Mimecast Security

Mimecast Security provides advanced cloud-based email protection, archiving, and threat intelligence to safeguard organizations from email-borne risks.

Mimecast Security is a leading cloud-based email security platform that protects organizations from advanced threats, data leaks, and compliance risks. This connector enables Swimlane Turbine users to automate a wide range of email security operations, including threat detection, incident response, message and attachment management, policy enforcement, and directory administration. By integrating Mimecast Security with Swimlane Turbine, security teams can streamline threat investigation, accelerate remediation, and enforce security policies at scale—without writing code. This integration empowers organizations to respond faster to email-borne threats, reduce manual workload, and maintain robust email security posture through automated workflows.

Limitations

None to date.

Supported Versions

This Mimecast Security connector uses the Mimecast API 2.0.

Additional Documents

Documentation Mimecast

Mimecast API Documentation

Building Search Queries

Mimecast Base URLs

Configuration

Prerequisites

To use the Mimecast Security connector, you must have the following prerequisites in place:

OAuth 2.0 Client Credentials authentication, which requires:

URL: The base endpoint for your Mimecast API instance.

Client ID: The unique identifier for your registered Mimecast application.

Client Secret: The secret key associated with your Mimecast application for secure authentication.

HMAC authentication, which requires:

URL: The base endpoint for your Mimecast API instance.

Access Key: The public key used to identify your Mimecast account.

App ID: The identifier for your specific Mimecast application integration.

App Key: The application-specific key for authenticating API requests.

Secret Key: The private key used to sign and secure your API requests.

Authentication Methods

URL: The endpoint URL for accessing Mimecast's API.

Access Key: A unique key provided by Mimecast for API access.

App ID: The application identifier for your Mimecast integration.

App Key: A key associated with your application ID for secure access.

Secret Key: A secret key used for generating HMAC signatures.

To set Access/Secrets to never expire, update the authentication cache TTL setting in the service user's effective authentication profile to "Never Expire."

URL: The endpoint URL for accessing Mimecast's OAuth2 service.

Client ID: The client identifier for your OAuth2 application.

Client Secret: A secret associated with your client ID for secure access.

Capabilities

This Mimecast Security connector provides the following capabilities:

Add Group Member

Archive Search

Create Block Sender Policy

Create Managed URL

Create Remediation Incident

Decode URL

Find Incidents

Get Account

Get Archived File Attachment

Get Archived Message Details

Get Archived Message Part

Get Archived Messages List

Get Archived Search Logs

Get File

Get Group Members ... and so on

Add Group Member

Add a new member to a specified group in Mimecast Security Click Here.

Archive Search

Conduct a search in Mimecast Security's archive using specified criteria Click Here.

Create Block Sender Policy

Create new blocked sender policies in Mimecast Security Click Here.

Create Managed URL

Add a specified URL to Mimecast's managed list for Targeted Threat Protection Click Here.

Create Remediation Incident

Initiate a new remediation incident in Mimecast Security Click Here.

Decode URL

Decode Mimecast Threat Protection URLs to their original form Click Here.

Find Incidents

Locate existing remediation incidents in Mimecast Security Click Here.

Get Account

Retrieve account details from Mimecast Security Click Here.

Get Archived File Attachment

Retrieve a file attachment from an archived message in Mimecast Security Click Here.

Get Archived Message Details

Retrieve detailed information about a specific archived message Click Here.

Get Archived Message Part

Retrieve a specific part of an archived message from Mimecast Security Click Here.

Get Archived Messages List

Retrieve a list of archived messages for a specified user Click Here.

Get Archived Search Logs

Retrieve archived search logs from Mimecast Security Click Here.

Get File

Download an email attachment from Mimecast's message queue Click Here.

Get Group Members

Retrieve a list of members for a specified group in Mimecast Security Click Here.

Get Groups

Retrieve matching groups from Mimecast using query parameters Click Here.

Get Held Messages List

Retrieve details of messages on hold in Mimecast Security Click Here.

Get Hold Summary List

Retrieve a summary of messages currently on hold, grouped by the policy or definition that held them Click Here.

This action does not take a request body. data and fail are returned in the response.

Get Inbound and Outbound Message Queue Hold List

Retrieve inbound and outbound email queue messages from Mimecast Security Click Here.

Get Managed URLs

Retrieve all managed URLs or domains from Mimecast Security Click Here.

Get Message Details

Retrieve detailed information about a specific message from the Mimecast gateway Click Here.

Get Message Info

Retrieve detailed information about a specific message using Message Finder Click Here.

Get Remediation Incident

Retrieve detailed information about a specific remediation incident Click Here.

Get TTP Attachment Logs

Retrieve Targeted Threat Protection attachment logs from Mimecast Security Click Here.

Get TTP Impersonation Protect Logs

Retrieve logs of impersonation attempts from Mimecast Security Click Here.

Get TTP URL Logs

Fetch log data for URLs processed by Mimecast's Targeted Threat Protection Click Here.

Message Finder Search

Search for messages in Mimecast Security using specified criteria Click Here.

Permit Or Block Sender

Permit or block a specified sender in Mimecast Security Click Here.

Policy Update

Update an existing Address Alteration Policy in Mimecast Security Click Here.

You must define the input required for your use case. If no policy input is defined, the action fails.

Reject Message from Queue

Reject a specific message from the Mimecast held queue Click Here.

Release Message from Queue

Release a specific message from Mimecast's hold queue Click Here.

Remove Group Member

Remove specified members from a Mimecast Security group Click Here.

Configurations

Mimecast HMAC

Authenticates using HMAC

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
access_key	Access Key	string	Required
app_id	App ID	string	Required
app_key	App Key	string	Required
secret_key	Secret Key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Mimecast Oauth 2.0 Client Credentials

Authenticates using oauth 2.0 client credentials

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
client_id	The client ID	string	Required
client_secret	The client secret.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Archived File Attachment

Retrieve a file attachment from an archived message in Mimecast Security using specified data parameters.

Endpoint

URL: /api/archive/get-file

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.id	string	Optional	Response data

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.status	number	Status value
data	array	Response data
data.urls	array	Response data
fail	array	Output field: fail
fail.file_name	string	Name of the resource
fail.file	string	Output field: fail.file

Output Example

{"status_code":200,"response_headers":{"date":"Tue, 16 Sep 2025 05:37:26 GMT","content-type":"application/json","cache-control":"no-store","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"793b7425-5352-48ef-9b2c-eb9a5e4aed6a","via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000","Transfer-Encoding":"chunked"},"reason":"OK","json_body":{"meta":{"status":200},"data":[{}],"fai...

Get Archived Message Details

Retrieve detailed information about a specific archived message in Mimecast Security using provided data parameters.

Endpoint

URL: /api/archive/get-message-detail

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.id	string	Required	Response data

Input Example

{"json_body":{"data":[{"id":"eNpVzlkLgkAUBeD_Mq8FZe5BD5HUGBXtKQSh4y23RnS8Ywv99-yx5-8cznkTAQwrSCIyJHNKp8FpgWFHlQ-WF1mG-8ku3SyMl9NoYmakDeyD63F78AdeGPh0uzE9JgB34TrT6ErWcSbRVpPxuac7TyEFpzoPPf-QMN1tbi-r4csabWfN3BHpkjiPyt-wZtuGYpnmwOiS-s5_V1DUUN21NiShEknByVBpkUfQYr-vtFAiIFz--58vo3BC9A"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.attachments	array	Response data
data.attachments.bodyType	number	Response data
data.attachments.contentId	string	Response data
data.attachments.contentType	string	Response data
data.attachments.extension	string	Response data
data.attachments.filename	string	Response data
data.attachments.id	string	Response data
data.attachments.sha256	string	Response data
data.attachments.size	number	Response data
data.attachments.verdict	string	Response data
data.cc	array	Response data
data.cc.displayableName	string	Response data
data.cc.emailAddress	string	Response data
data.envelopeFrom	object	Response data
data.envelopeFrom.displayableName	string	Response data
data.envelopeFrom.emailAddress	string	Response data
data.hasHtmlBody	boolean	Response data
data.hasTextBody	boolean	Response data
data.headerDate	string	Response data
data.headers	array	Response data
data.headers.name	string	Response data
data.id	object	Response data

Output Example

{"status_code":200,"response_headers":{"date":"Tue, 10 Jun 2025 10:09:08 GMT","content-type":"application/json","cache-control":"no-store","pragma":"no-cache","x-robots-tag":"noindex, nofollow","content-encoding":"gzip","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"48b4c8e7-6150-45a4-bd51-a86d8d0372d0","via":"1.1 google","transfer-encoding":"chunked"},"reason":"OK","json_body":{"data":[{}],"fail":[...

Get Archived Messages List

Retrieve a list of archived messages for a specified user in Mimecast Security using the provided data payload.

Endpoint

URL: /api/archive/get-message-list

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.end	string	Optional	Response data
data.includeAliases	boolean	Optional	Response data
data.includeDelegates	boolean	Optional	Response data
data.mailbox	string	Optional	Response data
data.start	string	Optional	Response data
data.view	string	Required	Response data

Input Example

{"json_body":{"data":[{"end":"2022-10-13T16:57:02+0000","includeAliases":true,"includeDelegates":true,"mailbox":"[email protected]","start":"2022-10-13T16:57:02+0000","view":"INBOX"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.attachmentCount	number	Response data
data.ccm	boolean	Response data
data.expired	boolean	Response data
data.from	object	Response data
data.from.displayableName	string	Response data
data.from.emailAddress	string	Response data
data.id	object	Response data
data.read	boolean	Response data
data.recalled	boolean	Response data
data.received	string	Response data
data.size	number	Response data
data.smash	string	Response data
data.status	string	Response data
data.subject	string	Response data
data.to	object	Response data
data.to.displayableName	string	Response data
data.to.emailAddress	string	Response data
fail	array	Output field: fail
fail.file_name	string	Name of the resource
fail.file	string	Output field: fail.file

Output Example

Get Archived Message Part

Retrieve a specific part of an archived message from Mimecast Security using the provided data parameters.

Endpoint

URL: /api/archive/get-message-part

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.context	string	Optional	Response data
data.id	string	Optional	Response data
data.type	string	Optional	Response data
data.extractFromHtml	boolean	Optional	Response data
data.mailbox	string	Optional	Response data
data.stripDangerous	boolean	Optional	Response data
data.stripImg	boolean	Optional	Response data
data.stripStyles	boolean	Optional	Response data
data.transposeInlineCID	boolean	Optional	Response data

Input Example

{"json_body":{"data":[{"context":"DELIVERED","id":"eNpVzlkLgkAUBeD_Mq8FZe5BD5HUGBXtKQSh4y23RnS8Ywv99-yx5-8cznkTAQwrSCIyJHNKp8FpgWFHlQ-WF1mG-8ku3SyMl9NoYmakDeyD63F78AdeGPh0uzE9JgB34TrT6ErWcSbRVpPxuac7TyEFpzoPPf-QMN1tbi-r4csabWfN3BHpkjiPyt-wZtuGYpnmwOiS-s5_V1DUUN21NiShEknByVBpkUfQYr-vtFAiIFz--58vo3BC9A","type":"RFC822","extractFromHtml":true,"mailbox":"[email protected]","stripDangerous":true,"stripImg":true,"stripStyles":true,"transposeInlineCID":true}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.status	number	Status value
data	array	Response data
data.urls	array	Response data
fail	array	Output field: fail
fail.errors	array	Error message if any
fail.errors.code	string	Error message if any
fail.errors.message	string	Response message
fail.errors.retryable	boolean	Error message if any

Output Example

Get Archived Search Logs

Retrieve archived search logs from Mimecast Security using specified JSON body parameters to access detailed log information for auditing or analysis.

Endpoint

URL: /api/archive/get-search-logs

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.end	string	Optional	Response data
data.query	string	Optional	Response data
data.start	string	Optional	Response data

Input Example

{"json_body":{"data":[{"end":"2022-10-24T20:51:21+0000","query":"<?xml version=\"1.0\"?> <xmlquery trace=\"iql,muse\"> <metadata query-type=\"emailarchive\" archive=\"true\" active=\"false\" page-size=\"25\" startrow=\"0\"> <mailboxes> <mailbox include-aliases=\"true\">[email protected]</mailbox> </mailboxes> <smartfolders/> <return-fields> <return-field>attachmentcount</return-field> <return-field>status</return-field> <return-field>subject</return-field> <return-field>size</return-field> <return-field>receiveddate</return-field> <return-field>displayfrom</return-field> <return-field>displayfromaddress</return-field> <return-field>id</return-field> <return-field>displayto</return-field> <return-field>displaytoaddresslist</return-field> <return-field>smash</return-field> </return-fields> </metadata> <muse> <text></text> <date select=\"last_year\"/> <sent></sent> <docs select=\"optional\"> </docs> <route/> </muse> </xmlquery>","start":"2022-10-23T20:51:21+0000"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.status	number	Status value
meta.pagination	object	Output field: meta.pagination
meta.pagination.pageSize	number	Output field: meta.pagination.pageSize
meta.pagination.totalCount	number	Count value
data	array	Response data
data.logs	array	Response data
data.logs.createTime	string	Response data
data.logs.emailAddr	string	Response data
data.logs.source	string	Response data
data.logs.searchText	string	Response data
data.logs.searchPath	string	Response data
data.logs.searchReason	string	Response data
data.logs.isAdmin	boolean	Response data
data.logs.museQuery	string	Response data
data.logs.description	string	Response data
fail	array	Output field: fail
fail.file_name	string	Name of the resource
fail.file	string	Output field: fail.file

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 24 Oct 2022 21:18:56 GMT","Content-Type":"application/json","Content-Length":"3360","Connection":"keep-alive","Cache-control":"no-store","Pragma":"no-cache","X-Robots-Tag":"noindex, nofollow","X-RateLimit-Limit":"800","X-RateLimit-Remaining":"799","X-RateLimit-Reset":"5000"},"reason":"OK","json_body":{"meta":{"status":200,"pagination":{}},"data":[{}],"fail":[]}}

Archive Search

Conduct a comprehensive search in Mimecast Security's archive using specified data parameters and retrieve matching archived items.

Endpoint

URL: /api/archive/search

Method: POST

Input

Argument Name	Type	Required	Description
meta	object	Optional	Parameter for Archive Search
meta.pagination	object	Optional	Parameter for Archive Search
meta.pagination.pageToken	string	Optional	Parameter for Archive Search
data	array	Optional	Response data
data.admin	boolean	Required	Response data
data.query	string	Required	Response data

Input Example

{"json_body":{"meta":{"pagination":{"pageToken":"pageToken"}},"data":[{"admin":false,"query":"<?xml version=\"1.0\"?> <xmlquery trace=\"iql,muse\"> <metadata query-type=\"emailarchive\" archive=\"true\" active=\"false\" page-size=\"100\" startrow=\"0\"> <muse> <text>Subject:subject</text> <date select=\"last_year\"/> <sent></sent> <docs select=\"optional\"> </docs> <route/> </muse> </xmlquery>"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.queryDuration	number	Response data
fail	array	Output field: fail
fail.errors	array	Error message if any
fail.errors.code	string	Error message if any
fail.errors.message	string	Response message
fail.errors.retryable	boolean	Error message if any
fail.key	object	Output field: fail.key
fail.key.query	string	Output field: fail.key.query
fail.key.admin	boolean	Output field: fail.key.admin

Output Example

Add Group Member

Add a new member to a specified group in Mimecast Security by submitting the required details in the JSON body.

Endpoint

URL: /api/directory/add-group-member

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.domain	string	Optional	Response data
data.notes	string	Optional	Response data
data.emailAddress	string	Optional	Response data
data.id	string	Required	Response data

Input Example

{"json_body":{"data":[{"domain":"www.test1.com","emailAddress":"[email protected]","id":"eNoVzk0LgjAYAOD_8l4TYtVKhQ6mkNGnlaXQRedrLc2Fc5OK_nt2fw7PByQyVSPPwAbungVziOmyXuEPgmW-1bPydQ9W47fXjuR8fG_xmOSnfRgPojSJ_X0wiZhEdUh3xcjf6OZWaGUNuXPpU-8ltax8WqVRHHJGF-31bbbVulGWt2OLKRhQZskT7DwpJRrAlGzEA2smMuwubnhwyMSh1OygxlpyUYFNDMhFmWH9_w4tSgj5_gA76UBc"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.emailAddress	string	Response data
data.folderId	string	Response data
data.id	string	Response data
data.internal	boolean	Response data
data.notes	string	Response data
fail	array	Output field: fail
fail.errors	array	Error message if any
fail.errors.code	string	Error message if any
fail.errors.message	string	Response message
fail.errors.retryable	boolean	Error message if any
fail.key	object	Output field: fail.key
fail.key.domain	string	Output field: fail.key.domain
fail.key.emailAddress	string	Output field: fail.key.emailAddress
fail.key.id	string	Unique identifier
fail.key.notes	string	Output field: fail.key.notes

Output Example

Get Groups

Retrieve directory groups from Mimecast Security that match the specified query parameters provided in the JSON body data.

Endpoint

URL: /api/directory/find-groups

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.query	string	Optional	Response data
data.source	string	Optional	Response data

Input Example

{"json_body":{"data":[{"query":"query string","source":"source string"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.folders	array	Response data
data.folders.description	string	Response data
data.folders.folderCount	number	Response data
data.folders.id	string	Response data
data.folders.parentId	string	Response data
data.folders.source	string	Response data
data.query	string	Response data
data.source	string	Response data
fail	array	Output field: fail
fail.errors	array	Error message if any
fail.errors.code	string	Error message if any
fail.errors.message	string	Response message
fail.errors.retryable	boolean	Error message if any
fail.key	object	Output field: fail.key
fail.key.query	string	Output field: fail.key.query
fail.key.source	string	Output field: fail.key.source

Output Example

Get Group Members

Retrieve a list of members for a specified group in Mimecast Security using the provided JSON body details.

Endpoint

URL: /api/directory/get-group-members

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.id	string	Required	Response data

Input Example

{"json_body":{"data":[{"id":"eNoVzk0LgjAYAOD_8l4TYtVKhQ6mkNGnlaXQRedrLc2Fc5OK_nt2fw7PByQyVSPPwAbungVziOmyXuEPgmW-1bPydQ9W47fXjuR8fG_xmOSnfRgPojSJ_X0wiZhEdUh3xcjf6OZWaGUNuXPpU-8ltax8WqVRHHJGF-31bbbVulGWt2OLKRhQZskT7DwpJRrAlGzEA2smMuwubnhwyMSh1OygxlpyUYFNDMhFmWH9_w4tSgj5_gA76UBc"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.groupMembers	array	Response data
data.groupMembers.domain	string	Response data
data.groupMembers.emailAddress	string	Response data
data.groupMembers.internal	boolean	Response data
data.groupMembers.name	string	Response data
data.groupMembers.type	string	Response data
data.groupMembers.notes	string	Response data
fail	array	Output field: fail
fail.errors	array	Error message if any
fail.errors.code	string	Error message if any
fail.errors.message	string	Response message
fail.errors.retryable	boolean	Error message if any
fail.key	object	Output field: fail.key
fail.key.id	string	Unique identifier

Output Example

Remove Group Member

Remove specified members from a Mimecast Security group by providing the necessary configuration details in the JSON body.

Endpoint

URL: /api/directory/remove-group-member

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.domain	string	Optional	Response data
data.emailAddress	string	Optional	Response data
data.id	string	Required	Response data

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.status	number	Status value
data	array	Response data
data.id	string	Response data
data.folderId	string	Response data
data.emailAddress	string	Response data
data.internal	boolean	Response data
fail	array	Output field: fail
fail.file_name	string	Name of the resource
fail.file	string	Output field: fail.file

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 10 Oct 2022 16:06:53 GMT","Content-Type":"application/json","Content-Length":"606","Connection":"keep-alive","Cache-control":"no-store","Pragma":"no-cache","X-Robots-Tag":"noindex, nofollow","X-RateLimit-Limit":"800","X-RateLimit-Remaining":"799","X-RateLimit-Reset":"5000"},"reason":"OK","json_body":{"meta":{"status":200},"data":[{}],"fail":[]}}

Get Inbound and Outbound Message Queue Hold List

Retrieve inbound and outbound email queue messages from Mimecast Security using specified data parameters.

Endpoint

URL: /api/email/get-email-queues

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.start	string	Required	Response data
data.end	string	Required	Response data

Input Example

{"json_body":{"data":[{"start":"2015-11-16T14:49:18+0000","end":"2015-11-16T14:49:18+0000"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.inboundEmailQueue	array	Response data
data.inboundEmailQueue.count	number	Response data
data.inboundEmailQueue.date	string	Response data
data.outboundEmailQueue	array	Response data
data.outboundEmailQueue.count	number	Response data
data.outboundEmailQueue.date	string	Response data
fail	array	Output field: fail
fail.errors	array	Error message if any
fail.errors.code	string	Error message if any
fail.errors.message	string	Response message
fail.errors.retryable	boolean	Error message if any
fail.key	object	Output field: fail.key
fail.key.end	string	Output field: fail.key.end
fail.key.start	string	Output field: fail.key.start

Output Example

Get Held Messages List

Retrieve details of messages currently on hold in Mimecast Security using specified criteria provided in the data payload.

Endpoint

URL: /api/gateway/get-hold-message-list

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.admin	boolean	Optional	Response data
data.start	string	Optional	Response data
data.searchBy	object	Optional	Response data
data.searchBy.fieldName	string	Optional	Response data
data.searchBy.value	string	Optional	Response data
data.end	string	Optional	Response data

Input Example

{"json_body":{"data":[{"admin":true,"start":"2015-11-16T14:49:18+0000","searchBy":{"fieldName":"field name","value":"value"},"end":"2015-11-16T14:49:18+0000"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.dateReceived	string	Response data
data.from	object	Response data
data.from.displayableName	string	Response data
data.from.emailAddress	string	Response data
data.fromHeader	object	Response data
data.fromHeader.displayableName	string	Response data
data.fromHeader.emailAddress	string	Response data
data.hasAttachments	string	Response data
data.id	string	Response data
data.policyInfo	string	Response data
data.reason	string	Response data
data.reasonCode	string	Response data
data.route	string	Response data
data.size	number	Response data
data.subject	string	Response data
data.to	object	Response data
data.to.displayableName	string	Response data
data.to.emailAddress	string	Response data
fail	array	Output field: fail
fail.errors	array	Error message if any
fail.errors.code	string	Error message if any
fail.errors.message	string	Response message

Output Example

Get Hold Summary List

Retrieve a summary of messages currently on hold in Mimecast Security, grouped by the policy or definition responsible for holding them.

Endpoint

URL: /api/gateway/get-hold-summary-list

Method: POST

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
fail	array	Output field: fail
meta	object	Output field: meta
meta.status	number	Status value
data	array	Response data
data.policyInfo	string	The name of the policy or definition that held a message.
data.numberOfItems	number	The number of messages currently held for this reason.

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"fail":[],"meta":{"status":200},"data":[{}]}}

Get Message Details

Retrieve detailed information for a specific message in Mimecast Security using the provided data parameters.

Endpoint

URL: /api/gateway/message/get-message-detail

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.viewType	string	Optional	Response data
data.id	string	Required	Response data
data.context	string	Optional	Response data
data.mailbox	string	Optional	Response data

Input Example

{"json_body":{"data":[{"viewType":"archive","id":"mimecast_secure_id","context":"DELIVERED","mailbox":"[email protected]"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Reject Message from Queue

Reject a specific message from the Mimecast held queue by submitting the required data parameters in the request body.

Endpoint

URL: /api/gateway/hold-reject

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.message	string	Optional	Response data
data.ids	array	Required	Response data
data.reasonType	string	Optional	Response data
data.notify	boolean	Optional	Response data

Input Example

{"json_body":{"data":[{"message":"Rejection message to be returned to sender","ids":["eNpVzl0LgjAYBeD_smshzc1c0EUkpFKhlaEQhB9v-VGT3ObI6L9nl10_53DOG3HIZQdVgeZI1WJThucJX7Z-4A9Bo_uZbazqcGMNjsJ8bdUKjun1tI-SaZylibsPZ3HOQR6yoMHurhdl00tqVsvzhDgv3nPmEpbFSVTlxFO3wVZsKyR1gtxbIA2V9-L5W8aUEmwYhOoaEg_2-yK5gO6Bx1APHa9ahubGiKyAEXXdHOEpQcLlv__5AqaPQs0"],"reasonType":"MESSAGE CONTAINS UNDESIRABLE CONTENT","notify":false}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	string	Response data
data.reject	boolean	Response data
fail	array	Output field: fail
fail.errors	array	Error message if any
fail.errors.code	string	Error message if any
fail.errors.message	string	Response message
fail.errors.retryable	boolean	Error message if any
fail.key	object	Output field: fail.key
fail.key.ids	array	Unique identifier
fail.key.message	string	Response message
fail.key.notify	boolean	Output field: fail.key.notify
fail.key.reasonType	string	Type of the resource

Output Example

Release Message from Queue

Release a specific email message from the Mimecast hold queue by providing the required data parameters.

Endpoint

URL: /api/gateway/hold-release

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.id	string	Required	Response data

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	string	Response data
data.release	boolean	Response data
fail	array	Output field: fail
fail.file_name	string	Name of the resource
fail.file	string	Output field: fail.file

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 13 Oct 2022 20:07:50 GMT","Content-Type":"application/json","Content-Length":"317","Connection":"keep-alive","Cache-control":"no-store","Pragma":"no-cache","X-Robots-Tag":"noindex, nofollow","X-RateLimit-Limit":"800","X-RateLimit-Remaining":"799","X-RateLimit-Reset":"5000"},"reason":"OK","json_body":{"meta":{"status":200},"data":[{}],"fail":[]}}

Get Account

Retrieve detailed account information from Mimecast Security using specified JSON body input parameters.

Endpoint

URL: /api/account/get-account

Method: POST

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
fail	array	Output field: fail
fail.file_name	string	Name of the resource
fail.file	string	Output field: fail.file
meta	object	Output field: meta
meta.status	number	Status value
data	array	Response data
data.maxRetention	number	Response data
data.accountCode	string	Response data
data.domain	string	Response data
data.automatedSegmentPurge	boolean	Response data
data.databaseCode	string	Response data
data.supportCode	string	Response data
data.region	string	Response data
data.accountName	string	Response data
data.maxRetentionConfirmed	boolean	Response data
data.archive	boolean	Response data
data.gateway	boolean	Response data
data.policyInheritance	boolean	Response data
data.passphrase	string	Response data
data.type	string	Response data
data.mailPlatform	string	Response data
data.packages	array	Response data
data.mimecastId	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"fail":[],"meta":{"status":200},"data":[{}]}}

Get TTP Attachment Logs

Retrieve TTP attachment logs from Mimecast Security using a JSON body to analyze and monitor email security events.

Endpoint

URL: /api/ttp/attachment/get-logs

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.from	string	Optional	Start date of logs to return in the following format 2015-11-16T14:49:18+0000. Default is the start of the current day.
data.oldestFirst	boolean	Optional	Default false. Orders results with the most recent first.
data.result	string	Optional	Filters logs by scan result, must be one of safe, malicious, timeout, error, unsafe, or all.
data.route	string	Optional	Filters logs by route, must be one of inbound, outbound, internal, or all.
data.to	string	Optional	End date of logs to return in the following format 2015-11-16T14:49:18+0000.

Input Example

{"json_body":{"data":[{"from":"2016-10-01T14:49:18+0000","oldestFirst":false,"result":"unsafe","route":"all","to":"2017-10-13T23:59:59+0000"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
fail	array	Output field: fail
fail.file_name	string	Name of the resource
fail.file	string	Output field: fail.file
meta	object	Output field: meta
meta.status	number	Status value
meta.pagination	object	Output field: meta.pagination
meta.pagination.pageSize	number	Output field: meta.pagination.pageSize
meta.pagination.next	string	Output field: meta.pagination.next
data	array	Response data
data.attachmentLogs	array	Response data
data.attachmentLogs.result	string	Response data
data.attachmentLogs.date	string	Response data
data.attachmentLogs.senderAddress	string	Response data
data.attachmentLogs.fileName	string	Response data
data.attachmentLogs.actiontriggered	string	Response data
data.attachmentLogs.route	string	Response data
data.attachmentLogs.details	string	Response data
data.attachmentLogs.recipientAddress	string	Response data
data.attachmentLogs.fileType	string	Response data
data.attachmentLogs.fileHash	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"fail":[],"meta":{"status":200,"pagination":{}},"data":[{}]}}

Create Remediation Incident

Initiate a new remediation incident in Mimecast Security by submitting the necessary data parameters.

Endpoint

URL: /api/ttp/remediation/create

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.reason	string	Required	The reason for the remediation incident.
data.searchBy	string	Required	The field to search by.
data.hashOrMessageId	string	Optional	The hash or message ID to search by.
data.end	string	Optional	The end date and time of the remediation incident.
data.url	string	Optional	The URL to remediate.
data.start	string	Optional	The start date and time of the remediation incident.

Input Example

{"json_body":{"data":[{"reason":"Remediate by URL","searchBy":"hash","hashOrMessageId":["c6617708516e3"],"end":"2022-01-22T00:00:00+00:00","url":"https://www.domain.tld/path/to/unwanted/content","start":"2022-01-20T00:00:00+00:00"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	string	Response data
data.code	string	Response data
data.create	string	Response data
data.failed	number	Response data
data.fileRemediationCanBeCancelled	boolean	Response data
data.fileRemediationCancelled	string	Response data
data.fileRemediationExpiryTime	string	Response data
data.identified	number	Response data
data.modified	string	Response data
data.reason	string	Response data
data.remediatedBy	string	Response data
data.removeFromDevice	string	Response data
data.restored	number	Response data
data.searchCriteria	object	Response data
data.searchCriteria.end	string	Response data
data.searchCriteria.fileHash	string	Response data
data.searchCriteria.from	string	Response data
data.searchCriteria.messageId	string	Response data
data.searchCriteria.restoreCode	string	Response data
data.searchCriteria.start	string	Response data
data.searchCriteria.subject	string	Response data
data.searchCriteria.to	string	Response data

Output Example

Get Remediation Incident

Retrieve detailed information about a specific remediation incident in Mimecast Security using the provided data.

Endpoint

URL: /api/ttp/remediation/get-incident

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.id	string	Required	Response data

Input Example

{"json_body":{"data":[{"id":"incidentIDString"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	string	Response data
data.code	string	Response data
data.create	string	Response data
data.failed	number	Response data
data.identified	number	Response data
data.modified	string	Response data
data.reason	string	Response data
data.restored	number	Response data
data.searchCriteria	object	Response data
data.searchCriteria.end	string	Response data
data.searchCriteria.fileHash	string	Response data
data.searchCriteria.from	string	Response data
data.searchCriteria.messageId	string	Response data
data.searchCriteria.messageIds	array	Response data
data.searchCriteria.restoreCode	string	Response data
data.searchCriteria.start	string	Response data
data.searchCriteria.to	string	Response data
data.searchCriteria.unremediateCode	string	Response data
data.successful	number	Response data
data.type	string	Response data
fail	array	Output field: fail
fail.errors	array	Error message if any

Output Example

Find Incidents

Locate existing remediation incidents in Mimecast Security using optional search criteria provided in the JSON body.

Endpoint

URL: /api/ttp/remediation/find-incidents

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.start	string	Optional	Response data
data.searchBy	array	Optional	Response data
data.searchBy.fieldName	string	Optional	Response data
data.searchBy.value	string	Optional	Response data
data.end	string	Optional	Response data
data.filterBy	array	Optional	Response data
data.filterBy.fieldName	string	Optional	Response data
data.filterBy.value	string	Optional	Response data

Input Example

{"json_body":{"data":[{"start":"2015-11-16T14:49:18+0000","searchBy":[{"fieldName":"String","value":"String"}],"end":"2015-11-16T14:49:18+0000","filterBy":[{"fieldName":"String","value":"String"}]}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.incidents	array	Response data
data.incidents.id	string	Response data
data.incidents.code	string	Response data
data.incidents.create	string	Response data
data.incidents.failed	number	Response data
data.incidents.identified	number	Response data
data.incidents.modified	string	Response data
data.incidents.reason	string	Response data
data.incidents.restored	number	Response data
data.incidents.searchCriteria	object	Response data
data.incidents.searchCriteria.end	string	Response data
data.incidents.searchCriteria.fileHash	string	Response data
data.incidents.searchCriteria.from	string	Response data
data.incidents.searchCriteria.messageId	string	Response data
data.incidents.searchCriteria.messageIds	array	Response data
data.incidents.searchCriteria.restoreCode	string	Response data
data.incidents.searchCriteria.start	string	Response data
data.incidents.searchCriteria.to	string	Response data
data.incidents.searchCriteria.unremediateCode	string	Response data
data.incidents.successful	number	Response data
data.incidents.type	string	Response data
fail	array	Output field: fail

Output Example

Permit Or Block Sender

Permit or block a specified sender in Mimecast Security by submitting the required sender data in the request body.

Endpoint

URL: /api/managedsender/permit-or-block-sender

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.action	string	Required	Response data
data.to	string	Required	Response data
data.sender	string	Required	Response data

Input Example

{"json_body":{"data":[{"action":"block","to":"[email protected]","sender":"[email protected]"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.status	number	Status value
data	array	Response data
data.id	string	Response data
data.sender	string	Response data
data.to	string	Response data
data.type	string	Response data
fail	array	Output field: fail
fail.file_name	string	Name of the resource
fail.file	string	Output field: fail.file

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 13 Oct 2022 18:33:04 GMT","Content-Type":"application/json","Content-Length":"370","Connection":"keep-alive","Cache-control":"no-store","Pragma":"no-cache","X-Robots-Tag":"noindex, nofollow","X-RateLimit-Limit":"800","X-RateLimit-Remaining":"799","X-RateLimit-Reset":"5000"},"reason":"OK","json_body":{"meta":{"status":200},"data":[{}],"fail":[]}}

Message Finder Search

Search for messages in Mimecast Security using specified criteria and return matching results based on the provided data.

Endpoint

URL: /api/message-finder/search

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.advancedTrackAndTraceOptions	object	Optional	Response data
data.advancedTrackAndTraceOptions.from	string	Optional	The sending email address or domain of the messages to track.
data.advancedTrackAndTraceOptions.senderIP	string	Optional	The source IP address of messages to track.
data.advancedTrackAndTraceOptions.subject	string	Optional	The subject of the messages to track.
data.advancedTrackAndTraceOptions.to	string	Optional	The recipient email address or domain of the messages to track.
data.advancedTrackAndTraceOptions.url	string	Optional	An URL from the email content.
data.attachments	boolean	Optional	If set to true then searches for emails with attachments.
data.end	string	Optional	The date and time of the latest message to track, in the following format, 2011-12-03T10:15:30+0000.
data.messageId	string	Optional	The internet message id of the message to track.
data.route	string	Optional	An array of routes to filter by. Possible values are internal, outbound and inbound.
data.searchReason	string	Optional	Reason for Tracking a email, used for activity tracking purposes.
data.start	string	Optional	The date and time of the earliest message to track, in the following format, 2011-12-03T10:15:30+0000.
data.status	string	Optional	An email status to filter by. Email status possible values {accepted, processing, bulk_processing, delivery, bulk_delivery, held, bounced, deferred, rejected and archived}.

Input Example

{"json_body":{"data":[{"advancedTrackAndTraceOptions":{"from":"","senderIP":"","subject":"","to":"","url":""},"attachments":true,"end":"2011-12-03T10:15:30+0000","messageId":"","route":"internal","searchReason":"","start":"2011-12-03T10:15:30+0000","status":"accepted"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.status	number	Status value
data	array	Response data
data.trackedEmails	array	Response data
data.trackedEmails.info	string	Response data
data.trackedEmails.id	string	Response data
data.trackedEmails.status	string	Response data
data.trackedEmails.fromEnv	object	Response data
data.trackedEmails.fromEnv.emailAddress	string	Response data
data.trackedEmails.fromHdr	object	Response data
data.trackedEmails.fromHdr.emailAddress	string	Response data
data.trackedEmails.to	array	Response data
data.trackedEmails.to.displayableName	string	Response data
data.trackedEmails.to.emailAddress	string	Response data
data.trackedEmails.received	string	Response data
data.trackedEmails.subject	string	Response data
data.trackedEmails.senderIP	string	Response data
data.trackedEmails.attachments	boolean	Response data
data.trackedEmails.route	string	Response data
data.trackedEmails.sent	string	Response data
data.trackedEmails.spamScore	number	Response data
data.trackedEmails.detectionLevel	string	Response data
fail	array	Output field: fail

Output Example

{"status_code":200,"response_headers":{"date":"Wed, 28 Jan 2026 09:50:17 GMT","content-type":"application/json","cache-control":"no-store","pragma":"no-cache","x-robots-tag":"noindex, nofollow","content-encoding":"gzip","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"960adbb5-57d0-4f99-baef-d8629ac05678","via":"1.1 google","transfer-encoding":"chunked"},"reason":"OK","json_body":{"meta":{"status":200...

Get File

Download an email attachment from Mimecast's message queue using specified data parameters for secure and efficient retrieval.

Endpoint

URL: /api/gateway/message/get-file

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.id	string	Required	Response data

Input Example

{"json_body":{"data":[{"id":"eNpVkOtv2jAUxf-VKV-hw4_YsdlDiqBqh7ah0lLYhIT8uIEsTxKHQaf973NKtW5frOt7js756f4KWjBdA6kNxkE635-bqslWN4P54viJTx-qzeh4O1EHmd0VyeT0OF3lP2ZfnhzjWTa9MdezZQ0D_LjovmXXR7LejKrDXfdwNvhrdoq5WDez3edTt1jDUjhE7-e3590pPqYxG_z8EAyDJjGCkNZ1WgfjssvzYVBA26od5FWVdbWrMig9mCBMKhlqZCVOSJIkRFCNQ4UZUGWsthZpRDG86zMuD0GEYEQYkogxGfHwH803K-eU2RdQunavCOO-hGARKom4EkmEGOFSAwLLmSbMIDAWpLFU-6W2ymrAIHgoiYoMoIgaSnxqUhY-aJWW39P6Tfxa8fYprf8rTdL8cnL8l5IjFkqMe5tx6fEiT5b3MY5ixsSWCyGIZISybdc6aIpwixDdvreQe3dzvjp00MHVy_0-9jSF8xGqrvPUKJdW5WZ04fD21n-DMR4GrrTgXT7KC64o-9aXfL8wfqwKaEz17HrF8dpz37bHZIhSLD1f9PsPUeq6Qg"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.status	number	Status value
data	array	Response data
data.urls	array	Response data
fail	array	Output field: fail
fail.file_name	string	Name of the resource
fail.file	string	Output field: fail.file

Output Example

{"status_code":200,"response_headers":{"date":"Wed, 11 Jun 2025 17:32:48 GMT","content-type":"application/json","cache-control":"no-store","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"53346ffa-a419-4d9b-957c-33ac460010d9","via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000","Transfer-Encoding":"chunked"},"reason":"OK","json_body":{"meta":{"status":200},"data":[{}],"fai...

Get Message Info

Retrieve detailed information about a specific message in Mimecast Security using the provided data parameters.

Endpoint

URL: /api/message-finder/get-message-info

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.id	string	Required	Response data

Input Example

{"json_body":{"data":[{"id":"eNpVzl0LgjAYBeD_smshzc1c0EUkpFKhlaEQhB9v-VGT3ObI6L9nl10_53DOG3HIZQdVgeZI1WJThucJX7Z-4A9Bo_uZbazqcGMNjsJ8bdUKjun1tI-SaZylibsPZ3HOQR6yoMHurhdl00tqVsvzhDgv3nPmEpbFSVTlxFO3wVZsKyR1gtxbIA2V9-L5W8aUEmwYhOoaEg_2-yK5gO6Bx1APHa9ahubGiKyAEXXdHOEpQcLlv__5AqaPQs0"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.deliveredMessage	object	Response data
data.deliveredMessage.ullamco6	object	Response data
data.deliveredMessage.ullamco6.messageInfo	object	Response data
data.deliveredMessage.ullamco6.messageInfo.attachments	array	Response data
data.deliveredMessage.ullamco6.messageInfo.cc	array	Response data
data.deliveredMessage.ullamco6.messageInfo.contentExpiration	string	Response data
data.deliveredMessage.ullamco6.messageInfo.fromEnvelope	string	Response data
data.deliveredMessage.ullamco6.messageInfo.fromHeader	string	Response data
data.deliveredMessage.ullamco6.messageInfo.htmlBody	string	Response data
data.deliveredMessage.ullamco6.messageInfo.metadataExpiration	string	Response data
data.deliveredMessage.ullamco6.messageInfo.processed	string	Response data
data.deliveredMessage.ullamco6.messageInfo.route	string	Response data
data.deliveredMessage.ullamco6.messageInfo.sent	string	Response data
data.deliveredMessage.ullamco6.messageInfo.subject	string	Response data
data.deliveredMessage.ullamco6.messageInfo.textBody	string	Response data
data.deliveredMessage.ullamco6.messageInfo.to	array	Response data
data.deliveredMessage.ullamco6.messageInfo.transmissionInfo	string	Response data
data.deliveredMessage.ullamco6.policyInfo	array	Response data
data.deliveredMessage.ullamco6.policyInfo.policyType	string	Response data
data.deliveredMessage.ullamco6.policyInfo.policyName	string	Response data
data.deliveredMessage.ullamco6.policyInfo.inherited	string	Response data
data.deliveredMessage.ullamco6.deliveryMetaInfo	object	Response data

Output Example

{"data":[{"deliveredMessage":{},"id":"12345678-1234-1234-1234-123456789abc","recipientInfo":{},"retentionInfo":{},"spamInfo":{},"status":"active"}],"fail":[{"file_name":"Example Name","file":"string"}]}

Policy Update

Update an existing Address Alteration Policy in Mimecast Security by providing the necessary data parameters.

Endpoint

URL: /api/policy/address-alteration/update-policy

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.id	string	Optional	Response data
data.addressAlterationSetId	string	Optional	Response data
data.policy	object	Optional	Response data
data.policy.bidirectional	boolean	Optional	Response data
data.policy.comment	string	Optional	Response data
data.policy.conditions	object	Optional	Response data
data.policy.conditions.sourceIPs	array	Optional	Response data
data.policy.description	string	Optional	Response data
data.policy.enabled	boolean	Optional	Response data
data.policy.enforced	boolean	Optional	Response data
data.policy.from	object	Optional	Response data
data.policy.from.attribute	object	Optional	Response data
data.policy.from.attribute.id	string	Optional	Response data
data.policy.from.attribute.name	string	Optional	Response data
data.policy.from.attribute.value	string	Optional	Response data
data.policy.from.emailAddress	string	Optional	Response data
data.policy.from.emailDomain	string	Optional	Response data
data.policy.from.groupId	string	Optional	Response data
data.policy.from.type	string	Optional	Response data
data.policy.fromDate	string	Optional	Response data
data.policy.fromEternal	boolean	Optional	Response data
data.policy.fromPart	string	Optional	Response data
data.policy.override	boolean	Optional	Response data
data.policy.to	object	Optional	Response data

Input Example

{"json_body":{"data":[{"id":"eNpFjkuLwjAYRf9LtlpI0jZVd07VOjPgpqNCN6Gkn0mwD8mjo4j_faIgs7mbc8_l3pEF4Q3oBi0QEzf57WPTn1W1r3briWpPVH7NNTU-T9qiV2W1WeWFjO1xezhd3Yc-km1-rX8V_pTZDk1RB9bWEkpXO29_bhcIs7URSo_QBCy8dUMHRgzNk-T7ckmyZZrOAhvBWD30aEGmb-X1SnIRAfcWE04zwscmZEQS_i9zimmKWSgkoefAdEmEMYsInccsY_EMY_T4A6fESWU","addressAlterationSetId":"eNpFjkuLwjAYRf9LtlpI0jZVd07VOjPgpqNCN6Gkn0mwD8mjo4j_faIgs7mbc8_l3pEF4Q3oBi0QEzf57WPTn1W1r3briWpPVH7NNTU-T9qiV2W1WeWFjO1xezhd3Yc-km1-rX8V_pTZDk1RB9bWEkpXO29_bhcIs7URSo_QBCy8dUMHRgzNk-T7ckmyZZrOAhvBWD30aEGmb-X1SnIRAfcWE04zwscmZEQS_i9zimmKWSgkoefAdEmEMYsInccsY_EMY_T4A6fESWU","policy":{"bidirectional":true,"comment":"This is a test comment","conditions":{"sourceIPs":["192.168.1.1","192.168.1.2"]},"description":"This is a test description","enabled":true,"enforced":true,"from":{"attribute":{"id":"1234567890","name":"This is a test name","value":"This is a test value"},"emailAddress":"[email protected]","emailDomain":"example.com","groupId":"1234567890","type":"profile_group"},"fromDate":"2021-01-01","fromEternal":true,"fromPart":"both","override":true,"to":{"attribute":{"id":"1234567890","name":"This is a test name","value":"This is a test value"},"emailAddress":"[email protected]","emailDomain":"example.com","groupId":"1234567890","type":"internal_addresses"},"toDate":"2021-01-01","toEternal":true}}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.addressAlterationSetId	string	Response data
data.id	string	Response data
data.policy	object	Response data
data.policy.bidirectional	boolean	Response data
data.policy.conditions	object	Response data
data.policy.conditions.sourceIPs	array	Response data
data.policy.createTime	string	Response data
data.policy.description	string	Response data
data.policy.enabled	boolean	Response data
data.policy.enforced	boolean	Response data
data.policy.from	object	Response data
data.policy.from.attribute	object	Response data
data.policy.from.attribute.id	string	Response data
data.policy.from.attribute.name	string	Response data
data.policy.from.attribute.value	string	Response data
data.policy.from.emailAddress	string	Response data
data.policy.from.emailDomain	string	Response data
data.policy.from.group	object	Response data
data.policy.from.group.description	string	Response data
data.policy.from.group.folderCount	number	Response data
data.policy.from.group.id	string	Response data
data.policy.from.group.parentId	string	Response data

Output Example

{"status_code":200,"response_headers":{"date":"Tue, 17 Jun 2025 05:48:58 GMT","content-type":"application/json","cache-control":"no-store","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"ad48d523-1983-492a-91d4-c2e1eb97cbac","via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000","Transfer-Encoding":"chunked"},"reason":"OK","json_body":{"data":[{}],"fail":[]}}

Create Block Sender Policy

Establish a new blocked sender policy in Mimecast Security by specifying sender and recipient restrictions using the provided data.

Endpoint

URL: /api/policy/blockedsenders/create-policy

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.option	string	Optional	Response data
data.policy	object	Optional	Response data
data.policy.bidirectional	boolean	Optional	Response data
data.policy.comment	string	Optional	Response data
data.policy.conditions	object	Optional	Response data
data.policy.conditions.sourceIPs	array	Optional	Response data
data.policy.description	string	Optional	Response data
data.policy.enabled	boolean	Optional	Response data
data.policy.enforced	boolean	Optional	Response data
data.policy.from	object	Optional	Response data
data.policy.from.attribute	object	Optional	Response data
data.policy.from.attribute.id	string	Optional	Response data
data.policy.from.attribute.name	string	Optional	Response data
data.policy.from.attribute.value	string	Optional	Response data
data.policy.from.emailAddress	string	Optional	Response data
data.policy.from.emailDomain	string	Optional	Response data
data.policy.from.groupId	string	Optional	Response data
data.policy.from.headerDisplayName	string	Optional	Response data
data.policy.from.type	string	Optional	Response data
data.policy.fromDate	string	Optional	Response data
data.policy.fromEternal	boolean	Optional	Response data
data.policy.fromPart	string	Optional	Response data
data.policy.override	boolean	Optional	Response data
data.policy.to	object	Optional	Response data

Input Example

{"json_body":{"data":[{"option":"no_action","policy":{"bidirectional":true,"comment":"This is a test comment","conditions":{"sourceIPs":["192.168.1.1","192.168.1.2"]},"description":"This is a test description","enabled":true,"enforced":true,"from":{"attribute":{"id":"1234567890","name":"This is a test name","value":"This is a test value"},"emailAddress":"[email protected]","emailDomain":"example.com","groupId":"1234567890","headerDisplayName":"This is a test header display name","type":"email_domain"},"fromDate":"2021-01-01","fromEternal":true,"fromPart":"envelope_from","override":true,"to":{"attribute":{"id":"1234567890","name":"This is a test name","value":"This is a test value"},"emailAddress":"[email protected]","emailDomain":"example.com","groupId":"1234567890","headerDisplayName":"This is a test header display name","type":"everyone"},"toDate":"2021-01-01","toEternal":true}}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	string	Response data
data.option	string	Response data
data.policy	object	Response data
data.policy.bidirectional	boolean	Response data
data.policy.comment	string	Response data
data.policy.conditions	object	Response data
data.policy.conditions.sourceIPs	array	Response data
data.policy.createTime	string	Response data
data.policy.description	string	Response data
data.policy.enabled	boolean	Response data
data.policy.enforced	boolean	Response data
data.policy.from	object	Response data
data.policy.from.attribute	object	Response data
data.policy.from.attribute.id	string	Response data
data.policy.from.attribute.name	string	Response data
data.policy.from.attribute.value	string	Response data
data.policy.from.device	object	Response data
data.policy.from.device.description	string	Response data
data.policy.from.device.folderCount	number	Response data
data.policy.from.device.folders	array	Response data
data.policy.from.device.id	string	Response data
data.policy.from.device.parentId	string	Response data

Output Example

Create Managed URL

Add a specified URL to the Mimecast managed list for Targeted Threat Protection using provided data parameters.

Endpoint

URL: /api/ttp/url/create-managed-url

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.matchType	string	Optional	Response data
data.disableRewrite	boolean	Optional	Response data
data.action	string	Required	Response data
data.comment	string	Optional	Response data
data.disableUserAwareness	boolean	Optional	Response data
data.url	string	Required	Response data
data.disableLogClick	boolean	Optional	Response data

Input Example

{"json_body":{"data":[{"matchType":"explicit","disableRewrite":false,"action":"block","comment":"This is a comment","disableUserAwareness":false,"url":"https://example.com","disableLogClick":false}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.action	object	Response data
data.action.name	string	Response data
data.action.ordinal	number	Response data
data.action.whitelist	boolean	Response data
data.comment	string	Response data
data.disableLogClick	boolean	Response data
data.disableRewrite	boolean	Response data
data.disableUserAwareness	boolean	Response data
data.domain	string	Response data
data.id	string	Response data
data.matchType	object	Response data
data.matchType.matchType	object	Response data
data.matchType.matchType.id	number	Response data
data.matchType.matchType.name	string	Response data
data.matchType.matchType.ordinal	number	Response data
data.matchType.name	string	Response data
data.matchType.ordinal	number	Response data
data.path	string	Response data
data.port	number	Response data
data.queryString	string	Response data
data.scheme	string	Response data
fail	array	Output field: fail

Output Example

Decode URL

Decode Mimecast Threat Protection URLs to reveal their original form using the specified data parameter.

Endpoint

URL: /api/ttp/url/decode-url

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.url	string	Required	Response data

Input Example

{"json_body":{"data":[{"url":"example.com"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.status	number	Status value
data	array	Response data
data.url	string	Response data
data.success	boolean	Response data
fail	array	Output field: fail
fail.file_name	string	Name of the resource
fail.file	string	Output field: fail.file

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 10 Oct 2022 18:22:06 GMT","Content-Type":"application/json","Content-Length":"79","Connection":"keep-alive","Cache-control":"no-store","Pragma":"no-cache","X-Robots-Tag":"noindex, nofollow","X-RateLimit-Limit":"800","X-RateLimit-Remaining":"799","X-RateLimit-Reset":"5000"},"reason":"OK","json_body":{"meta":{"status":200},"data":[{}],"fail":[]}}

Get Managed URLs

Retrieve all managed URLs or domains from Mimecast Security using the provided data in the request body.

Endpoint

URL: /api/ttp/url/get-all-managed-urls

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.domainOrComment	string	Optional	Response data
data.domainOrUrl	string	Required	Response data
data.exactMatch	boolean	Optional	Response data
data.filterBy	array	Optional	Response data
data.filterBy.fieldName	string	Optional	Response data
data.filterBy.value	string	Optional	Response data
data.sortByUrl	boolean	Optional	Response data
data.sortOrder	string	Optional	Response data

Input Example

{"json_body":{"data":[{"domainOrComment":"This is a test comment","domainOrUrl":"example.com","exactMatch":true,"filterBy":[{"fieldName":"This is a test field name","value":"This is a test value"},{"fieldName":"This is a test field name","value":"This is a test value"}],"sortByUrl":true,"sortOrder":"asc"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.action	object	Response data
data.action.name	string	Response data
data.action.ordinal	number	Response data
data.action.whitelist	boolean	Response data
data.comment	string	Response data
data.disableLogClick	boolean	Response data
data.disableRewrite	boolean	Response data
data.disableUserAwareness	boolean	Response data
data.domain	string	Response data
data.id	string	Response data
data.matchType	object	Response data
data.matchType.matchType	object	Response data
data.matchType.matchType.id	number	Response data
data.matchType.matchType.name	string	Response data
data.matchType.matchType.ordinal	number	Response data
data.matchType.name	string	Response data
data.matchType.ordinal	number	Response data
data.path	string	Response data
data.port	number	Response data
data.queryString	string	Response data
data.scheme	string	Response data
fail	array	Output field: fail

Output Example

Get TTP URL Logs

Fetch log data for URLs processed by Mimecast's Targeted Threat Protection service using the specified data parameter.

Endpoint

URL: /api/ttp/url/get-logs

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.oldestFirst	boolean	Optional	Response data
data.from	string	Optional	Response data
data.route	string	Optional	Response data
data.to	string	Optional	Response data
data.scanResult	string	Optional	Response data

Input Example

{"json_body":{"data":[{"oldestFirst":false,"from":"2016-10-01T14:49:18+0000","route":"all","to":"2017-10-13T23:59:59+0000","scanResult":"all"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.clickLogs	array	Response data
data.clickLogs.action	string	Response data
data.clickLogs.actions	string	Response data
data.clickLogs.adminOverride	string	Response data
data.clickLogs.advancedPhishingResult	object	Response data
data.clickLogs.category	string	Response data
data.clickLogs.creationMethod	string	Response data
data.clickLogs.date	string	Response data
data.clickLogs.emailPartsDescription	array	Response data
data.clickLogs.fromUserEmailAddress	string	Response data
data.clickLogs.heuristicDomainSource	string	Response data
data.clickLogs.messageId	string	Response data
data.clickLogs.route	string	Response data
data.clickLogs.scanResult	string	Response data
data.clickLogs.sendingIp	string	Response data
data.clickLogs.similarDomain	string	Response data
data.clickLogs.subject	string	Response data
data.clickLogs.tagMap	object	Response data
data.clickLogs.ttpDefinition	string	Response data
data.clickLogs.url	string	Response data
data.clickLogs.userAwarenessAction	string	Response data
data.clickLogs.userEmailAddress	string	Response data

Output Example

Get TTP Impersonation Protect Logs

Retrieve detailed logs of impersonation attempts from Mimecast Security using specified data parameters for comprehensive threat analysis.

Endpoint

URL: /api/ttp/impersonation/get-logs

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.actions	array	Optional	Response data
data.from	string	Optional	Response data
data.identifiers	array	Optional	Response data
data.oldestFirst	boolean	Optional	Response data
data.query	string	Optional	Response data
data.searchField	string	Optional	Response data
data.taggedMalicious	boolean	Optional	Response data
data.to	string	Optional	Response data

Input Example

{"json_body":{"data":[{"actions":["hold","bounce"],"from":"2022-10-13T16:57:02+0000","identifiers":["newly_observed_domain","internal_user_name"],"oldestFirst":true,"query":"This is a test query","searchField":"subject","taggedMalicious":true,"to":"2022-10-13T16:57:02+0000"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Response Headers

Header	Description	Example
Alt-Svc	HTTP response header: Alt-Svc	h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control	Directives for caching mechanisms	no-store
Connection	HTTP response header: Connection	keep-alive
content-encoding	HTTP response header: content-encoding	gzip
Content-Length	The length of the response body in bytes	317
Content-Type	The media type of the resource	application/json
date	The date and time at which the message was originated	Wed, 28 Jan 2026 09:50:17 GMT
Pragma	HTTP response header: Pragma	no-cache
referrer-policy	HTTP response header: referrer-policy	same-origin
strict-transport-security	HTTP response header: strict-transport-security	max-age=31536000; includeSubDomains
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
via	HTTP response header: via	1.1 google
x-frame-options	HTTP response header: x-frame-options	SAMEORIGIN
X-RateLimit-Limit	The number of requests allowed in the current rate limit window	800
X-RateLimit-Remaining	The number of requests remaining in the current rate limit window	799
X-RateLimit-Reset	The time at which the current rate limit window resets	5000
x-request-id	A unique identifier for the request	960adbb5-57d0-4f99-baef-d8629ac05678
x-robots-tag	HTTP response header: x-robots-tag	noindex, nofollow