cloudflare 6.0.0-beta.2 → 6.0.0

package/resources/email-security/investigate/detections.js

@@ -3,14 +3,23 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Detections = void 0;
 const resource_1 = require("../../../resource.js");
-const core_1 = require("../../../core.js");
 class Detections extends resource_1.APIResource {
-    get(postfixId, params = {}, options) {
-        if ((0, core_1.isRequestOptions)(params)) {
-            return this.get(postfixId, {}, params);
-        }
-        const { account_id = this._client.accountId } = params;
-        return this._client.get(`/accounts/${account_id}/email-security/investigate/${postfixId}/detections`, options)._thenUnwrap((obj) => obj.result);
+    /**
+     * Returns detection details such as threat categories and sender information for
+     * non-benign messages.
+     *
+     * @example
+     * ```ts
+     * const detection =
+     *   await client.emailSecurity.investigate.detections.get(
+     *     '4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678',
+     *     { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
+     *   );
+     * ```
+     */
+    get(investigateId, params, options) {
+        const { account_id } = params;
+        return this._client.get(`/accounts/${account_id}/email-security/investigate/${investigateId}/detections`, options)._thenUnwrap((obj) => obj.result);
     }
 }
 exports.Detections = Detections;

package/resources/email-security/investigate/detections.js.map

@@ -1 +1 @@
-{"version":3,"file":"detections.js","sourceRoot":"","sources":["../../../src/resources/email-security/investigate/detections.ts"],"names":[],"mappings":";AAAA,sFAAsF;;;AAEtF,mDAAgD;AAChD,2CAAiD;AAGjD,MAAa,UAAW,SAAQ,sBAAW;IAoBzC,GAAG,CACD,SAAiB,EACjB,SAAmD,EAAE,EACrD,OAA6B;QAE7B,IAAI,IAAA,uBAAgB,EAAC,MAAM,CAAC,EAAE;YAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;SACxC;QACD,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC;QACvD,OACE,IAAI,CAAC,OAAO,CAAC,GAAG,CACd,aAAa,UAAU,+BAA+B,SAAS,aAAa,EAC5E,OAAO,CAEV,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;CACF;AApCD,gCAoCC"}
+{"version":3,"file":"detections.js","sourceRoot":"","sources":["../../../src/resources/email-security/investigate/detections.ts"],"names":[],"mappings":";AAAA,sFAAsF;;;AAEtF,mDAAgD;AAGhD,MAAa,UAAW,SAAQ,sBAAW;IACzC;;;;;;;;;;;;OAYG;IACH,GAAG,CACD,aAAqB,EACrB,MAA0B,EAC1B,OAA6B;QAE7B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;QAC9B,OACE,IAAI,CAAC,OAAO,CAAC,GAAG,CACd,aAAa,UAAU,+BAA+B,aAAa,aAAa,EAChF,OAAO,CAEV,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;CACF;AA3BD,gCA2BC"}

package/resources/email-security/investigate/detections.mjs

@@ -1,13 +1,22 @@
 // File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 import { APIResource } from "../../../resource.mjs";
-import { isRequestOptions } from "../../../core.mjs";
 export class Detections extends APIResource {
-    get(postfixId, params = {}, options) {
-        if (isRequestOptions(params)) {
-            return this.get(postfixId, {}, params);
-        }
-        const { account_id = this._client.accountId } = params;
-        return this._client.get(`/accounts/${account_id}/email-security/investigate/${postfixId}/detections`, options)._thenUnwrap((obj) => obj.result);
+    /**
+     * Returns detection details such as threat categories and sender information for
+     * non-benign messages.
+     *
+     * @example
+     * ```ts
+     * const detection =
+     *   await client.emailSecurity.investigate.detections.get(
+     *     '4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678',
+     *     { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
+     *   );
+     * ```
+     */
+    get(investigateId, params, options) {
+        const { account_id } = params;
+        return this._client.get(`/accounts/${account_id}/email-security/investigate/${investigateId}/detections`, options)._thenUnwrap((obj) => obj.result);
     }
 }
 //# sourceMappingURL=detections.mjs.map

package/resources/email-security/investigate/detections.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"detections.mjs","sourceRoot":"","sources":["../../../src/resources/email-security/investigate/detections.ts"],"names":[],"mappings":"AAAA,sFAAsF;OAE/E,EAAE,WAAW,EAAE;OACf,EAAE,gBAAgB,EAAE;AAG3B,MAAM,OAAO,UAAW,SAAQ,WAAW;IAoBzC,GAAG,CACD,SAAiB,EACjB,SAAmD,EAAE,EACrD,OAA6B;QAE7B,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE;YAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;SACxC;QACD,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC;QACvD,OACE,IAAI,CAAC,OAAO,CAAC,GAAG,CACd,aAAa,UAAU,+BAA+B,SAAS,aAAa,EAC5E,OAAO,CAEV,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;CACF"}
+{"version":3,"file":"detections.mjs","sourceRoot":"","sources":["../../../src/resources/email-security/investigate/detections.ts"],"names":[],"mappings":"AAAA,sFAAsF;OAE/E,EAAE,WAAW,EAAE;AAGtB,MAAM,OAAO,UAAW,SAAQ,WAAW;IACzC;;;;;;;;;;;;OAYG;IACH,GAAG,CACD,aAAqB,EACrB,MAA0B,EAC1B,OAA6B;QAE7B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;QAC9B,OACE,IAAI,CAAC,OAAO,CAAC,GAAG,CACd,aAAa,UAAU,+BAA+B,aAAa,aAAa,EAChF,OAAO,CAEV,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;CACF"}

package/resources/email-security/investigate/index.d.ts

@@ -1,6 +1,6 @@
 export { Detections, type DetectionGetResponse, type DetectionGetParams } from "./detections.js";
 export { InvestigateListResponsesV4PagePaginationArray, Investigate, type InvestigateListResponse, type InvestigateGetResponse, type InvestigateListParams, type InvestigateGetParams, } from "./investigate.js";
-export { MoveBulkResponsesSinglePage, Move, type MoveCreateResponse, type MoveBulkResponse, type MoveCreateParams, type MoveBulkParams, } from "./move.js";
+export { MoveCreateResponsesSinglePage, MoveBulkResponsesSinglePage, Move, type MoveCreateResponse, type MoveBulkResponse, type MoveCreateParams, type MoveBulkParams, } from "./move.js";
 export { Preview, type PreviewCreateResponse, type PreviewGetResponse, type PreviewCreateParams, type PreviewGetParams, } from "./preview.js";
 export { Raw, type RawGetResponse, type RawGetParams } from "./raw.js";
 export { Reclassify, type ReclassifyCreateResponse, type ReclassifyCreateParams } from "./reclassify.js";

package/resources/email-security/investigate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/resources/email-security/investigate/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,KAAK,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC9F,OAAO,EACL,6CAA6C,EAC7C,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,2BAA2B,EAC3B,IAAI,EACJ,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,cAAc,GACpB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,OAAO,EACP,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,GAAG,EAAE,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,KAAK,wBAAwB,EAAE,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtG,OAAO,EACL,8BAA8B,EAC9B,OAAO,EACP,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,KAAK,EAAE,KAAK,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/resources/email-security/investigate/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,KAAK,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC9F,OAAO,EACL,6CAA6C,EAC7C,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,IAAI,EACJ,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,cAAc,GACpB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,OAAO,EACP,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,GAAG,EAAE,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,KAAK,wBAAwB,EAAE,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtG,OAAO,EACL,8BAA8B,EAC9B,OAAO,EACP,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,KAAK,EAAE,KAAK,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC"}

package/resources/email-security/investigate/index.js

@@ -1,13 +1,14 @@
 "use strict";
 // File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Trace = exports.Release = exports.ReleaseBulkResponsesSinglePage = exports.Reclassify = exports.Raw = exports.Preview = exports.Move = exports.MoveBulkResponsesSinglePage = exports.Investigate = exports.InvestigateListResponsesV4PagePaginationArray = exports.Detections = void 0;
+exports.Trace = exports.Release = exports.ReleaseBulkResponsesSinglePage = exports.Reclassify = exports.Raw = exports.Preview = exports.Move = exports.MoveBulkResponsesSinglePage = exports.MoveCreateResponsesSinglePage = exports.Investigate = exports.InvestigateListResponsesV4PagePaginationArray = exports.Detections = void 0;
 var detections_1 = require("./detections.js");
 Object.defineProperty(exports, "Detections", { enumerable: true, get: function () { return detections_1.Detections; } });
 var investigate_1 = require("./investigate.js");
 Object.defineProperty(exports, "InvestigateListResponsesV4PagePaginationArray", { enumerable: true, get: function () { return investigate_1.InvestigateListResponsesV4PagePaginationArray; } });
 Object.defineProperty(exports, "Investigate", { enumerable: true, get: function () { return investigate_1.Investigate; } });
 var move_1 = require("./move.js");
+Object.defineProperty(exports, "MoveCreateResponsesSinglePage", { enumerable: true, get: function () { return move_1.MoveCreateResponsesSinglePage; } });
 Object.defineProperty(exports, "MoveBulkResponsesSinglePage", { enumerable: true, get: function () { return move_1.MoveBulkResponsesSinglePage; } });
 Object.defineProperty(exports, "Move", { enumerable: true, get: function () { return move_1.Move; } });
 var preview_1 = require("./preview.js");

package/resources/email-security/investigate/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/resources/email-security/investigate/index.ts"],"names":[],"mappings":";AAAA,sFAAsF;;;AAEtF,8CAA8F;AAArF,wGAAA,UAAU,OAAA;AACnB,gDAOuB;AANrB,4IAAA,6CAA6C,OAAA;AAC7C,0GAAA,WAAW,OAAA;AAMb,kCAOgB;AANd,mHAAA,2BAA2B,OAAA;AAC3B,4FAAA,IAAI,OAAA;AAMN,wCAMmB;AALjB,kGAAA,OAAO,OAAA;AAMT,gCAAoE;AAA3D,0FAAA,GAAG,OAAA;AACZ,8CAAsG;AAA7F,wGAAA,UAAU,OAAA;AACnB,wCAKmB;AAJjB,yHAAA,8BAA8B,OAAA;AAC9B,kGAAA,OAAO,OAAA;AAIT,oCAA4E;AAAnE,8FAAA,KAAK,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/resources/email-security/investigate/index.ts"],"names":[],"mappings":";AAAA,sFAAsF;;;AAEtF,8CAA8F;AAArF,wGAAA,UAAU,OAAA;AACnB,gDAOuB;AANrB,4IAAA,6CAA6C,OAAA;AAC7C,0GAAA,WAAW,OAAA;AAMb,kCAQgB;AAPd,qHAAA,6BAA6B,OAAA;AAC7B,mHAAA,2BAA2B,OAAA;AAC3B,4FAAA,IAAI,OAAA;AAMN,wCAMmB;AALjB,kGAAA,OAAO,OAAA;AAMT,gCAAoE;AAA3D,0FAAA,GAAG,OAAA;AACZ,8CAAsG;AAA7F,wGAAA,UAAU,OAAA;AACnB,wCAKmB;AAJjB,yHAAA,8BAA8B,OAAA;AAC9B,kGAAA,OAAO,OAAA;AAIT,oCAA4E;AAAnE,8FAAA,KAAK,OAAA"}

package/resources/email-security/investigate/index.mjs

@@ -1,7 +1,7 @@
 // File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 export { Detections } from "./detections.mjs";
 export { InvestigateListResponsesV4PagePaginationArray, Investigate, } from "./investigate.mjs";
-export { MoveBulkResponsesSinglePage, Move, } from "./move.mjs";
+export { MoveCreateResponsesSinglePage, MoveBulkResponsesSinglePage, Move, } from "./move.mjs";
 export { Preview, } from "./preview.mjs";
 export { Raw } from "./raw.mjs";
 export { Reclassify } from "./reclassify.mjs";

package/resources/email-security/investigate/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../../src/resources/email-security/investigate/index.ts"],"names":[],"mappings":"AAAA,sFAAsF;OAE/E,EAAE,UAAU,EAAsD;OAClE,EACL,6CAA6C,EAC7C,WAAW,GAKZ;OACM,EACL,2BAA2B,EAC3B,IAAI,GAKL;OACM,EACL,OAAO,GAKR;OACM,EAAE,GAAG,EAA0C;OAC/C,EAAE,UAAU,EAA8D;OAC1E,EACL,8BAA8B,EAC9B,OAAO,GAGR;OACM,EAAE,KAAK,EAA8C"}
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../../src/resources/email-security/investigate/index.ts"],"names":[],"mappings":"AAAA,sFAAsF;OAE/E,EAAE,UAAU,EAAsD;OAClE,EACL,6CAA6C,EAC7C,WAAW,GAKZ;OACM,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,IAAI,GAKL;OACM,EACL,OAAO,GAKR;OACM,EAAE,GAAG,EAA0C;OAC/C,EAAE,UAAU,EAA8D;OAC1E,EACL,8BAA8B,EAC9B,OAAO,GAGR;OACM,EAAE,KAAK,EAA8C"}

package/resources/email-security/investigate/investigate.d.ts

@@ -3,7 +3,7 @@ import * as Core from "../../../core.js";
 import * as DetectionsAPI from "./detections.js";
 import { DetectionGetParams, DetectionGetResponse, Detections } from "./detections.js";
 import * as MoveAPI from "./move.js";
-import { Move, MoveBulkParams, MoveBulkResponse, MoveBulkResponsesSinglePage, MoveCreateParams, MoveCreateResponse } from "./move.js";
+import { Move, MoveBulkParams, MoveBulkResponse, MoveBulkResponsesSinglePage, MoveCreateParams, MoveCreateResponse, MoveCreateResponsesSinglePage } from "./move.js";
 import * as PreviewAPI from "./preview.js";
 import { Preview, PreviewCreateParams, PreviewCreateResponse, PreviewGetParams, PreviewGetResponse } from "./preview.js";
 import * as RawAPI from "./raw.js";
@@ -24,9 +24,7 @@ export declare class Investigate extends APIResource {
     reclassify: ReclassifyAPI.Reclassify;
     release: ReleaseAPI.Release;
     /**
-     * Returns information for each email that matches the search parameter(s). If the
-     * search takes too long, the endpoint returns 202 with a Location header pointing
-     * to a polling endpoint where results can be retrieved once ready.
+     * Returns information for each email that matches the search parameter(s).
      *
      * @example
      * ```ts
@@ -38,86 +36,157 @@ export declare class Investigate extends APIResource {
      * }
      * ```
      */
-    list(params?: InvestigateListParams, options?: Core.RequestOptions): Core.PagePromise<InvestigateListResponsesV4PagePaginationArray, InvestigateListResponse>;
-    list(options?: Core.RequestOptions): Core.PagePromise<InvestigateListResponsesV4PagePaginationArray, InvestigateListResponse>;
+    list(params: InvestigateListParams, options?: Core.RequestOptions): Core.PagePromise<InvestigateListResponsesV4PagePaginationArray, InvestigateListResponse>;
     /**
-     * Retrieves detailed information about a specific email message, including
-     * headers, metadata, and security scan results.
+     * Retrieves comprehensive details for a specific email message including headers,
+     * recipients, sender information, and current quarantine status. Use the
+     * investigate_id from search results to fetch detailed information.
      *
      * @example
      * ```ts
      * const investigate =
      *   await client.emailSecurity.investigate.get(
-     *     '4Njp3P0STMz2c02Q',
+     *     '4Njp3P0STMz2c02Q-2024-01-05T10:00:00-12345678',
      *     { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
      *   );
      * ```
      */
-    get(postfixId: string, params?: InvestigateGetParams, options?: Core.RequestOptions): Core.APIPromise<InvestigateGetResponse>;
-    get(postfixId: string, options?: Core.RequestOptions): Core.APIPromise<InvestigateGetResponse>;
+    get(investigateId: string, params: InvestigateGetParams, options?: Core.RequestOptions): Core.APIPromise<InvestigateGetResponse>;
 }
 export declare class InvestigateListResponsesV4PagePaginationArray extends V4PagePaginationArray<InvestigateListResponse> {
 }
 export interface InvestigateListResponse {
+    /**
+     * Unique identifier for a message retrieved from investigation
+     */
     id: string;
     /**
-     * @deprecated Deprecated: use `/investigate/{id}/action_log` instead.
+     * @deprecated Deprecated, use `GET /investigate/{investigate_id}/action_log`
+     * instead. End of life: November 1, 2026.
      */
-    action_log: unknown;
+    action_log: Array<InvestigateListResponse.ActionLog>;
     client_recipients: Array<string>;
     detection_reasons: Array<string>;
     is_phish_submission: boolean;
     is_quarantined: boolean;
     /**
-     * The identifier of the message.
+     * The identifier of the message
      */
     postfix_id: string;
+    /**
+     * Message processing properties
+     */
     properties: InvestigateListResponse.Properties;
     /**
-     * @deprecated Deprecated, use `scanned_at` instead
+     * @deprecated Deprecated, use `scanned_at` instead. End of life: November 1, 2026.
      */
     ts: string;
     alert_id?: string | null;
-    delivery_mode?: 'DIRECT' | 'BCC' | 'JOURNAL' | 'REVIEW_SUBMISSION' | 'DMARC_UNVERIFIED' | 'DMARC_FAILURE_REPORT' | 'DMARC_AGGREGATE_REPORT' | 'THREAT_INTEL_SUBMISSION' | 'SIMULATION_SUBMISSION' | 'API' | 'RETRO_SCAN' | null;
+    delivery_mode?: 'DIRECT' | 'BCC' | 'JOURNAL' | 'REVIEW_SUBMISSION' | 'DMARC_UNVERIFIED' | 'DMARC_FAILURE_REPORT' | 'DMARC_AGGREGATE_REPORT' | 'THREAT_INTEL_SUBMISSION' | 'SIMULATION_SUBMISSION' | 'API' | 'RETRO_SCAN';
+    delivery_status?: Array<'delivered' | 'moved' | 'quarantined' | 'rejected' | 'deferred' | 'bounced' | 'queued'> | null;
     edf_hash?: string | null;
     envelope_from?: string | null;
     envelope_to?: Array<string> | null;
-    final_disposition?: 'MALICIOUS' | 'MALICIOUS-BEC' | 'SUSPICIOUS' | 'SPOOF' | 'SPAM' | 'BULK' | 'ENCRYPTED' | 'EXTERNAL' | 'UNKNOWN' | 'NONE' | null;
+    final_disposition?: 'MALICIOUS' | 'MALICIOUS-BEC' | 'SUSPICIOUS' | 'SPOOF' | 'SPAM' | 'BULK' | 'ENCRYPTED' | 'EXTERNAL' | 'UNKNOWN' | 'NONE';
     /**
-     * @deprecated Deprecated.
+     * @deprecated Deprecated, use the `findings` field from
+     * `GET /investigate/{investigate_id}/detections` instead. End of life: November
+     * 1, 2026. Detection findings for this message.
      */
     findings?: Array<InvestigateListResponse.Finding> | null;
     from?: string | null;
     from_name?: string | null;
     htmltext_structure_hash?: string | null;
     message_id?: string | null;
-    post_delivery_operations?: Array<'PREVIEW' | 'QUARANTINE_RELEASE' | 'SUBMISSION' | 'MOVE'>;
+    /**
+     * Post-delivery operations performed on this message
+     */
+    post_delivery_operations?: Array<'PREVIEW' | 'QUARANTINE_RELEASE' | 'SUBMISSION' | 'MOVE'> | null;
     postfix_id_outbound?: string | null;
     replyto?: string | null;
-    scanned_at?: string;
-    sent_at?: string;
     /**
-     * @deprecated Deprecated, use `sent_at` instead
+     * When the message was scanned (UTC)
+     */
+    scanned_at?: string | null;
+    /**
+     * When the message was sent (UTC)
      */
+    sent_at?: string | null;
     sent_date?: string | null;
     subject?: string | null;
     threat_categories?: Array<string> | null;
     to?: Array<string> | null;
     to_name?: Array<string> | null;
-    validation?: InvestigateListResponse.Validation | null;
+    validation?: InvestigateListResponse.Validation;
 }
 export declare namespace InvestigateListResponse {
+    interface ActionLog {
+        /**
+         * Timestamp when action completed
+         */
+        completed_at: string;
+        /**
+         * Type of action performed
+         */
+        operation: 'MOVE' | 'RELEASE' | 'RECLASSIFY' | 'SUBMISSION' | 'QUARANTINE_RELEASE' | 'PREVIEW';
+        /**
+         * @deprecated Deprecated, use `completed_at` instead. End of life: November
+         * 1, 2026.
+         */
+        completed_timestamp?: string;
+        /**
+         * Additional properties for the action
+         */
+        properties?: ActionLog.Properties;
+        /**
+         * Status of the action
+         */
+        status?: string | null;
+    }
+    namespace ActionLog {
+        /**
+         * Additional properties for the action
+         */
+        interface Properties {
+            /**
+             * Target folder for move operations
+             */
+            folder?: string;
+            /**
+             * User who requested the action
+             */
+            requested_by?: string;
+        }
+    }
+    /**
+     * Message processing properties
+     */
     interface Properties {
-        allowlisted_pattern?: string;
-        allowlisted_pattern_type?: 'quarantine_release' | 'acceptable_sender' | 'allowed_sender' | 'allowed_recipient' | 'domain_similarity' | 'domain_recency' | 'managed_acceptable_sender' | 'outbound_ndr';
-        blocklisted_message?: boolean;
-        blocklisted_pattern?: string;
-        whitelisted_pattern_type?: 'quarantine_release' | 'acceptable_sender' | 'allowed_sender' | 'allowed_recipient' | 'domain_similarity' | 'domain_recency' | 'managed_acceptable_sender' | 'outbound_ndr';
+        /**
+         * Pattern that allowlisted this message
+         */
+        allowlisted_pattern?: string | null;
+        /**
+         * Type of allowlist pattern
+         */
+        allowlisted_pattern_type?: 'quarantine_release' | 'acceptable_sender' | 'allowed_sender' | 'allowed_recipient' | 'domain_similarity' | 'domain_recency' | 'managed_acceptable_sender' | 'outbound_ndr' | null;
+        /**
+         * Whether message was blocklisted
+         */
+        blocklisted_message?: boolean | null;
+        /**
+         * Pattern that blocklisted this message
+         */
+        blocklisted_pattern?: string | null;
+        /**
+         * Legacy field for allowlist pattern type
+         */
+        whitelisted_pattern_type?: 'quarantine_release' | 'acceptable_sender' | 'allowed_sender' | 'allowed_recipient' | 'domain_similarity' | 'domain_recency' | 'managed_acceptable_sender' | 'outbound_ndr' | null;
     }
     interface Finding {
         attachment?: string | null;
         detail?: string | null;
-        detection?: 'MALICIOUS' | 'MALICIOUS-BEC' | 'SUSPICIOUS' | 'SPOOF' | 'SPAM' | 'BULK' | 'ENCRYPTED' | 'EXTERNAL' | 'UNKNOWN' | 'NONE' | null;
+        detection?: 'MALICIOUS' | 'MALICIOUS-BEC' | 'SUSPICIOUS' | 'SPOOF' | 'SPAM' | 'BULK' | 'ENCRYPTED' | 'EXTERNAL' | 'UNKNOWN' | 'NONE';
         field?: string | null;
         name?: string | null;
         portion?: string | null;
@@ -127,71 +196,143 @@ export declare namespace InvestigateListResponse {
     }
     interface Validation {
         comment?: string | null;
-        dkim?: 'pass' | 'neutral' | 'fail' | 'error' | 'none' | null;
-        dmarc?: 'pass' | 'neutral' | 'fail' | 'error' | 'none' | null;
-        spf?: 'pass' | 'neutral' | 'fail' | 'error' | 'none' | null;
+        dkim?: 'pass' | 'neutral' | 'fail' | 'error' | 'none';
+        dmarc?: 'pass' | 'neutral' | 'fail' | 'error' | 'none';
+        spf?: 'pass' | 'neutral' | 'fail' | 'error' | 'none';
     }
 }
 export interface InvestigateGetResponse {
+    /**
+     * Unique identifier for a message retrieved from investigation
+     */
     id: string;
     /**
-     * @deprecated Deprecated: use `/investigate/{id}/action_log` instead.
+     * @deprecated Deprecated, use `GET /investigate/{investigate_id}/action_log`
+     * instead. End of life: November 1, 2026.
      */
-    action_log: unknown;
+    action_log: Array<InvestigateGetResponse.ActionLog>;
     client_recipients: Array<string>;
     detection_reasons: Array<string>;
     is_phish_submission: boolean;
     is_quarantined: boolean;
     /**
-     * The identifier of the message.
+     * The identifier of the message
      */
     postfix_id: string;
+    /**
+     * Message processing properties
+     */
     properties: InvestigateGetResponse.Properties;
     /**
-     * @deprecated Deprecated, use `scanned_at` instead
+     * @deprecated Deprecated, use `scanned_at` instead. End of life: November 1, 2026.
      */
     ts: string;
     alert_id?: string | null;
-    delivery_mode?: 'DIRECT' | 'BCC' | 'JOURNAL' | 'REVIEW_SUBMISSION' | 'DMARC_UNVERIFIED' | 'DMARC_FAILURE_REPORT' | 'DMARC_AGGREGATE_REPORT' | 'THREAT_INTEL_SUBMISSION' | 'SIMULATION_SUBMISSION' | 'API' | 'RETRO_SCAN' | null;
+    delivery_mode?: 'DIRECT' | 'BCC' | 'JOURNAL' | 'REVIEW_SUBMISSION' | 'DMARC_UNVERIFIED' | 'DMARC_FAILURE_REPORT' | 'DMARC_AGGREGATE_REPORT' | 'THREAT_INTEL_SUBMISSION' | 'SIMULATION_SUBMISSION' | 'API' | 'RETRO_SCAN';
+    delivery_status?: Array<'delivered' | 'moved' | 'quarantined' | 'rejected' | 'deferred' | 'bounced' | 'queued'> | null;
     edf_hash?: string | null;
     envelope_from?: string | null;
     envelope_to?: Array<string> | null;
-    final_disposition?: 'MALICIOUS' | 'MALICIOUS-BEC' | 'SUSPICIOUS' | 'SPOOF' | 'SPAM' | 'BULK' | 'ENCRYPTED' | 'EXTERNAL' | 'UNKNOWN' | 'NONE' | null;
+    final_disposition?: 'MALICIOUS' | 'MALICIOUS-BEC' | 'SUSPICIOUS' | 'SPOOF' | 'SPAM' | 'BULK' | 'ENCRYPTED' | 'EXTERNAL' | 'UNKNOWN' | 'NONE';
     /**
-     * @deprecated Deprecated.
+     * @deprecated Deprecated, use the `findings` field from
+     * `GET /investigate/{investigate_id}/detections` instead. End of life: November
+     * 1, 2026. Detection findings for this message.
      */
     findings?: Array<InvestigateGetResponse.Finding> | null;
     from?: string | null;
     from_name?: string | null;
     htmltext_structure_hash?: string | null;
     message_id?: string | null;
-    post_delivery_operations?: Array<'PREVIEW' | 'QUARANTINE_RELEASE' | 'SUBMISSION' | 'MOVE'>;
+    /**
+     * Post-delivery operations performed on this message
+     */
+    post_delivery_operations?: Array<'PREVIEW' | 'QUARANTINE_RELEASE' | 'SUBMISSION' | 'MOVE'> | null;
     postfix_id_outbound?: string | null;
     replyto?: string | null;
-    scanned_at?: string;
-    sent_at?: string;
     /**
-     * @deprecated Deprecated, use `sent_at` instead
+     * When the message was scanned (UTC)
+     */
+    scanned_at?: string | null;
+    /**
+     * When the message was sent (UTC)
      */
+    sent_at?: string | null;
     sent_date?: string | null;
     subject?: string | null;
     threat_categories?: Array<string> | null;
     to?: Array<string> | null;
     to_name?: Array<string> | null;
-    validation?: InvestigateGetResponse.Validation | null;
+    validation?: InvestigateGetResponse.Validation;
 }
 export declare namespace InvestigateGetResponse {
+    interface ActionLog {
+        /**
+         * Timestamp when action completed
+         */
+        completed_at: string;
+        /**
+         * Type of action performed
+         */
+        operation: 'MOVE' | 'RELEASE' | 'RECLASSIFY' | 'SUBMISSION' | 'QUARANTINE_RELEASE' | 'PREVIEW';
+        /**
+         * @deprecated Deprecated, use `completed_at` instead. End of life: November
+         * 1, 2026.
+         */
+        completed_timestamp?: string;
+        /**
+         * Additional properties for the action
+         */
+        properties?: ActionLog.Properties;
+        /**
+         * Status of the action
+         */
+        status?: string | null;
+    }
+    namespace ActionLog {
+        /**
+         * Additional properties for the action
+         */
+        interface Properties {
+            /**
+             * Target folder for move operations
+             */
+            folder?: string;
+            /**
+             * User who requested the action
+             */
+            requested_by?: string;
+        }
+    }
+    /**
+     * Message processing properties
+     */
     interface Properties {
-        allowlisted_pattern?: string;
-        allowlisted_pattern_type?: 'quarantine_release' | 'acceptable_sender' | 'allowed_sender' | 'allowed_recipient' | 'domain_similarity' | 'domain_recency' | 'managed_acceptable_sender' | 'outbound_ndr';
-        blocklisted_message?: boolean;
-        blocklisted_pattern?: string;
-        whitelisted_pattern_type?: 'quarantine_release' | 'acceptable_sender' | 'allowed_sender' | 'allowed_recipient' | 'domain_similarity' | 'domain_recency' | 'managed_acceptable_sender' | 'outbound_ndr';
+        /**
+         * Pattern that allowlisted this message
+         */
+        allowlisted_pattern?: string | null;
+        /**
+         * Type of allowlist pattern
+         */
+        allowlisted_pattern_type?: 'quarantine_release' | 'acceptable_sender' | 'allowed_sender' | 'allowed_recipient' | 'domain_similarity' | 'domain_recency' | 'managed_acceptable_sender' | 'outbound_ndr' | null;
+        /**
+         * Whether message was blocklisted
+         */
+        blocklisted_message?: boolean | null;
+        /**
+         * Pattern that blocklisted this message
+         */
+        blocklisted_pattern?: string | null;
+        /**
+         * Legacy field for allowlist pattern type
+         */
+        whitelisted_pattern_type?: 'quarantine_release' | 'acceptable_sender' | 'allowed_sender' | 'allowed_recipient' | 'domain_similarity' | 'domain_recency' | 'managed_acceptable_sender' | 'outbound_ndr' | null;
     }
     interface Finding {
         attachment?: string | null;
         detail?: string | null;
-        detection?: 'MALICIOUS' | 'MALICIOUS-BEC' | 'SUSPICIOUS' | 'SPOOF' | 'SPAM' | 'BULK' | 'ENCRYPTED' | 'EXTERNAL' | 'UNKNOWN' | 'NONE' | null;
+        detection?: 'MALICIOUS' | 'MALICIOUS-BEC' | 'SUSPICIOUS' | 'SPOOF' | 'SPAM' | 'BULK' | 'ENCRYPTED' | 'EXTERNAL' | 'UNKNOWN' | 'NONE';
         field?: string | null;
         name?: string | null;
         portion?: string | null;
@@ -201,18 +342,18 @@ export declare namespace InvestigateGetResponse {
     }
     interface Validation {
         comment?: string | null;
-        dkim?: 'pass' | 'neutral' | 'fail' | 'error' | 'none' | null;
-        dmarc?: 'pass' | 'neutral' | 'fail' | 'error' | 'none' | null;
-        spf?: 'pass' | 'neutral' | 'fail' | 'error' | 'none' | null;
+        dkim?: 'pass' | 'neutral' | 'fail' | 'error' | 'none';
+        dmarc?: 'pass' | 'neutral' | 'fail' | 'error' | 'none';
+        spf?: 'pass' | 'neutral' | 'fail' | 'error' | 'none';
     }
 }
 export interface InvestigateListParams extends V4PagePaginationArrayParams {
     /**
-     * Path param: Account Identifier
+     * Path param: Identifier.
      */
-    account_id?: string;
+    account_id: string;
     /**
-     * Query param: Determines if the message action log is included in the response.
+     * Query param: Whether to include the message action log in the response.
      */
     action_log?: boolean;
     /**
@@ -224,31 +365,25 @@ export interface InvestigateListParams extends V4PagePaginationArrayParams {
      */
     cursor?: string;
     /**
-     * Query param: Determines if the search results will include detections or not.
+     * Query param: Whether to include only detections in search results.
      */
     detections_only?: boolean;
     /**
-     * Query param: Filter by a domain found in the email: sender domain, recipient
-     * domain, or a domain in a link.
+     * Query param: Sender domains to filter by.
      */
     domain?: string;
     /**
-     * Query param: The end of the search date range. Defaults to `now` if not
-     * provided.
+     * Query param: The end of the search date range. Defaults to `now`.
      */
     end?: string;
     /**
-     * Query param: Search for messages with an exact subject match.
-     */
-    exact_subject?: string;
-    /**
-     * Query param: The dispositions the search filters by.
+     * Query param: Dispositions to filter by.
      */
     final_disposition?: 'MALICIOUS' | 'SUSPICIOUS' | 'SPOOF' | 'SPAM' | 'BULK' | 'NONE';
     /**
-     * Query param: The message actions the search filters by.
+     * Query param: Message actions to filter by.
      */
-    message_action?: 'PREVIEW' | 'QUARANTINE_RELEASED' | 'MOVED' | 'SUBMITTED';
+    message_action?: 'PREVIEW' | 'QUARANTINE_RELEASED' | 'MOVED';
     /**
      * Query param
      */
@@ -258,61 +393,32 @@ export interface InvestigateListParams extends V4PagePaginationArrayParams {
      */
     metric?: string;
     /**
-     * Query param: The space-delimited term used in the query. The search is
-     * case-insensitive.
-     *
-     * The content of the following email metadata fields are searched:
-     *
-     * - alert_id
-     * - CC
-     * - From (envelope_from)
-     * - From Name
-     * - final_disposition
-     * - md5 hash (of any attachment)
-     * - sha1 hash (of any attachment)
-     * - sha256 hash (of any attachment)
-     * - name (of any attachment)
-     * - Reason
-     * - Received DateTime (yyyy-mm-ddThh:mm:ss)
-     * - Sent DateTime (yyyy-mm-ddThh:mm:ss)
-     * - ReplyTo
-     * - To (envelope_to)
-     * - To Name
-     * - Message-ID
-     * - smtp_helo_server_ip
-     * - smtp_previous_hop_ip
-     * - x_originating_ip
-     * - Subject
+     * Query param: Space-delimited search term. Case-insensitive.
      */
     query?: string;
     /**
-     * Query param: Filter by recipient. Matches either an email address or a domain.
+     * Query param
      */
     recipient?: string;
     /**
-     * Query param: Filter by sender. Matches either an email address or a domain.
+     * Query param
      */
     sender?: string;
     /**
-     * Query param: The beginning of the search date range. Defaults to `now - 30 days`
-     * if not provided.
+     * Query param: The beginning of the search date range. Defaults to
+     * `now - 30 days`.
      */
     start?: string;
     /**
-     * Query param: Search for messages containing individual keywords in any order
-     * within the subject.
+     * Query param
      */
     subject?: string;
-    /**
-     * Query param: Search for submissions instead of original messages
-     */
-    submissions?: boolean;
 }
 export interface InvestigateGetParams {
     /**
-     * Path param: Account Identifier
+     * Path param: Identifier.
      */
-    account_id?: string;
+    account_id: string;
     /**
      * Query param: When true, search the submissions datastore only. When false or
      * omitted, search the regular datastore only.
@@ -325,7 +431,7 @@ export declare namespace Investigate {
     export { Preview as Preview, type PreviewCreateResponse as PreviewCreateResponse, type PreviewGetResponse as PreviewGetResponse, type PreviewCreateParams as PreviewCreateParams, type PreviewGetParams as PreviewGetParams, };
     export { Raw as Raw, type RawGetResponse as RawGetResponse, type RawGetParams as RawGetParams };
     export { Trace as Trace, type TraceGetResponse as TraceGetResponse, type TraceGetParams as TraceGetParams };
-    export { Move as Move, type MoveCreateResponse as MoveCreateResponse, type MoveBulkResponse as MoveBulkResponse, MoveBulkResponsesSinglePage as MoveBulkResponsesSinglePage, type MoveCreateParams as MoveCreateParams, type MoveBulkParams as MoveBulkParams, };
+    export { Move as Move, type MoveCreateResponse as MoveCreateResponse, type MoveBulkResponse as MoveBulkResponse, MoveCreateResponsesSinglePage as MoveCreateResponsesSinglePage, MoveBulkResponsesSinglePage as MoveBulkResponsesSinglePage, type MoveCreateParams as MoveCreateParams, type MoveBulkParams as MoveBulkParams, };
     export { Reclassify as Reclassify, type ReclassifyCreateResponse as ReclassifyCreateResponse, type ReclassifyCreateParams as ReclassifyCreateParams, };
     export { Release as Release, type ReleaseBulkResponse as ReleaseBulkResponse, ReleaseBulkResponsesSinglePage as ReleaseBulkResponsesSinglePage, type ReleaseBulkParams as ReleaseBulkParams, };
 }