--- title: Mimecast Security slug: connectors/mimecast-security docTags: createdAt: 2026-06-09T16:30:08.785Z --- Mimecast Security is an email security platform that protects against threats like phishing and malware while offering archiving solutions. Mimecast Security is a comprehensive email security platform that provides advanced threat protection, data leak prevention, and secure email archiving. The integration with Swimlane Turbine enables seamless automation of email threat detection and response, allowing security teams to efficiently manage incidents, retrieve detailed message information, and enforce security policies. This integration enhances the ability to automate routine security tasks, streamline workflows, and improve overall security posture by leveraging Mimecast's robust capabilities within the Swimlane Turbine environment. ## Prerequisites Before you can use the Mimecast Security connector for Turbine, you'll need access to the Mimecast API. This requires the following: - HMAC authentication using the following parameters: - URL: The endpoint URL for accessing Mimecast's API. - Access Key: A unique key provided by Mimecast for API access. - App ID: The application identifier for your Mimecast integration. - App Key: A key associated with your application ID for secure access. - Secret Key: A secret key used for generating HMAC signatures. - OAuth2 authorization using the following parameters: - URL: The endpoint URL for accessing Mimecast's OAuth2 service. - Client ID: The client identifier for your OAuth2 application. - Client Secret: A secret associated with your client ID for secure access. ## Action API Permissions Below is the table of required API scopes for the set of credentials used in the asset and broken down by action. | Action | Required API Permissions | | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | | Add or Remove Group Members | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/directory/add-group-member/) | | Archive Message Search | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/archive/search/) | | Create Managed URL | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/targeted-threat-protection-url-protect/create-managed-url/) | | Create Remediation Incident | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/threat-intel/create-incident/) | | Decode URL | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/targeted-threat-protection-url-protect/get-managed-url/) | | Get Archived File Attachment | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/archive/get-file/) | | Get Archived Message Details | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/archive/get-message-detail/) | | Get Archived Message Part | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/archive/get-message-part/) | | Get Archived Messages List | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/archive/get-message-list/) | | Get Archived Search Logs | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/logs-and-statistics/get-archive-search-logs/) | | Get Group Members | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/directory/get-group-members/) | | Get Groups | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/directory/find-groups/) | | Get File | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/message-queues/get-file/) | | Get Held Messages List | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/message-queues/get-hold-message-list/) | | Get TTP Impersonation Protect Logs | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/logs-and-statistics/get-ttp-impersonation-protect-logs/) | | Get Inbound & Output Message Queue Hold List | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/message-queues/inbound-outbound-queues/) | | Get Incident | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/threat-intel/get-incident/) | | Get Managed URLs | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/targeted-threat-protection-url-protect/get-managed-url/) | | Get Message Detail | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/message-queues/get-message-detail/) | | Get Message Info | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/message-finder-formally-tracking/get-message-info/) | | Get TTP URL Logs | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/logs-and-statistics/get-ttp-url-logs/) | | Message Finder Search | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/message-finder-formally-tracking/search/) | | Permit Or Block Sender | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/managed-sender/) | | Reject Message from Queue | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/message-queues/reject-message/) | | Release Message from Queue | [API Permissions](https://integrations.mimecast.com/documentation/endpoint-reference/message-queues/release-message/) | ## Capabilities The Mimecast connector provides the following capabilities: - Add or Remove Group Members - Archive Message Search - Create Managed URL - Create Remediation Incident - Decode URL - Get Account - Get Archived File Attachment - Get Archived Message Details - Get Archived Message Part - Get Archived Messages List - Get Archived Search Logs - Get File - Get Group Members - Get Groups - Get Held Messages List *... and so on* ## Additional Information about Capabilities - See the [Building Search Queries](https://www.mimecast.com/tech-connect/documentation/tutorials/building-search-queries/) guide for more information on building search queries. ### Notes - [Mimecast Endpoint Reference Documentation](https://integrations.mimecast.com/documentation/endpoint-reference/) - [Mimecast API Documentation](https://www.mimecast.com/tech-connect/documentation) - You will need to use a Mimecast [Base URL](https://community.mimecast.com/docs/DOC-1070), see the below table: To set Access/Secrets to never expire you must update the authentication cache TTL setting in the service user's effective authentication profile to "Never Expire." | Region | API Endpoint | Check for Update URLs | | -------------------------- | -------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | Australia | au-api.mimecast.com | [https://updates-au.mimecast.com/update/descriptors/mfo/latest](https://updates-au.mimecast.com/update/descriptors/mfo/latest) | | Europe (excluding Germany) | eu-api.mimecast.com | [https://updates-uk.mimecast.com/update/descriptors/mfo/latest](https://updates-uk.mimecast.com/update/descriptors/mfo/latest) | | Germany | de-api.mimecast.com | [https://updates-de.mimecast.com/update/descriptors/mfo/latest](https://updates-de.mimecast.com/update/descriptors/mfo/latest) | | Offshore | jer-api.mimecast.com | [https://updates-jer.mimecast.com/update/descriptors/mfo/latest](https://updates-jer.mimecast.com/update/descriptors/mfo/latest) | | REQUIRED | api.mimecast.com | N/A - Used for initial account discovery. | | South Africa | za-api.mimecast.com | [https://updates-za.mimecast.com/update/descriptors/mfo/latest](https://updates-za.mimecast.com/update/descriptors/mfo/latest) | | United States | us-api.mimecast.com | [https://updates-us.mimecast.com/update/descriptors/mfo/latest](https://updates-us.mimecast.com/update/descriptors/mfo/latest) | ## About Address Alteration Policy Updates You must define the input required for your use case in the Policy Update action. The Policy Update action doesn't require any policy input, which is how Mimecast defined this endpoint. If no policy input is defined, then the action will fail. For more information about all the available inputs, see the [official API documentation.](https://integrations.mimecast.com/documentation/endpoint-reference/policies/address-alteration/update-policy/) ## Additional Notes - Please provide Admin access or required premissions to your Mimecast account or credentials wherever applicable to make the connector actions working. # Configurations ## Mimecast HMAC Authenticates using HMAC ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | access\_key | Access Key | string | Required | | app\_id | App ID | string | Required | | app\_key | App Key | string | Required | | secret\_key | Secret Key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | ## Mimecast Oauth 2.0 Client Credentials Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | client\_id | The client ID | string | Required | | client\_secret | The client secret. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Archived File Attachment Retrieve a file attachment from an archived message in Mimecast Security using specified data parameters. ### Endpoint - **URL:** `/api/archive/get-file` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.id` | string | Optional | Response data | ### Input Example `{"json_body":{"data":[{"id":"eNpFjkuLwjAYRf9LtlpI0jZVd07VOjPgpqNCN6Gkn0mwD8mjo4j_faIgs7mbc8_l3pEF4Q3oBi0QEzf57WPTn1W1r3briWpPVH7NNTU-T9qiV2W1WeWFjO1xezhd3Yc-km1-rX8V_pTZDk1RB9bWEkpXO29_bhcIs7URSo_QBCy8dUMHRgzNk-T7ckmyZZrOAhvBWD30aEGmb-X1SnIRAfcWE04zwscmZEQS_i9zimmKWSgkoefAdEmEMYsInccsY_EMY_T4A6fESWU"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.status` | number | Status value | | `data` | array | Response data | | `data.urls` | array | Response data | | `fail` | array | Output field: fail | | `fail.file_name` | string | Name of the resource | | `fail.file` | string | Output field: fail.file | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 16 Sep 2025 05:37:26 GMT","content-type":"application/json","cache-control":"no-store","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"793b7425-5352-48ef-9b2c-eb9a5e4aed6a","via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000","Transfer-Encoding":"chunked"},"reason":"OK","json_body":{"meta":{"status":200},"data":[{}],"fai...` ## Get Archived Message Details Retrieve detailed information about a specific message from Mimecast's archive using the provided data parameters. ### Endpoint - **URL:** `/api/archive/get-message-detail` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.id` | string | Required | Response data | ### Input Example `{"json_body":{"data":[{"id":"eNpVzlkLgkAUBeD_Mq8FZe5BD5HUGBXtKQSh4y23RnS8Ywv99-yx5-8cznkTAQwrSCIyJHNKp8FpgWFHlQ-WF1mG-8ku3SyMl9NoYmakDeyD63F78AdeGPh0uzE9JgB34TrT6ErWcSbRVpPxuac7TyEFpzoPPf-QMN1tbi-r4csabWfN3BHpkjiPyt-wZtuGYpnmwOiS-s5_V1DUUN21NiShEknByVBpkUfQYr-vtFAiIFz--58vo3BC9A"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.attachments` | array | Response data | | `data.attachments.bodyType` | number | Response data | | `data.attachments.contentId` | string | Response data | | `data.attachments.contentType` | string | Response data | | `data.attachments.extension` | string | Response data | | `data.attachments.filename` | string | Response data | | `data.attachments.id` | string | Response data | | `data.attachments.sha256` | string | Response data | | `data.attachments.size` | number | Response data | | `data.attachments.verdict` | string | Response data | | `data.cc` | array | Response data | | `data.cc.displayableName` | string | Response data | | `data.cc.emailAddress` | string | Response data | | `data.envelopeFrom` | object | Response data | | `data.envelopeFrom.displayableName` | string | Response data | | `data.envelopeFrom.emailAddress` | string | Response data | | `data.hasHtmlBody` | boolean | Response data | | `data.hasTextBody` | boolean | Response data | | `data.headerDate` | string | Response data | | `data.headers` | array | Response data | | `data.headers.name` | string | Response data | | `data.id` | object | Response data | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 10 Jun 2025 10:09:08 GMT","content-type":"application/json","cache-control":"no-store","pragma":"no-cache","x-robots-tag":"noindex, nofollow","content-encoding":"gzip","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"48b4c8e7-6150-45a4-bd51-a86d8d0372d0","via":"1.1 google","transfer-encoding":"chunked"},"reason":"OK","json_body":{"data":[{}],"fail":[...` ## Get Archived Messages List Retrieve a list of archived messages for a specified user in Mimecast Security. Requires a data payload. ### Endpoint - **URL:** `/api/archive/get-message-list` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.end` | string | Optional | Response data | | `data.includeAliases` | boolean | Optional | Response data | | `data.includeDelegates` | boolean | Optional | Response data | | `data.mailbox` | string | Optional | Response data | | `data.start` | string | Optional | Response data | | `data.view` | string | Required | Response data | ### Input Example `{"json_body":{"data":[{"end":"2022-10-13T16:57:02+0000","includeAliases":true,"includeDelegates":true,"mailbox":"admin@mctest.swimlane.com","start":"2022-10-13T16:57:02+0000","view":"INBOX"}]}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.attachmentCount` | number | Response data | | `data.ccm` | boolean | Response data | | `data.expired` | boolean | Response data | | `data.from` | object | Response data | | `data.from.displayableName` | string | Response data | | `data.from.emailAddress` | string | Response data | | `data.id` | object | Response data | | `data.read` | boolean | Response data | | `data.recalled` | boolean | Response data | | `data.received` | string | Response data | | `data.size` | number | Response data | | `data.smash` | string | Response data | | `data.status` | string | Response data | | `data.subject` | string | Response data | | `data.to` | object | Response data | | `data.to.displayableName` | string | Response data | | `data.to.emailAddress` | string | Response data | | `fail` | array | Output field: fail | | `fail.file_name` | string | Name of the resource | | `fail.file` | string | Output field: fail.file | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 10 Jun 2025 10:09:08 GMT","content-type":"application/json","cache-control":"no-store","pragma":"no-cache","x-robots-tag":"noindex, nofollow","content-encoding":"gzip","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"48b4c8e7-6150-45a4-bd51-a86d8d0372d0","via":"1.1 google","transfer-encoding":"chunked"},"reason":"OK","json_body":{"data":[{}],"fail":[...` ## Get Archived Message Part Retrieve a specific part of an archived message from Mimecast Security using the provided data parameters. ### Endpoint - **URL:** `/api/archive/get-message-part` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.context` | string | Optional | Response data | | `data.id` | string | Optional | Response data | | `data.type` | string | Optional | Response data | | `data.extractFromHtml` | boolean | Optional | Response data | | `data.mailbox` | string | Optional | Response data | | `data.stripDangerous` | boolean | Optional | Response data | | `data.stripImg` | boolean | Optional | Response data | | `data.stripStyles` | boolean | Optional | Response data | | `data.transposeInlineCID` | boolean | Optional | Response data | ### Input Example `{"json_body":{"data":[{"context":"DELIVERED","id":"eNpVzlkLgkAUBeD_Mq8FZe5BD5HUGBXtKQSh4y23RnS8Ywv99-yx5-8cznkTAQwrSCIyJHNKp8FpgWFHlQ-WF1mG-8ku3SyMl9NoYmakDeyD63F78AdeGPh0uzE9JgB34TrT6ErWcSbRVpPxuac7TyEFpzoPPf-QMN1tbi-r4csabWfN3BHpkjiPyt-wZtuGYpnmwOiS-s5_V1DUUN21NiShEknByVBpkUfQYr-vtFAiIFz--58vo3BC9A","type":"RFC822","extractFromHtml":true,"mailbox":"admin@mctest.swimlane.com","stripDangerous":true,"stripImg":true,"stripStyles":true,"transposeInlineCID":true}]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.status` | number | Status value | | `data` | array | Response data | | `data.urls` | array | Response data | | `fail` | array | Output field: fail | | `fail.errors` | array | Error message if any | | `fail.errors.code` | string | Error message if any | | `fail.errors.message` | string | Response message | | `fail.errors.retryable` | boolean | Error message if any | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 10 Jun 2025 10:09:08 GMT","content-type":"application/json","cache-control":"no-store","pragma":"no-cache","x-robots-tag":"noindex, nofollow","content-encoding":"gzip","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"48b4c8e7-6150-45a4-bd51-a86d8d0372d0","via":"1.1 google","transfer-encoding":"chunked"},"reason":"OK","json_body":{"meta":{"status":200...` ## Get Archived Search Logs Retrieve archived search logs from Mimecast Security using specified JSON body parameters. ### Endpoint - **URL:** `/api/archive/get-search-logs` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.end` | string | Optional | Response data | | `data.query` | string | Optional | Response data | | `data.start` | string | Optional | Response data | ### Input Example `{"json_body":{"data":[{"end":"2022-10-24T20:51:21+0000","query":" admin@mctest.swimlane.com attachmentcount status subject size receiveddate displayfrom displayfromaddress id displayto displaytoaddresslist smash ","start":"2022-10-23T20:51:21+0000"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.status` | number | Status value | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.pageSize` | number | Output field: meta.pagination.pageSize | | `meta.pagination.totalCount` | number | Count value | | `data` | array | Response data | | `data.logs` | array | Response data | | `data.logs.createTime` | string | Response data | | `data.logs.emailAddr` | string | Response data | | `data.logs.source` | string | Response data | | `data.logs.searchText` | string | Response data | | `data.logs.searchPath` | string | Response data | | `data.logs.searchReason` | string | Response data | | `data.logs.isAdmin` | boolean | Response data | | `data.logs.museQuery` | string | Response data | | `data.logs.description` | string | Response data | | `fail` | array | Output field: fail | | `fail.file_name` | string | Name of the resource | | `fail.file` | string | Output field: fail.file | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 24 Oct 2022 21:18:56 GMT","Content-Type":"application/json","Content-Length":"3360","Connection":"keep-alive","Cache-control":"no-store","Pragma":"no-cache","X-Robots-Tag":"noindex, nofollow","X-RateLimit-Limit":"800","X-RateLimit-Remaining":"799","X-RateLimit-Reset":"5000"},"reason":"OK","json_body":{"meta":{"status":200,"pagination":{}},"data":[{}],"fail":[]}}` ## Archive Search Conduct a comprehensive search in Mimecast Security's archive using specified data parameters. ### Endpoint - **URL:** `/api/archive/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ---------------------------- | | `meta` | object | Optional | Parameter for Archive Search | | `meta.pagination` | object | Optional | Parameter for Archive Search | | `meta.pagination.pageToken` | string | Optional | Parameter for Archive Search | | `data` | array | Optional | Response data | | `data.admin` | boolean | Required | Response data | | `data.query` | string | Required | Response data | ### Input Example `{"json_body":{"meta":{"pagination":{"pageToken":"pageToken"}},"data":[{"admin":false,"query":" Subject:subject "}]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.queryDuration` | number | Response data | | `fail` | array | Output field: fail | | `fail.errors` | array | Error message if any | | `fail.errors.code` | string | Error message if any | | `fail.errors.message` | string | Response message | | `fail.errors.retryable` | boolean | Error message if any | | `fail.key` | object | Output field: fail.key | | `fail.key.query` | string | Output field: fail.key.query | | `fail.key.admin` | boolean | Output field: fail.key.admin | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 10 Jun 2025 10:09:08 GMT","content-type":"application/json","cache-control":"no-store","pragma":"no-cache","x-robots-tag":"noindex, nofollow","content-encoding":"gzip","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"48b4c8e7-6150-45a4-bd51-a86d8d0372d0","via":"1.1 google","transfer-encoding":"chunked"},"reason":"OK","json_body":{"data":[{},{}],"fail...` ## Add Group Member Add a new member to a specified group in Mimecast Security using the provided JSON body. ### Endpoint - **URL:** `/api/directory/add-group-member` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.domain` | string | Optional | Response data | | `data.notes` | string | Optional | Response data | | `data.emailAddress` | string | Optional | Response data | | `data.id` | string | Required | Response data | ### Input Example `{"json_body":{"data":[{"domain":"www.test1.com","emailAddress":"test@test1.com","id":"eNoVzk0LgjAYAOD_8l4TYtVKhQ6mkNGnlaXQRedrLc2Fc5OK_nt2fw7PByQyVSPPwAbungVziOmyXuEPgmW-1bPydQ9W47fXjuR8fG_xmOSnfRgPojSJ_X0wiZhEdUh3xcjf6OZWaGUNuXPpU-8ltax8WqVRHHJGF-31bbbVulGWt2OLKRhQZskT7DwpJRrAlGzEA2smMuwubnhwyMSh1OygxlpyUYFNDMhFmWH9_w4tSgj5_gA76UBc"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | ----------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.emailAddress` | string | Response data | | `data.folderId` | string | Response data | | `data.id` | string | Response data | | `data.internal` | boolean | Response data | | `data.notes` | string | Response data | | `fail` | array | Output field: fail | | `fail.errors` | array | Error message if any | | `fail.errors.code` | string | Error message if any | | `fail.errors.message` | string | Response message | | `fail.errors.retryable` | boolean | Error message if any | | `fail.key` | object | Output field: fail.key | | `fail.key.domain` | string | Output field: fail.key.domain | | `fail.key.emailAddress` | string | Output field: fail.key.emailAddress | | `fail.key.id` | string | Unique identifier | | `fail.key.notes` | string | Output field: fail.key.notes | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 10 Jun 2025 10:09:08 GMT","content-type":"application/json","cache-control":"no-store","pragma":"no-cache","x-robots-tag":"noindex, nofollow","content-encoding":"gzip","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"48b4c8e7-6150-45a4-bd51-a86d8d0372d0","via":"1.1 google","transfer-encoding":"chunked"},"reason":"OK","json_body":{"data":[{}],"fail":[...` ## Get Groups Retrieve matching groups from Mimecast using query parameters specified in the JSON body data. ### Endpoint - **URL:** `/api/directory/find-groups` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.query` | string | Optional | Response data | | `data.source` | string | Optional | Response data | ### Input Example `{"json_body":{"data":[{"query":"query string","source":"source string"}]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.folders` | array | Response data | | `data.folders.description` | string | Response data | | `data.folders.folderCount` | number | Response data | | `data.folders.id` | string | Response data | | `data.folders.parentId` | string | Response data | | `data.folders.source` | string | Response data | | `data.query` | string | Response data | | `data.source` | string | Response data | | `fail` | array | Output field: fail | | `fail.errors` | array | Error message if any | | `fail.errors.code` | string | Error message if any | | `fail.errors.message` | string | Response message | | `fail.errors.retryable` | boolean | Error message if any | | `fail.key` | object | Output field: fail.key | | `fail.key.query` | string | Output field: fail.key.query | | `fail.key.source` | string | Output field: fail.key.source | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 10 Jun 2025 10:09:08 GMT","content-type":"application/json","cache-control":"no-store","pragma":"no-cache","x-robots-tag":"noindex, nofollow","content-encoding":"gzip","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"48b4c8e7-6150-45a4-bd51-a86d8d0372d0","via":"1.1 google","transfer-encoding":"chunked"},"reason":"OK","json_body":{"data":[{},{}],"fail...` ## Get Group Members Retrieve a list of members for a specified group in Mimecast Security using the provided JSON body details. ### Endpoint - **URL:** `/api/directory/get-group-members` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.id` | string | Required | Response data | ### Input Example `{"json_body":{"data":[{"id":"eNoVzk0LgjAYAOD_8l4TYtVKhQ6mkNGnlaXQRedrLc2Fc5OK_nt2fw7PByQyVSPPwAbungVziOmyXuEPgmW-1bPydQ9W47fXjuR8fG_xmOSnfRgPojSJ_X0wiZhEdUh3xcjf6OZWaGUNuXPpU-8ltax8WqVRHHJGF-31bbbVulGWt2OLKRhQZskT7DwpJRrAlGzEA2smMuwubnhwyMSh1OygxlpyUYFNDMhFmWH9_w4tSgj5_gA76UBc"}]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.groupMembers` | array | Response data | | `data.groupMembers.domain` | string | Response data | | `data.groupMembers.emailAddress` | string | Response data | | `data.groupMembers.internal` | boolean | Response data | | `data.groupMembers.name` | string | Response data | | `data.groupMembers.type` | string | Response data | | `data.groupMembers.notes` | string | Response data | | `fail` | array | Output field: fail | | `fail.errors` | array | Error message if any | | `fail.errors.code` | string | Error message if any | | `fail.errors.message` | string | Response message | | `fail.errors.retryable` | boolean | Error message if any | | `fail.key` | object | Output field: fail.key | | `fail.key.id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 10 Jun 2025 10:09:08 GMT","content-type":"application/json","cache-control":"no-store","pragma":"no-cache","x-robots-tag":"noindex, nofollow","content-encoding":"gzip","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"48b4c8e7-6150-45a4-bd51-a86d8d0372d0","via":"1.1 google","transfer-encoding":"chunked"},"reason":"OK","json_body":{"data":[{},{}],"fail...` ## Remove Group Member Remove specified members from a Mimecast Security group using the provided JSON body for configuration. ### Endpoint - **URL:** `/api/directory/remove-group-member` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.domain` | string | Optional | Response data | | `data.emailAddress` | string | Optional | Response data | | `data.id` | string | Required | Response data | ### Input Example `{"json_body":{"data":[{"domain":"www.test1.com","emailAddress":"test@test1.com","id":"eNoVzk0LgjAYAOD_8l4TYtVKhQ6mkNGnlaXQRedrLc2Fc5OK_nt2fw7PByQyVSPPwAbungVziOmyXuEPgmW-1bPydQ9W47fXjuR8fG_xmOSnfRgPojSJ_X0wiZhEdUh3xcjf6OZWaGUNuXPpU-8ltax8WqVRHHJGF-31bbbVulGWt2OLKRhQZskT7DwpJRrAlGzEA2smMuwubnhwyMSh1OygxlpyUYFNDMhFmWH9_w4tSgj5_gA76UBc"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.status` | number | Status value | | `data` | array | Response data | | `data.id` | string | Response data | | `data.folderId` | string | Response data | | `data.emailAddress` | string | Response data | | `data.internal` | boolean | Response data | | `fail` | array | Output field: fail | | `fail.file_name` | string | Name of the resource | | `fail.file` | string | Output field: fail.file | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 10 Oct 2022 16:06:53 GMT","Content-Type":"application/json","Content-Length":"606","Connection":"keep-alive","Cache-control":"no-store","Pragma":"no-cache","X-Robots-Tag":"noindex, nofollow","X-RateLimit-Limit":"800","X-RateLimit-Remaining":"799","X-RateLimit-Reset":"5000"},"reason":"OK","json_body":{"meta":{"status":200},"data":[{}],"fail":[]}}` ## Get Inbound and Outbound Message Queue Hold List Retrieve inbound and outbound email queue messages from Mimecast Security using specified data parameters. ### Endpoint - **URL:** `/api/email/get-email-queues` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.start` | string | Required | Response data | | `data.end` | string | Required | Response data | ### Input Example `{"json_body":{"data":[{"start":"2015-11-16T14:49:18+0000","end":"2015-11-16T14:49:18+0000"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.inboundEmailQueue` | array | Response data | | `data.inboundEmailQueue.count` | number | Response data | | `data.inboundEmailQueue.date` | string | Response data | | `data.outboundEmailQueue` | array | Response data | | `data.outboundEmailQueue.count` | number | Response data | | `data.outboundEmailQueue.date` | string | Response data | | `fail` | array | Output field: fail | | `fail.errors` | array | Error message if any | | `fail.errors.code` | string | Error message if any | | `fail.errors.message` | string | Response message | | `fail.errors.retryable` | boolean | Error message if any | | `fail.key` | object | Output field: fail.key | | `fail.key.end` | string | Output field: fail.key.end | | `fail.key.start` | string | Output field: fail.key.start | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 10 Jun 2025 10:09:08 GMT","content-type":"application/json","cache-control":"no-store","pragma":"no-cache","x-robots-tag":"noindex, nofollow","content-encoding":"gzip","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"48b4c8e7-6150-45a4-bd51-a86d8d0372d0","via":"1.1 google","transfer-encoding":"chunked"},"reason":"OK","json_body":{"data":[{},{}],"fail...` ## Get Held Messages List Retrieve details of messages on hold in Mimecast Security using specified criteria within the required data payload. ### Endpoint - **URL:** `/api/gateway/get-hold-message-list` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.admin` | boolean | Optional | Response data | | `data.start` | string | Optional | Response data | | `data.searchBy` | object | Optional | Response data | | `data.searchBy.fieldName` | string | Optional | Response data | | `data.searchBy.value` | string | Optional | Response data | | `data.end` | string | Optional | Response data | ### Input Example `{"json_body":{"data":[{"admin":true,"start":"2015-11-16T14:49:18+0000","searchBy":{"fieldName":"field name","value":"value"},"end":"2015-11-16T14:49:18+0000"}]}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.dateReceived` | string | Response data | | `data.from` | object | Response data | | `data.from.displayableName` | string | Response data | | `data.from.emailAddress` | string | Response data | | `data.fromHeader` | object | Response data | | `data.fromHeader.displayableName` | string | Response data | | `data.fromHeader.emailAddress` | string | Response data | | `data.hasAttachments` | string | Response data | | `data.id` | string | Response data | | `data.policyInfo` | string | Response data | | `data.reason` | string | Response data | | `data.reasonCode` | string | Response data | | `data.route` | string | Response data | | `data.size` | number | Response data | | `data.subject` | string | Response data | | `data.to` | object | Response data | | `data.to.displayableName` | string | Response data | | `data.to.emailAddress` | string | Response data | | `fail` | array | Output field: fail | | `fail.errors` | array | Error message if any | | `fail.errors.code` | string | Error message if any | | `fail.errors.message` | string | Response message | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 10 Jun 2025 10:09:08 GMT","content-type":"application/json","cache-control":"no-store","pragma":"no-cache","x-robots-tag":"noindex, nofollow","content-encoding":"gzip","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"48b4c8e7-6150-45a4-bd51-a86d8d0372d0","via":"1.1 google","transfer-encoding":"chunked"},"reason":"OK","json_body":{"data":[{}],"fail":[...` ## Get Message Details Retrieve detailed information about a specific message from Mimecast Security using the provided data parameters. ### Endpoint - **URL:** `/api/gateway/message/get-message-detail` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.viewType` | string | Optional | Response data | | `data.id` | string | Required | Response data | | `data.context` | string | Optional | Response data | | `data.mailbox` | string | Optional | Response data | ### Input Example `{"json_body":{"data":[{"viewType":"archive","id":"mimecast_secure_id","context":"DELIVERED","mailbox":"mailbox@mailbox.com"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Reject Message from Queue Reject a specific message from the Mimecast held queue using provided data parameters. ### Endpoint - **URL:** `/api/gateway/hold-reject` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.message` | string | Optional | Response data | | `data.ids` | array | Required | Response data | | `data.reasonType` | string | Optional | Response data | | `data.notify` | boolean | Optional | Response data | ### Input Example `{"json_body":{"data":[{"message":"Rejection message to be returned to sender","ids":["eNpVzl0LgjAYBeD_smshzc1c0EUkpFKhlaEQhB9v-VGT3ObI6L9nl10_53DOG3HIZQdVgeZI1WJThucJX7Z-4A9Bo_uZbazqcGMNjsJ8bdUKjun1tI-SaZylibsPZ3HOQR6yoMHurhdl00tqVsvzhDgv3nPmEpbFSVTlxFO3wVZsKyR1gtxbIA2V9-L5W8aUEmwYhOoaEg_2-yK5gO6Bx1APHa9ahubGiKyAEXXdHOEpQcLlv__5AqaPQs0"],"reasonType":"MESSAGE CONTAINS UNDESIRABLE CONTENT","notify":false}]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.id` | string | Response data | | `data.reject` | boolean | Response data | | `fail` | array | Output field: fail | | `fail.errors` | array | Error message if any | | `fail.errors.code` | string | Error message if any | | `fail.errors.message` | string | Response message | | `fail.errors.retryable` | boolean | Error message if any | | `fail.key` | object | Output field: fail.key | | `fail.key.ids` | array | Unique identifier | | `fail.key.message` | string | Response message | | `fail.key.notify` | boolean | Output field: fail.key.notify | | `fail.key.reasonType` | string | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 10 Jun 2025 10:09:08 GMT","content-type":"application/json","cache-control":"no-store","pragma":"no-cache","x-robots-tag":"noindex, nofollow","content-encoding":"gzip","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"48b4c8e7-6150-45a4-bd51-a86d8d0372d0","via":"1.1 google","transfer-encoding":"chunked"},"reason":"OK","json_body":{"data":[{},{}],"fail...` ## Release Message from Queue Release a specific message from Mimecast's hold queue using provided data parameters. ### Endpoint - **URL:** `/api/gateway/hold-release` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.id` | string | Required | Response data | ### Input Example `{"json_body":{"data":[{"id":"eNpVzlkLgkAUBeD_Mq8FZe5BD5HUGBXtKQSh4y23RnS8Ywv99-yx5-8cznkTAQwrSCIyJHNKp8FpgWFHlQ-WF1mG-8ku3SyMl9NoYmakDeyD63F78AdeGPh0uzE9JgB34TrT6ErWcSbRVpPxuac7TyEFpzoPPf-QMN1tbi-r4csabWfN3BHpkjiPyt-wZtuGYpnmwOiS-s5_V1DUUN21NiShEknByVBpkUfQYr-vtFAiIFz--58vo3BC9A"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.id` | string | Response data | | `data.release` | boolean | Response data | | `fail` | array | Output field: fail | | `fail.file_name` | string | Name of the resource | | `fail.file` | string | Output field: fail.file | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 13 Oct 2022 20:07:50 GMT","Content-Type":"application/json","Content-Length":"317","Connection":"keep-alive","Cache-control":"no-store","Pragma":"no-cache","X-Robots-Tag":"noindex, nofollow","X-RateLimit-Limit":"800","X-RateLimit-Remaining":"799","X-RateLimit-Reset":"5000"},"reason":"OK","json_body":{"meta":{"status":200},"data":[{}],"fail":[]}}` ## Get Account Retrieve account details from Mimecast Security using the provided JSON body input. ### Endpoint - **URL:** `/api/account/get-account` - **Method:** `POST` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `fail` | array | Output field: fail | | `fail.file_name` | string | Name of the resource | | `fail.file` | string | Output field: fail.file | | `meta` | object | Output field: meta | | `meta.status` | number | Status value | | `data` | array | Response data | | `data.maxRetention` | number | Response data | | `data.accountCode` | string | Response data | | `data.domain` | string | Response data | | `data.automatedSegmentPurge` | boolean | Response data | | `data.databaseCode` | string | Response data | | `data.supportCode` | string | Response data | | `data.region` | string | Response data | | `data.accountName` | string | Response data | | `data.maxRetentionConfirmed` | boolean | Response data | | `data.archive` | boolean | Response data | | `data.gateway` | boolean | Response data | | `data.policyInheritance` | boolean | Response data | | `data.passphrase` | string | Response data | | `data.type` | string | Response data | | `data.mailPlatform` | string | Response data | | `data.packages` | array | Response data | | `data.mimecastId` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"fail":[],"meta":{"status":200},"data":[{}]}}` ## Get TTP Attachment Logs Get TTP attachment logs from Mimecast Security using the provided JSON body to analyze email security events. ### Endpoint - **URL:** `/api/ttp/attachment/get-logs` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------- | | `data` | array | Optional | Response data | | `data.from` | string | Optional | Start date of logs to return in the following format 2015-11-16T14:49:18+0000. Default is the start of the current day. | | `data.oldestFirst` | boolean | Optional | Default false. Orders results with the most recent first. | | `data.result` | string | Optional | Filters logs by scan result, must be one of safe, malicious, timeout, error, unsafe, or all. | | `data.route` | string | Optional | Filters logs by route, must be one of inbound, outbound, internal, or all. | | `data.to` | string | Optional | End date of logs to return in the following format 2015-11-16T14:49:18+0000. | ### Input Example `{"json_body":{"data":[{"from":"2016-10-01T14:49:18+0000","oldestFirst":false,"result":"unsafe","route":"all","to":"2017-10-13T23:59:59+0000"}]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | -------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `fail` | array | Output field: fail | | `fail.file_name` | string | Name of the resource | | `fail.file` | string | Output field: fail.file | | `meta` | object | Output field: meta | | `meta.status` | number | Status value | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.pageSize` | number | Output field: meta.pagination.pageSize | | `meta.pagination.next` | string | Output field: meta.pagination.next | | `data` | array | Response data | | `data.attachmentLogs` | array | Response data | | `data.attachmentLogs.result` | string | Response data | | `data.attachmentLogs.date` | string | Response data | | `data.attachmentLogs.senderAddress` | string | Response data | | `data.attachmentLogs.fileName` | string | Response data | | `data.attachmentLogs.actiontriggered` | string | Response data | | `data.attachmentLogs.route` | string | Response data | | `data.attachmentLogs.details` | string | Response data | | `data.attachmentLogs.recipientAddress` | string | Response data | | `data.attachmentLogs.fileType` | string | Response data | | `data.attachmentLogs.fileHash` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"fail":[],"meta":{"status":200,"pagination":{}},"data":[{}]}}` ## Create Remediation Incident Initiate a new remediation incident in Mimecast Security using specified data parameters. ### Endpoint - **URL:** `/api/ttp/remediation/create` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ---------------------------------------------------- | | `data` | array | Optional | Response data | | `data.reason` | string | Required | The reason for the remediation incident. | | `data.searchBy` | string | Required | The field to search by. | | `data.hashOrMessageId` | string | Optional | The hash or message ID to search by. | | `data.end` | string | Optional | The end date and time of the remediation incident. | | `data.url` | string | Optional | The URL to remediate. | | `data.start` | string | Optional | The start date and time of the remediation incident. | ### Input Example `{"json_body":{"data":[{"reason":"Remediate by URL","searchBy":"hash","hashOrMessageId":["c6617708516e3"],"end":"2022-01-22T00:00:00+00:00","url":"https://www.domain.tld/path/to/unwanted/content","start":"2022-01-20T00:00:00+00:00"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.id` | string | Response data | | `data.code` | string | Response data | | `data.create` | string | Response data | | `data.failed` | number | Response data | | `data.fileRemediationCanBeCancelled` | boolean | Response data | | `data.fileRemediationCancelled` | string | Response data | | `data.fileRemediationExpiryTime` | string | Response data | | `data.identified` | number | Response data | | `data.modified` | string | Response data | | `data.reason` | string | Response data | | `data.remediatedBy` | string | Response data | | `data.removeFromDevice` | string | Response data | | `data.restored` | number | Response data | | `data.searchCriteria` | object | Response data | | `data.searchCriteria.end` | string | Response data | | `data.searchCriteria.fileHash` | string | Response data | | `data.searchCriteria.from` | string | Response data | | `data.searchCriteria.messageId` | string | Response data | | `data.searchCriteria.restoreCode` | string | Response data | | `data.searchCriteria.start` | string | Response data | | `data.searchCriteria.subject` | string | Response data | | `data.searchCriteria.to` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 10 Jun 2025 10:09:08 GMT","content-type":"application/json","cache-control":"no-store","pragma":"no-cache","x-robots-tag":"noindex, nofollow","content-encoding":"gzip","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"48b4c8e7-6150-45a4-bd51-a86d8d0372d0","via":"1.1 google","transfer-encoding":"chunked"},"reason":"OK","json_body":{"data":[{}],"fail":[...` ## Get Remediation Incident Retrieve detailed information about a specific remediation incident in Mimecast Security using the provided data. ### Endpoint - **URL:** `/api/ttp/remediation/get-incident` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.id` | string | Required | Response data | ### Input Example `{"json_body":{"data":[{"id":"incidentIDString"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.id` | string | Response data | | `data.code` | string | Response data | | `data.create` | string | Response data | | `data.failed` | number | Response data | | `data.identified` | number | Response data | | `data.modified` | string | Response data | | `data.reason` | string | Response data | | `data.restored` | number | Response data | | `data.searchCriteria` | object | Response data | | `data.searchCriteria.end` | string | Response data | | `data.searchCriteria.fileHash` | string | Response data | | `data.searchCriteria.from` | string | Response data | | `data.searchCriteria.messageId` | string | Response data | | `data.searchCriteria.messageIds` | array | Response data | | `data.searchCriteria.restoreCode` | string | Response data | | `data.searchCriteria.start` | string | Response data | | `data.searchCriteria.to` | string | Response data | | `data.searchCriteria.unremediateCode` | string | Response data | | `data.successful` | number | Response data | | `data.type` | string | Response data | | `fail` | array | Output field: fail | | `fail.errors` | array | Error message if any | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 10 Jun 2025 10:09:08 GMT","content-type":"application/json","cache-control":"no-store","pragma":"no-cache","x-robots-tag":"noindex, nofollow","content-encoding":"gzip","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"48b4c8e7-6150-45a4-bd51-a86d8d0372d0","via":"1.1 google","transfer-encoding":"chunked"},"reason":"OK","json_body":{"data":[{}],"fail":[...` ## Find Incidents Locate existing remediation incidents in Mimecast Security using optional search criteria. Requires a JSON body with data. ### Endpoint - **URL:** `/api/ttp/remediation/find-incidents` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.start` | string | Optional | Response data | | `data.searchBy` | array | Optional | Response data | | `data.searchBy.fieldName` | string | Optional | Response data | | `data.searchBy.value` | string | Optional | Response data | | `data.end` | string | Optional | Response data | | `data.filterBy` | array | Optional | Response data | | `data.filterBy.fieldName` | string | Optional | Response data | | `data.filterBy.value` | string | Optional | Response data | ### Input Example `{"json_body":{"data":[{"start":"2015-11-16T14:49:18+0000","searchBy":[{"fieldName":"String","value":"String"}],"end":"2015-11-16T14:49:18+0000","filterBy":[{"fieldName":"String","value":"String"}]}]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.incidents` | array | Response data | | `data.incidents.id` | string | Response data | | `data.incidents.code` | string | Response data | | `data.incidents.create` | string | Response data | | `data.incidents.failed` | number | Response data | | `data.incidents.identified` | number | Response data | | `data.incidents.modified` | string | Response data | | `data.incidents.reason` | string | Response data | | `data.incidents.restored` | number | Response data | | `data.incidents.searchCriteria` | object | Response data | | `data.incidents.searchCriteria.end` | string | Response data | | `data.incidents.searchCriteria.fileHash` | string | Response data | | `data.incidents.searchCriteria.from` | string | Response data | | `data.incidents.searchCriteria.messageId` | string | Response data | | `data.incidents.searchCriteria.messageIds` | array | Response data | | `data.incidents.searchCriteria.restoreCode` | string | Response data | | `data.incidents.searchCriteria.start` | string | Response data | | `data.incidents.searchCriteria.to` | string | Response data | | `data.incidents.searchCriteria.unremediateCode` | string | Response data | | `data.incidents.successful` | number | Response data | | `data.incidents.type` | string | Response data | | `fail` | array | Output field: fail | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 10 Jun 2025 10:09:08 GMT","content-type":"application/json","cache-control":"no-store","pragma":"no-cache","x-robots-tag":"noindex, nofollow","content-encoding":"gzip","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"48b4c8e7-6150-45a4-bd51-a86d8d0372d0","via":"1.1 google","transfer-encoding":"chunked"},"reason":"OK","json_body":{"data":[{},{}],"fail...` ## Permit Or Block Sender Permit or block a specified sender in Mimecast Security using provided data. ### Endpoint - **URL:** `/api/managedsender/permit-or-block-sender` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.action` | string | Required | Response data | | `data.to` | string | Required | Response data | | `data.sender` | string | Required | Response data | ### Input Example `{"json_body":{"data":[{"action":"block","to":"admin@mctest.swimlane.com","sender":"test@test.com"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.status` | number | Status value | | `data` | array | Response data | | `data.id` | string | Response data | | `data.sender` | string | Response data | | `data.to` | string | Response data | | `data.type` | string | Response data | | `fail` | array | Output field: fail | | `fail.file_name` | string | Name of the resource | | `fail.file` | string | Output field: fail.file | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 13 Oct 2022 18:33:04 GMT","Content-Type":"application/json","Content-Length":"370","Connection":"keep-alive","Cache-control":"no-store","Pragma":"no-cache","X-Robots-Tag":"noindex, nofollow","X-RateLimit-Limit":"800","X-RateLimit-Remaining":"799","X-RateLimit-Reset":"5000"},"reason":"OK","json_body":{"meta":{"status":200},"data":[{}],"fail":[]}}` ## Message Finder Search Execute a search for messages in Mimecast Security using specified criteria and return matching results. Requires a JSON body with data. ### Endpoint - **URL:** `/api/message-finder/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `data` | array | Optional | Response data | | `data.advancedTrackAndTraceOptions` | object | Optional | Response data | | `data.advancedTrackAndTraceOptions.from` | string | Optional | The sending email address or domain of the messages to track. | | `data.advancedTrackAndTraceOptions.senderIP` | string | Optional | The source IP address of messages to track. | | `data.advancedTrackAndTraceOptions.subject` | string | Optional | The subject of the messages to track. | | `data.advancedTrackAndTraceOptions.to` | string | Optional | The recipient email address or domain of the messages to track. | | `data.advancedTrackAndTraceOptions.url` | string | Optional | An URL from the email content. | | `data.attachments` | boolean | Optional | If set to true then searches for emails with attachments. | | `data.end` | string | Optional | The date and time of the latest message to track, in the following format, 2011-12-03T10:15:30+0000. | | `data.messageId` | string | Optional | The internet message id of the message to track. | | `data.route` | string | Optional | An array of routes to filter by. Possible values are internal, outbound and inbound. | | `data.searchReason` | string | Optional | Reason for Tracking a email, used for activity tracking purposes. | | `data.start` | string | Optional | The date and time of the earliest message to track, in the following format, 2011-12-03T10:15:30+0000. | | `data.status` | string | Optional | An email status to filter by. Email status possible values \{accepted, processing, bulk\_processing, delivery, bulk\_delivery, held, bounced, deferred, rejected and archived}. | ### Input Example `{"json_body":{"data":[{"advancedTrackAndTraceOptions":{"from":"","senderIP":"","subject":"","to":"","url":""},"attachments":true,"end":"2011-12-03T10:15:30+0000","messageId":"","route":"internal","searchReason":"","start":"2011-12-03T10:15:30+0000","status":"accepted"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.status` | number | Status value | | `data` | array | Response data | | `data.trackedEmails` | array | Response data | | `data.trackedEmails.info` | string | Response data | | `data.trackedEmails.id` | string | Response data | | `data.trackedEmails.status` | string | Response data | | `data.trackedEmails.fromEnv` | object | Response data | | `data.trackedEmails.fromEnv.emailAddress` | string | Response data | | `data.trackedEmails.fromHdr` | object | Response data | | `data.trackedEmails.fromHdr.emailAddress` | string | Response data | | `data.trackedEmails.to` | array | Response data | | `data.trackedEmails.to.displayableName` | string | Response data | | `data.trackedEmails.to.emailAddress` | string | Response data | | `data.trackedEmails.received` | string | Response data | | `data.trackedEmails.subject` | string | Response data | | `data.trackedEmails.senderIP` | string | Response data | | `data.trackedEmails.attachments` | boolean | Response data | | `data.trackedEmails.route` | string | Response data | | `data.trackedEmails.sent` | string | Response data | | `data.trackedEmails.spamScore` | number | Response data | | `data.trackedEmails.detectionLevel` | string | Response data | | `fail` | array | Output field: fail | ### Output Example `{"status_code":200,"response_headers":{"date":"Wed, 28 Jan 2026 09:50:17 GMT","content-type":"application/json","cache-control":"no-store","pragma":"no-cache","x-robots-tag":"noindex, nofollow","content-encoding":"gzip","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"960adbb5-57d0-4f99-baef-d8629ac05678","via":"1.1 google","transfer-encoding":"chunked"},"reason":"OK","json_body":{"meta":{"status":200...` ## Get File Download an email attachment from Mimecast's message queue using specified data parameters. ### Endpoint - **URL:** `/api/gateway/message/get-file` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.id` | string | Required | Response data | ### Input Example `{"json_body":{"data":[{"id":"eNpVkOtv2jAUxf-VKV-hw4_YsdlDiqBqh7ah0lLYhIT8uIEsTxKHQaf973NKtW5frOt7js756f4KWjBdA6kNxkE635-bqslWN4P54viJTx-qzeh4O1EHmd0VyeT0OF3lP2ZfnhzjWTa9MdezZQ0D_LjovmXXR7LejKrDXfdwNvhrdoq5WDez3edTt1jDUjhE7-e3590pPqYxG_z8EAyDJjGCkNZ1WgfjssvzYVBA26od5FWVdbWrMig9mCBMKhlqZCVOSJIkRFCNQ4UZUGWsthZpRDG86zMuD0GEYEQYkogxGfHwH803K-eU2RdQunavCOO-hGARKom4EkmEGOFSAwLLmSbMIDAWpLFU-6W2ymrAIHgoiYoMoIgaSnxqUhY-aJWW39P6Tfxa8fYprf8rTdL8cnL8l5IjFkqMe5tx6fEiT5b3MY5ixsSWCyGIZISybdc6aIpwixDdvreQe3dzvjp00MHVy_0-9jSF8xGqrvPUKJdW5WZ04fD21n-DMR4GrrTgXT7KC64o-9aXfL8wfqwKaEz17HrF8dpz37bHZIhSLD1f9PsPUeq6Qg"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.status` | number | Status value | | `data` | array | Response data | | `data.urls` | array | Response data | | `fail` | array | Output field: fail | | `fail.file_name` | string | Name of the resource | | `fail.file` | string | Output field: fail.file | ### Output Example `{"status_code":200,"response_headers":{"date":"Wed, 11 Jun 2025 17:32:48 GMT","content-type":"application/json","cache-control":"no-store","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"53346ffa-a419-4d9b-957c-33ac460010d9","via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000","Transfer-Encoding":"chunked"},"reason":"OK","json_body":{"meta":{"status":200},"data":[{}],"fai...` ## Get Message Info Retrieve detailed information about a specific message in Mimecast using the provided data parameters. ### Endpoint - **URL:** `/api/message-finder/get-message-info` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.id` | string | Required | Response data | ### Input Example `{"json_body":{"data":[{"id":"eNpVzl0LgjAYBeD_smshzc1c0EUkpFKhlaEQhB9v-VGT3ObI6L9nl10_53DOG3HIZQdVgeZI1WJThucJX7Z-4A9Bo_uZbazqcGMNjsJ8bdUKjun1tI-SaZylibsPZ3HOQR6yoMHurhdl00tqVsvzhDgv3nPmEpbFSVTlxFO3wVZsKyR1gtxbIA2V9-L5W8aUEmwYhOoaEg_2-yK5gO6Bx1APHa9ahubGiKyAEXXdHOEpQcLlv__5AqaPQs0"}]}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.deliveredMessage` | object | Response data | | `data.deliveredMessage.ullamco6` | object | Response data | | `data.deliveredMessage.ullamco6.messageInfo` | object | Response data | | `data.deliveredMessage.ullamco6.messageInfo.attachments` | array | Response data | | `data.deliveredMessage.ullamco6.messageInfo.cc` | array | Response data | | `data.deliveredMessage.ullamco6.messageInfo.contentExpiration` | string | Response data | | `data.deliveredMessage.ullamco6.messageInfo.fromEnvelope` | string | Response data | | `data.deliveredMessage.ullamco6.messageInfo.fromHeader` | string | Response data | | `data.deliveredMessage.ullamco6.messageInfo.htmlBody` | string | Response data | | `data.deliveredMessage.ullamco6.messageInfo.metadataExpiration` | string | Response data | | `data.deliveredMessage.ullamco6.messageInfo.processed` | string | Response data | | `data.deliveredMessage.ullamco6.messageInfo.route` | string | Response data | | `data.deliveredMessage.ullamco6.messageInfo.sent` | string | Response data | | `data.deliveredMessage.ullamco6.messageInfo.subject` | string | Response data | | `data.deliveredMessage.ullamco6.messageInfo.textBody` | string | Response data | | `data.deliveredMessage.ullamco6.messageInfo.to` | array | Response data | | `data.deliveredMessage.ullamco6.messageInfo.transmissionInfo` | string | Response data | | `data.deliveredMessage.ullamco6.policyInfo` | array | Response data | | `data.deliveredMessage.ullamco6.policyInfo.policyType` | string | Response data | | `data.deliveredMessage.ullamco6.policyInfo.policyName` | string | Response data | | `data.deliveredMessage.ullamco6.policyInfo.inherited` | string | Response data | | `data.deliveredMessage.ullamco6.deliveryMetaInfo` | object | Response data | ### Output Example `{"data":[{"deliveredMessage":{},"id":"12345678-1234-1234-1234-123456789abc","recipientInfo":{},"retentionInfo":{},"spamInfo":{},"status":"active"}],"fail":[{"file_name":"Example Name","file":"string"}]}` ## Policy Update Update an existing Address Alteration Policy in Mimecast Security using specified data parameters. ### Endpoint - **URL:** `/api/policy/address-alteration/update-policy` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.id` | string | Optional | Response data | | `data.addressAlterationSetId` | string | Optional | Response data | | `data.policy` | object | Optional | Response data | | `data.policy.bidirectional` | boolean | Optional | Response data | | `data.policy.comment` | string | Optional | Response data | | `data.policy.conditions` | object | Optional | Response data | | `data.policy.conditions.sourceIPs` | array | Optional | Response data | | `data.policy.description` | string | Optional | Response data | | `data.policy.enabled` | boolean | Optional | Response data | | `data.policy.enforced` | boolean | Optional | Response data | | `data.policy.from` | object | Optional | Response data | | `data.policy.from.attribute` | object | Optional | Response data | | `data.policy.from.attribute.id` | string | Optional | Response data | | `data.policy.from.attribute.name` | string | Optional | Response data | | `data.policy.from.attribute.value` | string | Optional | Response data | | `data.policy.from.emailAddress` | string | Optional | Response data | | `data.policy.from.emailDomain` | string | Optional | Response data | | `data.policy.from.groupId` | string | Optional | Response data | | `data.policy.from.type` | string | Optional | Response data | | `data.policy.fromDate` | string | Optional | Response data | | `data.policy.fromEternal` | boolean | Optional | Response data | | `data.policy.fromPart` | string | Optional | Response data | | `data.policy.override` | boolean | Optional | Response data | | `data.policy.to` | object | Optional | Response data | ### Input Example `{"json_body":{"data":[{"id":"eNpFjkuLwjAYRf9LtlpI0jZVd07VOjPgpqNCN6Gkn0mwD8mjo4j_faIgs7mbc8_l3pEF4Q3oBi0QEzf57WPTn1W1r3briWpPVH7NNTU-T9qiV2W1WeWFjO1xezhd3Yc-km1-rX8V_pTZDk1RB9bWEkpXO29_bhcIs7URSo_QBCy8dUMHRgzNk-T7ckmyZZrOAhvBWD30aEGmb-X1SnIRAfcWE04zwscmZEQS_i9zimmKWSgkoefAdEmEMYsInccsY_EMY_T4A6fESWU","addressAlterationSetId":"eNpFjkuLwjAYRf9LtlpI0jZVd07VOjPgpqNCN6Gkn0mwD8mjo4j_faIgs7mbc8_l3pEF4Q3oBi0QEzf57WPTn1W1r3briWpPVH7NNTU-T9qiV2W1WeWFjO1xezhd3Yc-km1-rX8V_pTZDk1RB9bWEkpXO29_bhcIs7URSo_QBCy8dUMHRgzNk-T7ckmyZZrOAhvBWD30aEGmb-X1SnIRAfcWE04zwscmZEQS_i9zimmKWSgkoefAdEmEMYsInccsY_EMY_T4A6fESWU","policy":{"bidirectional":true,"comment":"This is a test comment","conditions":{"sourceIPs":["192.168.1.1","192.168.1.2"]},"description":"This is a test description","enabled":true,"enforced":true,"from":{"attribute":{"id":"1234567890","name":"This is a test name","value":"This is a test value"},"emailAddress":"test@example.com","emailDomain":"example.com","groupId":"1234567890","type":"profile_group"},"fromDate":"2021-01-01","fromEternal":true,"fromPart":"both","override":true,"to":{"attribute":{"id":"1234567890","name":"This is a test name","value":"This is a test value"},"emailAddress":"test@example.com","emailDomain":"example.com","groupId":"1234567890","type":"internal_addresses"},"toDate":"2021-01-01","toEternal":true}}]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.addressAlterationSetId` | string | Response data | | `data.id` | string | Response data | | `data.policy` | object | Response data | | `data.policy.bidirectional` | boolean | Response data | | `data.policy.conditions` | object | Response data | | `data.policy.conditions.sourceIPs` | array | Response data | | `data.policy.createTime` | string | Response data | | `data.policy.description` | string | Response data | | `data.policy.enabled` | boolean | Response data | | `data.policy.enforced` | boolean | Response data | | `data.policy.from` | object | Response data | | `data.policy.from.attribute` | object | Response data | | `data.policy.from.attribute.id` | string | Response data | | `data.policy.from.attribute.name` | string | Response data | | `data.policy.from.attribute.value` | string | Response data | | `data.policy.from.emailAddress` | string | Response data | | `data.policy.from.emailDomain` | string | Response data | | `data.policy.from.group` | object | Response data | | `data.policy.from.group.description` | string | Response data | | `data.policy.from.group.folderCount` | number | Response data | | `data.policy.from.group.id` | string | Response data | | `data.policy.from.group.parentId` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 17 Jun 2025 05:48:58 GMT","content-type":"application/json","cache-control":"no-store","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"ad48d523-1983-492a-91d4-c2e1eb97cbac","via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000","Transfer-Encoding":"chunked"},"reason":"OK","json_body":{"data":[{}],"fail":[]}}` ## Create Block Sender Policy Establish new blocked sender policies in Mimecast Security, managing sender and recipient restrictions with specified data. ### Endpoint - **URL:** `/api/policy/blockedsenders/create-policy` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------ | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.option` | string | Optional | Response data | | `data.policy` | object | Optional | Response data | | `data.policy.bidirectional` | boolean | Optional | Response data | | `data.policy.comment` | string | Optional | Response data | | `data.policy.conditions` | object | Optional | Response data | | `data.policy.conditions.sourceIPs` | array | Optional | Response data | | `data.policy.description` | string | Optional | Response data | | `data.policy.enabled` | boolean | Optional | Response data | | `data.policy.enforced` | boolean | Optional | Response data | | `data.policy.from` | object | Optional | Response data | | `data.policy.from.attribute` | object | Optional | Response data | | `data.policy.from.attribute.id` | string | Optional | Response data | | `data.policy.from.attribute.name` | string | Optional | Response data | | `data.policy.from.attribute.value` | string | Optional | Response data | | `data.policy.from.emailAddress` | string | Optional | Response data | | `data.policy.from.emailDomain` | string | Optional | Response data | | `data.policy.from.groupId` | string | Optional | Response data | | `data.policy.from.headerDisplayName` | string | Optional | Response data | | `data.policy.from.type` | string | Optional | Response data | | `data.policy.fromDate` | string | Optional | Response data | | `data.policy.fromEternal` | boolean | Optional | Response data | | `data.policy.fromPart` | string | Optional | Response data | | `data.policy.override` | boolean | Optional | Response data | | `data.policy.to` | object | Optional | Response data | ### Input Example `{"json_body":{"data":[{"option":"no_action","policy":{"bidirectional":true,"comment":"This is a test comment","conditions":{"sourceIPs":["192.168.1.1","192.168.1.2"]},"description":"This is a test description","enabled":true,"enforced":true,"from":{"attribute":{"id":"1234567890","name":"This is a test name","value":"This is a test value"},"emailAddress":"test@example.com","emailDomain":"example.com","groupId":"1234567890","headerDisplayName":"This is a test header display name","type":"email_domain"},"fromDate":"2021-01-01","fromEternal":true,"fromPart":"envelope_from","override":true,"to":{"attribute":{"id":"1234567890","name":"This is a test name","value":"This is a test value"},"emailAddress":"test@example.com","emailDomain":"example.com","groupId":"1234567890","headerDisplayName":"This is a test header display name","type":"everyone"},"toDate":"2021-01-01","toEternal":true}}]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.id` | string | Response data | | `data.option` | string | Response data | | `data.policy` | object | Response data | | `data.policy.bidirectional` | boolean | Response data | | `data.policy.comment` | string | Response data | | `data.policy.conditions` | object | Response data | | `data.policy.conditions.sourceIPs` | array | Response data | | `data.policy.createTime` | string | Response data | | `data.policy.description` | string | Response data | | `data.policy.enabled` | boolean | Response data | | `data.policy.enforced` | boolean | Response data | | `data.policy.from` | object | Response data | | `data.policy.from.attribute` | object | Response data | | `data.policy.from.attribute.id` | string | Response data | | `data.policy.from.attribute.name` | string | Response data | | `data.policy.from.attribute.value` | string | Response data | | `data.policy.from.device` | object | Response data | | `data.policy.from.device.description` | string | Response data | | `data.policy.from.device.folderCount` | number | Response data | | `data.policy.from.device.folders` | array | Response data | | `data.policy.from.device.id` | string | Response data | | `data.policy.from.device.parentId` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 17 Jun 2025 05:48:58 GMT","content-type":"application/json","cache-control":"no-store","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"ad48d523-1983-492a-91d4-c2e1eb97cbac","via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000","Transfer-Encoding":"chunked"},"reason":"OK","json_body":{"data":[{}],"fail":[]}}` ## Create Managed URL Add a specified URL to Mimecast's managed list for Targeted Threat Protection using provided data parameters. ### Endpoint - **URL:** `/api/ttp/url/create-managed-url` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.matchType` | string | Optional | Response data | | `data.disableRewrite` | boolean | Optional | Response data | | `data.action` | string | Required | Response data | | `data.comment` | string | Optional | Response data | | `data.disableUserAwareness` | boolean | Optional | Response data | | `data.url` | string | Required | Response data | | `data.disableLogClick` | boolean | Optional | Response data | ### Input Example `{"json_body":{"data":[{"matchType":"explicit","disableRewrite":false,"action":"block","comment":"This is a comment","disableUserAwareness":false,"url":"https://example.com","disableLogClick":false}]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.action` | object | Response data | | `data.action.name` | string | Response data | | `data.action.ordinal` | number | Response data | | `data.action.whitelist` | boolean | Response data | | `data.comment` | string | Response data | | `data.disableLogClick` | boolean | Response data | | `data.disableRewrite` | boolean | Response data | | `data.disableUserAwareness` | boolean | Response data | | `data.domain` | string | Response data | | `data.id` | string | Response data | | `data.matchType` | object | Response data | | `data.matchType.matchType` | object | Response data | | `data.matchType.matchType.id` | number | Response data | | `data.matchType.matchType.name` | string | Response data | | `data.matchType.matchType.ordinal` | number | Response data | | `data.matchType.name` | string | Response data | | `data.matchType.ordinal` | number | Response data | | `data.path` | string | Response data | | `data.port` | number | Response data | | `data.queryString` | string | Response data | | `data.scheme` | string | Response data | | `fail` | array | Output field: fail | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 17 Jun 2025 05:48:58 GMT","content-type":"application/json","cache-control":"no-store","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"ad48d523-1983-492a-91d4-c2e1eb97cbac","via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000","Transfer-Encoding":"chunked"},"reason":"OK","json_body":{"data":[{}],"fail":[]}}` ## Decode URL Decode Mimecast's Threat Protection URLs to their original form using the 'data' parameter for input. ### Endpoint - **URL:** `/api/ttp/url/decode-url` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.url` | string | Required | Response data | ### Input Example `{"json_body":{"data":[{"url":"example.com"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.status` | number | Status value | | `data` | array | Response data | | `data.url` | string | Response data | | `data.success` | boolean | Response data | | `fail` | array | Output field: fail | | `fail.file_name` | string | Name of the resource | | `fail.file` | string | Output field: fail.file | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 10 Oct 2022 18:22:06 GMT","Content-Type":"application/json","Content-Length":"79","Connection":"keep-alive","Cache-control":"no-store","Pragma":"no-cache","X-Robots-Tag":"noindex, nofollow","X-RateLimit-Limit":"800","X-RateLimit-Remaining":"799","X-RateLimit-Reset":"5000"},"reason":"OK","json_body":{"meta":{"status":200},"data":[{}],"fail":[]}}` ## Get Managed URLs Retrieve all managed URLs or domains from Mimecast Security using the specified 'data' query parameter. ### Endpoint - **URL:** `/api/ttp/url/get-all-managed-urls` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.domainOrComment` | string | Optional | Response data | | `data.domainOrUrl` | string | Required | Response data | | `data.exactMatch` | boolean | Optional | Response data | | `data.filterBy` | array | Optional | Response data | | `data.filterBy.fieldName` | string | Optional | Response data | | `data.filterBy.value` | string | Optional | Response data | | `data.sortByUrl` | boolean | Optional | Response data | | `data.sortOrder` | string | Optional | Response data | ### Input Example `{"json_body":{"data":[{"domainOrComment":"This is a test comment","domainOrUrl":"example.com","exactMatch":true,"filterBy":[{"fieldName":"This is a test field name","value":"This is a test value"},{"fieldName":"This is a test field name","value":"This is a test value"}],"sortByUrl":true,"sortOrder":"asc"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.action` | object | Response data | | `data.action.name` | string | Response data | | `data.action.ordinal` | number | Response data | | `data.action.whitelist` | boolean | Response data | | `data.comment` | string | Response data | | `data.disableLogClick` | boolean | Response data | | `data.disableRewrite` | boolean | Response data | | `data.disableUserAwareness` | boolean | Response data | | `data.domain` | string | Response data | | `data.id` | string | Response data | | `data.matchType` | object | Response data | | `data.matchType.matchType` | object | Response data | | `data.matchType.matchType.id` | number | Response data | | `data.matchType.matchType.name` | string | Response data | | `data.matchType.matchType.ordinal` | number | Response data | | `data.matchType.name` | string | Response data | | `data.matchType.ordinal` | number | Response data | | `data.path` | string | Response data | | `data.port` | number | Response data | | `data.queryString` | string | Response data | | `data.scheme` | string | Response data | | `fail` | array | Output field: fail | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 17 Jun 2025 05:48:58 GMT","content-type":"application/json","cache-control":"no-store","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"ad48d523-1983-492a-91d4-c2e1eb97cbac","via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000","Transfer-Encoding":"chunked"},"reason":"OK","json_body":{"data":[{}],"fail":[]}}` ## Get TTP URL Logs Fetch log data for URLs processed by Mimecast's Targeted Threat Protection service using the 'data' parameter. ### Endpoint - **URL:** `/api/ttp/url/get-logs` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.oldestFirst` | boolean | Optional | Response data | | `data.from` | string | Optional | Response data | | `data.route` | string | Optional | Response data | | `data.to` | string | Optional | Response data | | `data.scanResult` | string | Optional | Response data | ### Input Example `{"json_body":{"data":[{"oldestFirst":false,"from":"2016-10-01T14:49:18+0000","route":"all","to":"2017-10-13T23:59:59+0000","scanResult":"all"}]}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.clickLogs` | array | Response data | | `data.clickLogs.action` | string | Response data | | `data.clickLogs.actions` | string | Response data | | `data.clickLogs.adminOverride` | string | Response data | | `data.clickLogs.advancedPhishingResult` | object | Response data | | `data.clickLogs.category` | string | Response data | | `data.clickLogs.creationMethod` | string | Response data | | `data.clickLogs.date` | string | Response data | | `data.clickLogs.emailPartsDescription` | array | Response data | | `data.clickLogs.fromUserEmailAddress` | string | Response data | | `data.clickLogs.heuristicDomainSource` | string | Response data | | `data.clickLogs.messageId` | string | Response data | | `data.clickLogs.route` | string | Response data | | `data.clickLogs.scanResult` | string | Response data | | `data.clickLogs.sendingIp` | string | Response data | | `data.clickLogs.similarDomain` | string | Response data | | `data.clickLogs.subject` | string | Response data | | `data.clickLogs.tagMap` | object | Response data | | `data.clickLogs.ttpDefinition` | string | Response data | | `data.clickLogs.url` | string | Response data | | `data.clickLogs.userAwarenessAction` | string | Response data | | `data.clickLogs.userEmailAddress` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"date":"Tue, 17 Jun 2025 05:48:58 GMT","content-type":"application/json","cache-control":"no-store","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"SAMEORIGIN","referrer-policy":"same-origin","x-request-id":"ad48d523-1983-492a-91d4-c2e1eb97cbac","via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000","Transfer-Encoding":"chunked"},"reason":"OK","json_body":{"data":[{}],"fail":[]}}` ## Get TTP Impersonation Protect Logs Retrieve logs of impersonation attempts from Mimecast Security using specified data parameters. ### Endpoint - **URL:** `/api/ttp/impersonation/get-logs` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | --------------- | | `data` | array | Optional | Response data | | `data.actions` | array | Optional | Response data | | `data.from` | string | Optional | Response data | | `data.identifiers` | array | Optional | Response data | | `data.oldestFirst` | boolean | Optional | Response data | | `data.query` | string | Optional | Response data | | `data.searchField` | string | Optional | Response data | | `data.taggedMalicious` | boolean | Optional | Response data | | `data.to` | string | Optional | Response data | ### Input Example `{"json_body":{"data":[{"actions":["hold","bounce"],"from":"2022-10-13T16:57:02+0000","identifiers":["newly_observed_domain","internal_user_name"],"oldestFirst":true,"query":"This is a test query","searchField":"subject","taggedMalicious":true,"to":"2022-10-13T16:57:02+0000"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ----------------------------------------------------------------- | ---------------------------------------------- | | Alt-Svc | HTTP response header: Alt-Svc | h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 | | cache-control | Directives for caching mechanisms | no-store | | Connection | HTTP response header: Connection | keep-alive | | content-encoding | HTTP response header: content-encoding | gzip | | Content-Length | The length of the response body in bytes | 79 | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Mon, 24 Oct 2022 21:18:56 GMT | | pragma | HTTP response header: pragma | no-cache | | referrer-policy | HTTP response header: referrer-policy | same-origin | | strict-transport-security | HTTP response header: strict-transport-security | max-age=31536000; includeSubDomains | | transfer-encoding | HTTP response header: transfer-encoding | chunked | | via | HTTP response header: via | 1.1 google | | x-frame-options | HTTP response header: x-frame-options | SAMEORIGIN | | X-RateLimit-Limit | The number of requests allowed in the current rate limit window | 800 | | X-RateLimit-Remaining | The number of requests remaining in the current rate limit window | 799 | | X-RateLimit-Reset | The time at which the current rate limit window resets | 5000 | | x-request-id | A unique identifier for the request | 793b7425-5352-48ef-9b2c-eb9a5e4aed6a | | x-robots-tag | HTTP response header: x-robots-tag | noindex, nofollow |