Skip to main content
Upload one or more messages to an incident. Note: The allowed number of recipients is up to 10,000 per message.

​
Parameters

ParameterDescription
DispositionThe disposition to set to the message, for example - malware.
Incident IDThe ID of the incident to attach the message to. Can be obtained from the response of Create Incident action.
MessagesAn array of JSON objects representing messages.

For example:
[
  {
    “rfcMessageId”: “<MESSAGE_ID@host>”,
    “recipient_addresses”: [“user@example.com”],
    “sender”: “bad@example.com”,
    “subject”: “Subject”,
    “disposition”: “malware”
  }
]
One Or Multiple MessagesChoose whether to upload one or multiple messages.
RFC Message IDThe RFC message ID.

Note: This parameter must include angle brackets (<,>). For example <abc123@mail.example.com>.
Recipient AddressesA comma-separated list of recipient email addresses.
SenderThe email address of the message sender.
SubjectThe subject of the message.

​
Example Output

{
	"rfcMessageId": "<SA1PR13MB60556A43EBD392CA7B453D7FAE282@SA1PR13MB6055.namprd13.prod.outlook.com>",
	"incident_id": "b78ee40c-5c26-482d-9ae5-f0edacb82400",
	"incidentDisplayId": "18906",
	"uploadedRecipientsCount": 2
}

​
Workflow Library Example

Upload Messages with Proofpoint Threat Protection and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop