1. Email
Anzenna Public API
  • How To Use the Anzenna Public API
  • AI Governance
    • Query all Shadow AI instances
      POST
    • Get a Shadow AI instance by id
      GET
    • Query all AI interactions
      POST
    • Get an AI interaction by id
      GET
    • List MCP servers
      POST
    • Get an MCP server
      GET
    • Query MCP server installations
      POST
  • Investigation
    • Query all investigations
      POST
    • Start an investigation
      POST
    • Get an investigation by id
      GET
    • Dismiss an investigation
      POST
    • Get detection investigation prompts
      GET
    • Get global investigation prompts
      GET
    • Get user investigation prompts
      GET
    • Query all risk registers
      POST
    • Query all risk register catalog entries
      POST
  • Identity
    • List accounts
      POST
    • Get an account by id
      GET
    • List login events
      POST
    • Get a login event by ID
      GET
    • Query all mfa statuses
      POST
    • Get an MFA status by id
      GET
    • Query all OAuth applications
      POST
    • Get an OAuth application by id
      GET
    • Query all OAuth application instances
      POST
    • Query all password reuse instances
      POST
  • Advanced
    • Execute an advanced query
    • List security events
    • Receive a webhook event
    • Query raw events
  • Detection
    • Query all allowlists
    • Create a new allowlist
    • Delete an allowlist
    • Update an allowlist
    • Get an anomaly by ID
    • Get key finding detections
    • Get detection details
    • List users associated with a given detection
    • Execute a remediation
  • Browser
    • Query all browser applications
    • Get a browser application by id
    • List browser application instances
    • List browser history entries
    • Query all remote machines
    • Get a remote machine by id
    • Query all web host resources
    • Get a web host resource by id
  • Data & IP
    • Query database exfiltration events
    • List file delete events
    • List file movement activities
    • Get file movement activity by id
    • List files used with data exfiltration.
    • Get a specific data exfiltration file
    • List git events
    • Get a specific git event by id
    • List git repositories
    • Get a specific git repository
    • List file sharing instances
    • Query database share grants
    • Query database share user additions
    • List documents
    • Get document by id
    • List DLP policies
    • Get a DLP policy by id
    • List DLP policy detectors
    • Query all DLP alerts
    • Get a DLP alert by id
  • Device
    • List devices
    • Get a device
    • List device applications
    • Get a device application
    • Query device application instances.
    • List device infections
    • Get a device infection
    • List device policies
    • Get a device policy
    • List USB device connection events
    • Get a USB connection event
    • List IDE applications
    • Get an IDE application
    • Query IDE application instances.
  • Email
    • Query all outbound email events
      POST
    • Get an outbound email event by id
      GET
    • Query all phishing interactions
      POST
  • Company
    • List groups
    • Query all people
    • Get departure analysis for a person
    • Get a person by id
    • Add a category to multiple people
    • Remove a category from multiple people
    • Get company risk trends
    • Get number of high risk organizations
  • SaaS
    • Query all Shadow IT instances
  • Outreach
    • List training campaigns
    • Create a training campaign
  • API Key
    • Get API key information
  1. Email

Query all outbound email events

POST
/email-flows
Query and filter outbound email events
Relations:
sender (Person): The person who sent the email

Request

Authorization
Bearer Token
Provide your bearer token in the
Authorization
header when making requests to protected resources.
Example:
Authorization: Bearer ********************
or
Body Params application/jsonRequired

Examples

Responses

🟢200OK
application/json
Successful operation
Bodyapplication/json

🟠400Bad Request
🟠401Unauthorized
🟠403Forbidden
Request Request Example
Shell
JavaScript
Java
Swift
curl --location '/email-flows' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
    "distinct_count": "string",
    "distinct_on": "host_name",
    "include_total_count": true,
    "limit": 10,
    "offset": 0,
    "query": "name='\''WINPC-4291'\'' AND status IN ('\''active'\'', '\''pending'\'')",
    "sort": "name desc, id"
}'
Response Response Example
200 - Example 1
{
    "distinct_values": [
        {
            "count": 0,
            "value": null
        }
    ],
    "pagination": {
        "count": 0,
        "total_count": 1000
    },
    "items": [
        {
            "attachments": [
                {
                    "extension": "xlsx",
                    "kind": "unspecified",
                    "name": "Q4-Report.xlsx"
                }
            ],
            "destination_domain": "example.com",
            "destination_email": "jane.doe@example.com",
            "destination_kind": "to",
            "direction": "external_destination",
            "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
            "message_id": "<abc123@mail.company.com>",
            "revocation_status": "revoked",
            "sender_email": "john.smith@company.com",
            "sender_name": "John Smith",
            "source": "unspecified",
            "subject": "Q4 Financial Report",
            "timestamp": "2021-01-01T00:00:00Z",
            "total_attachments_size": 348160
        }
    ]
}
Modified at 2026-10-20 18:32:30
Previous
Query IDE application instances.
Next
Get an outbound email event by id
Built with