such as identity, username, and secure_email_status.

Use page and page_size query parameters to paginate. Pages start at 1, and page_size must be between 1 and 1000.

The query descriptions also accept relative datetime values such as 2 days ago.
The example uses literals because the OpenAPI validation patterns only describe literal dates and datetimes.