API reference

Signal catalogue, for building the rule form

Body: CreateAlertRuleDto

Body: UpdateAlertRuleDto

Every alert this tenant has fired, newest first

Unread (or all recent) alert events for this tenant

Body: LegalHoldQueryDto

Body: LegalHoldQueryDto

Body: LegalHoldDto

Events removed by retention, and the file each was written to

Download one audit archive

Every simulation campaign, with its result funnel

Body: CampaignDto

Body: CampaignDto

Freeze the audience and start sending

Who a given audience selection would reach

Body: AudienceDto

Body: TemplateDto

Assigned lessons and who has finished them, outstanding first

Assign a lesson to people and mail them the link

Body: AssignTrainingDto

Send an outstanding lesson link again

Per-person risk, worst first

How the risk bands have moved, replayed from the campaign events

Rate, billing profile, status and when the next invoice is raised

What the next invoice would be, and how the seat count was derived

What has been sent about unpaid invoices, and what happens if they stay unpaid

Who the invoice is addressed to. Rate and cycle are operator-set.

Body: UpdateProfileDto

Effective branding for this tenant

Body: TenantBrandingDto

Drop tenant overrides and fall back to platform branding

Upload a logo as a base64 data URL

Body: LogoUploadDto

Supported import types and the CSV columns each expects

Export one entity type as CSV, in the columns the importer reads

Mailbox passwords are exported empty: what is stored is a bcrypt hash, and a hash is not a password. Personal safe-sender entries are left out of the list export, because the importer would read them back as rules over the whole organisation.

Dry-run validation of a CSV import — nothing is written

Body: ImportCsvDto

Commit a CSV import — creates every valid row

Body: ImportCsvDto

Threat campaigns for this tenant, most recently active first

One campaign, its worst-hit recipients and what is still in a mailbox

Mark a campaign contained, closed, or open again

Body: CampaignStatusDto

The messages clustered into this campaign

Claw back every delivered copy in this campaign

Works through a batch of up to 100 messages and reports how many are left, so a large campaign is several presses rather than one request that times out halfway through.

Body: CampaignRemediateDto

Certificate authorities available to this tenant

Create an internal certificate authority

Body: CreateAuthorityDto

Stop an authority issuing without invalidating its certificates

The root certificate, for correspondents to trust

Certificates due for renewal

Store a correspondent's certificate, or a keypair from a public CA

Body: ImportCertificateDto

Issue an S/MIME certificate for a hosted address

Body: IssueCertificateDto

Body: RenewDto

Body: RevokeDto

Download as PKCS#12 for import into a mail client

Body: ExportDto

Generate a keypair for one of your own addresses

Body: GenerateKeyDto

Store a correspondent's public key, or your own keypair

Body: ImportKeyDto

Create or replace the rule for one correspondent

Body: UpsertPolicyDto

What would apply to one recipient, and which rule decided it

Set or replace the passphrase for one correspondent

Body: UpsertSecretDto

Show a passphrase so it can be passed on out of band

Messages delivered as encrypted PDFs, and whether they were opened

Whether connector hardening is offered for this tenant, and where each domain stands

Compose the Exchange script

Changes nothing in the customer’s tenant. Returns what the script will create, the script, and the command that produces the output this install accepts as proof.

Body: PlanDto

Record enforcement from Exchange’s own connector output

A domain reaches gateway_enforced only through here. Anything the output does not prove is recorded as unconfirmed, with the reason.

Body: ReadBackDto

Put a domain back to MX-only without pasting output

Continuity outage status for the tenant

Emergency inbox: messages held while MX is down

Retry delivery for one held recipient now

Drain this tenant's continuity spool immediately

Inbound/outbound traffic strip for Message Trace (last N hours)

SMTP accept / last relay failure pulse for Message Trace

SSE stream of traffic + pipeline pulses (replaces 30s polling)

Search the message trace by sender, recipient, subject or message-id

Stream every message matching the filters as CSV, not just the current page

Egress delivery attempts for one message (tenant-scoped)

Re-enqueue delivery for bounced/deferred/parked recipients

SMTP connection-level rejections for this tenant

Body: DlpRuleDto

Body: DlpRulePatchDto

Try a rule (saved or draft) against a sample of text; omit the rule fields to test everything currently enabled

Body: TestSampleDto

Aligned and failing message volume per day, with a compliance percent

Successful and failed TLS sessions per day, from RFC 8460 reports

Why TLS sessions failed, by result type and by host pair

RFC 5965 feedback-loop reports, by type, with the recent ones

Everyone sending as this domain, with alignment and a classification

Where this domain is between monitoring and enforcement

Set the DMARC policy this domain is working towards

Body: SetDmarcTargetDto

Body: IngestDmarcDto

Upload a raw DMARC aggregate report (XML, .xml.gz or .zip)

Body: UploadReportDto

Upload a raw RFC 8460 TLS report (JSON, .json.gz or .zip)

Body: UploadReportDto

Body: CreateDomainDto

Body: IntegrationDto

Body: DeliveryModeDto

Body: InboundModeDto

Body: DnsDelegationDto

Body: InboundRelayForwardDto

Body: SetRelayAccountsDto

Body: TestRelayDto

Body: InspectPanelDto

Body: ConnectPanelDto

Body: UpdatePanelDto

Body: PanelRunDto

Body: CreateCaseDto

Body: CaseItemsDto

Body: CaseQueryDto

Body: StartExportDto

Quarantine overturn rate, per-policy hits and per-engine accuracy

List generated evidence packs

Generate an evidence pack for a period

Body: BuildPackDto

Download one evidence pack

Delete an evidence pack

Mail platform connections for this tenant

Begin admin consent, returning the URL to send an administrator to

Body: ConnectProviderDto

Upload a domain-wide-delegated service-account key for Google Workspace clawback

Call the provider and record whether the grant still works

Forget the stored authorisation for this provider

Journal endpoints for this tenant

Create a journal endpoint

Returns the full URL, including the token, exactly once. It is stored as a SHA-256 and cannot be shown again.

Body: CreateEndpointDto

Stop or resume accepting reports on this endpoint

Body: SetEnabledDto

Delete a journal endpoint and the token that reaches it

Body: UpdateSettingsDto

Never rewrite, or always refuse, links to a host

Body: AddEntryDto

What Link Guard would make of one address

Body: CheckUrlDto

Links rewritten in one message

Body: AddListDto

List the caller's own safe/blocked senders

Body: AddListDto

The mailbox this session will act on, or null

Folder tree with message and unread counts

One page of a folder, newest first

Move to Trash, or expunge when already there

Body: MailDeleteDto

One message, body sanitised for the reading pane

Download one MIME part

The original .eml

Fetch a remote image on the reader’s behalf

Set or clear flags on a selection

Body: MailFlagsDto

Move a selection to another folder

Body: MailMoveDto

Submit a message through the install’s own listener

Body: ComposeDto

Save a draft, replacing the previous revision

Body: ComposeDto

SSE stream of folder counts, so new mail appears

Body: CreateMailboxDto

Committed quota and usage per domain

Body: CreateAliasDto

Body: UpdateMailboxDto

Hostnames and ports for setting up a mail client

Body: RuleSetDto

Body: ShareDto

The IMAP folders a mailbox actually has

The ACL as the mail store currently holds it

Create one; the password is returned once and never again

Body: CreateAppPasswordDto

List throttled/suspended (or all) outbound senders for this tenant

Sending habits per outbound sender — volume, correspondents, and hours

One sender: hour histogram, known correspondents, recent additions

Clear a throttled/suspended sender and restore normal outbound sending

Body: SimulateDto

Body: CreatePolicyDto

Body: AddRuleDto

Body: ReorderRulesDto

Body: UpdateRuleDto

Body: UpdatePolicyDto

Body: ScopePolicyDto

List held messages visible to the caller

Daily quarantine inflow vs release counts, for the dashboard trend panel