The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

REST API call to get Email Protection incidents based on email message IDs

Prev Next

You can use this REST API call to query the list of data-in-use or data-in-motion Email Protection incident IDs for the specified email message IDs.

GET request URL

https://<epo_server_name:port>/rest/dlp/incidents/list/useOrMotion/emailMessageIds

Where, epo_server_name:port is the server IP address and port number.

Request Parameters

Parameter name

Description

Required

Values

Authorization

User credentials for ePO - On-prem.

Required

emailMessageIds

List of email message IDs for which the corresponding Email Protection incident IDs are retrieved.

Required

List of strings

Sample GET request URL

https://172.27.108.53:8443/rest/dlp/incidents/list/useOrMotion/emailMessageIds

{

"emailMessageIds":["msg1","UDLP_IncidentEmail"]

}

Sample cURL command

curl -k -v -X GET 'https://172.27.108.53:8443/rest/dlp/incidents/list/useOrMotion/emailMessageIds' -u '<user>:<password>'

--data-raw ' {

"emailMessageIds":["msg1","UDLP_IncidentEmail"]

} '

Response parameters

The response to this API call returns a list of Email Protection data-in-use/motion incidents for the specified email message IDs.

Element

Description

Data type

Incident Id list

List of data-in-use or data-in-motion incident IDs corresponding to email message IDs specified in the request. Shows the reason for failure, if there is a failure.

List of strings

Sample request

{
    "emailMessageIds":["<20221108105804.006088@test.dlp.com>"]
}

Sample response

[
    "56",
    "65"
]

Status and error codes

List of HTTP status codes returned for the query.

Code

Description

200 OK

Successfully returns a list of incident IDs for the specified email message IDs.

400 Bad Request

Empty email message IDs.

404 Not Found

Incorrect ePO - On-prem URL.

500 Internal Server Error

An error on the server side that failed the request. See the ePO - On-prem orion.log file for more details about the error.