quarantineMessages
Quarantined Messages. Quarantined mail with release, preview, and delete actions. The quarantineMessages entity set lives under /exchange/v1.0/quarantineMessages in the Threat protection category.
| Fact | Value |
|---|---|
| Path | /exchange/v1.0/quarantineMessages |
| Category | Threat protection |
| Tier | Tier 4, Threat protection |
| Read role | ThreatPolicy.Read.All (Community) |
| Write role | ThreatPolicy.ReadWrite.All (Enterprise) |
| Backing cmdlets | Get-QuarantineMessage, Get-QuarantineMessageHeader, Preview-QuarantineMessage, Release-QuarantineMessage, Delete-QuarantineMessage |
Routes
Section titled “Routes”| Method | Path | Synopsis | Role | Plan |
|---|---|---|---|---|
| GET | /exchange/v1.0/quarantineMessages |
GET /quarantineMessages - rich filter surface. Up to ~24 query params (subset of Get-QuarantineMessage’s parameter set). Common usage: filter by ?senderAddress= + ?startReceivedDate=. | ThreatPolicy.Read |
Community |
| POST | /exchange/v1.0/quarantineMessages/delete |
POST /quarantineMessages/delete - BULK delete via Delete-QuarantineMessage -Identities. Body: { “ids”: [“GUID1\GUID2”, …] }. ?hardDelete=true bypasses the recoverable window. 204 on success. POST (not DELETE) because the operation carries a request body of ids. | ThreatPolicy.ReadWrite |
Enterprise |
| POST | /exchange/v1.0/quarantineMessages/release |
POST /quarantineMessages/release - BULK release via Release-QuarantineMessage -Identities. Body: { “ids”: [“GUID1\GUID2”, …] } (each id is the composite identity from GET /quarantineMessages). The bulk (Identities) parameter set releases to the original recipients; it does NOT take releaseToAll/user (use the per-message POST /quarantineMessages/{key}/release for targeted release). Query switches mirror the single release: ?actionType, ?allowSender, ?reportFalsePositive, ?force. 204 on success. | ThreatPolicy.ReadWrite |
Enterprise |
| GET | /exchange/v1.0/quarantineMessages/{key} |
Get a single quarantineMessages entry by Identity. | ThreatPolicy.Read |
Community |
| DELETE | /exchange/v1.0/quarantineMessages/{key} |
DELETE /quarantineMessages/{key} - bound to Delete-QuarantineMessage. Use ?hardDelete=true to bypass the recoverable-items window, ?recipientAddress=<smtp> + ?entityType= to scope a per-recipient or per-entity delete. | ThreatPolicy.ReadWrite |
Enterprise |
| GET | /exchange/v1.0/quarantineMessages/{key}/headers |
GET /quarantineMessages/{key}/headers - Get-QuarantineMessageHeader. | ThreatPolicy.Read |
Community |
| GET | /exchange/v1.0/quarantineMessages/{key}/preview |
GET /quarantineMessages/{key}/preview - Preview-QuarantineMessage. Returns the message body without releasing it. Cmdlet emits an opaque PSObject; we surface as a generic JSON payload. | ThreatPolicy.Read |
Community |
| POST | /exchange/v1.0/quarantineMessages/{key}/release |
POST /quarantineMessages/{key}/release - bound action via Release-QuarantineMessage. Body picks the recipient set: {“releaseToAll”: true} → release to ALL original recipients{“user”: [“alice@x.com”, “bob@y.com”]} → release only to listed users Query params: ?actionType=Deny|Release|Request (no “Approve” value - Release also approves pending release requests), ?allowSender=true (also bypass spam scoring for future messages from this sender), ?reportFalsePositive=true (report to Microsoft as miscategorized), ?force=true. | ThreatPolicy.ReadWrite |
Enterprise |
GET /exchange/v1.0/quarantineMessages
Section titled “GET /exchange/v1.0/quarantineMessages”GET /quarantineMessages - rich filter surface. Up to ~24 query params (subset of Get-QuarantineMessage’s parameter set). Common usage: filter by ?senderAddress= + ?startReceivedDate=.
Backing cmdlet: Get-QuarantineMessage. Role: ThreatPolicy.Read (Community).
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
messageId |
query | string | ||
subject |
query | string | ||
senderAddress |
query | String[] | ||
recipientAddress |
query | String[] | ||
domain |
query | String[] | ||
direction |
query | string | ||
type |
query | string | ||
quarantineTypes |
query | String[] | ||
policyTypes |
query | String[] | ||
policyName |
query | string | ||
entityType |
query | string | ||
startReceivedDate |
query | datetime | ||
endReceivedDate |
query | datetime | ||
startExpiresDate |
query | datetime | ||
endExpiresDate |
query | datetime | ||
releaseStatus |
query | String[] | ||
recipientTag |
query | String[] | ||
reported |
query | bool (switch) | ||
includeMessagesFromBlockedSenderAddress |
query | bool (switch) | ||
myItems |
query | bool (switch) | ||
teamsConversationTypes |
query | String[] | ||
page |
query | int | ||
pageSize |
query | int |
List quarantineMessages
Section titled “List quarantineMessages”Stub auto-generated example for the quarantineMessages collection. Backing cmdlet: Get-QuarantineMessage. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.
GET /exchange/v1.0/quarantineMessages?$top=3 HTTP/1.1Authorization: Bearer {token}HTTP/1.1 200 OK
{ "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#quarantineMessages", "value": []}Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.
Related: GET /exchange/v1.0/quarantineMessages/{key}
POST /exchange/v1.0/quarantineMessages/delete
Section titled “POST /exchange/v1.0/quarantineMessages/delete”POST /quarantineMessages/delete - BULK delete via Delete-QuarantineMessage -Identities. Body: { “ids”: [“GUID1\GUID2”, …] }. ?hardDelete=true bypasses the recoverable window. 204 on success. POST (not DELETE) because the operation carries a request body of ids.
When -Identities is used -Identity is required but ignored - placeholder “000” per the cmdlet Wiki.
Backing cmdlet: Delete-QuarantineMessage. Role: ThreatPolicy.ReadWrite (Enterprise).
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
ids |
body | array | yes | |
hardDelete |
query | bool (switch) | ||
dryRun |
query | bool (switch) |
POST /exchange/v1.0/quarantineMessages/release
Section titled “POST /exchange/v1.0/quarantineMessages/release”POST /quarantineMessages/release - BULK release via Release-QuarantineMessage -Identities. Body: { “ids”: [“GUID1\GUID2”, …] } (each id is the composite identity from GET /quarantineMessages). The bulk (Identities) parameter set releases to the original recipients; it does NOT take releaseToAll/user (use the per-message POST /quarantineMessages/{key}/release for targeted release). Query switches mirror the single release: ?actionType, ?allowSender, ?reportFalsePositive, ?force. 204 on success.
Per the cmdlet Wiki, when -Identities is used -Identity is required but ignored - we send the documented placeholder “000”.
Backing cmdlet: Release-QuarantineMessage. Role: ThreatPolicy.ReadWrite (Enterprise).
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
ids |
body | array | yes | |
actionType |
query | string | ||
allowSender |
query | bool (switch) | ||
reportFalsePositive |
query | bool (switch) | ||
force |
query | bool (switch) | ||
dryRun |
query | bool (switch) |
GET /exchange/v1.0/quarantineMessages/{key}
Section titled “GET /exchange/v1.0/quarantineMessages/{key}”Get a single quarantineMessages entry by Identity.
Backing cmdlet: Get-QuarantineMessage. Role: ThreatPolicy.Read (Community).
Get a single quarantineMessages entry
Section titled “Get a single quarantineMessages entry”Stub auto-generated example for GET /quarantineMessages/{key}. Backing cmdlet: Get-QuarantineMessage with -Identity {key}. Returns the full entity body; 404 if the identity doesn’t resolve.
GET /exchange/v1.0/quarantineMessages/{key} HTTP/1.1Authorization: Bearer {token}HTTP/1.1 200 OK
{ "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#quarantineMessages/$entity"}Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.
Related: GET /exchange/v1.0/quarantineMessages
DELETE /exchange/v1.0/quarantineMessages/{key}
Section titled “DELETE /exchange/v1.0/quarantineMessages/{key}”DELETE /quarantineMessages/{key} - bound to Delete-QuarantineMessage. Use ?hardDelete=true to bypass the recoverable-items window, ?recipientAddress=<smtp> + ?entityType= to scope a per-recipient or per-entity delete.
Backing cmdlet: Delete-QuarantineMessage. Role: ThreatPolicy.ReadWrite (Enterprise).
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
hardDelete |
query | bool (switch) | ||
recipientAddress |
query | string | ||
entityType |
query | string | ||
dryRun |
query | bool (switch) |
Delete a quarantined message
Section titled “Delete a quarantined message”Deletes a quarantined message by its opaque Identity key via Delete-QuarantineMessage. Use ?hardDelete=true to bypass the recoverable-items window, or ?recipientAddress= + ?entityType= to scope a per-recipient delete.
DELETE /exchange/v1.0/quarantineMessages/{key} HTTP/1.1Authorization: Bearer {token}Content-Type: application/jsonHTTP/1.1 204 No ContentNotes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.
Related: GET /exchange/v1.0/quarantineMessages
GET /exchange/v1.0/quarantineMessages/{key}/headers
Section titled “GET /exchange/v1.0/quarantineMessages/{key}/headers”GET /quarantineMessages/{key}/headers - Get-QuarantineMessageHeader.
Backing cmdlet: Get-QuarantineMessageHeader. Role: ThreatPolicy.Read (Community).
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
recipientAddress |
query | string | ||
entityType |
query | string |
GET /exchange/v1.0/quarantineMessages/{key}/preview
Section titled “GET /exchange/v1.0/quarantineMessages/{key}/preview”GET /quarantineMessages/{key}/preview - Preview-QuarantineMessage. Returns the message body without releasing it. Cmdlet emits an opaque PSObject; we surface as a generic JSON payload.
Backing cmdlet: Get-QuarantineMessage. Role: ThreatPolicy.Read (Community).
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
recipientAddress |
query | string | ||
entityType |
query | string |
POST /exchange/v1.0/quarantineMessages/{key}/release
Section titled “POST /exchange/v1.0/quarantineMessages/{key}/release”POST /quarantineMessages/{key}/release - bound action via Release-QuarantineMessage. Body picks the recipient set: {“releaseToAll”: true} → release to ALL original recipients{“user”: [“alice@x.com”, “bob@y.com”]} → release only to listed users Query params: ?actionType=Deny|Release|Request (no “Approve” value - Release also approves pending release requests), ?allowSender=true (also bypass spam scoring for future messages from this sender), ?reportFalsePositive=true (report to Microsoft as miscategorized), ?force=true.
Backing cmdlet: Release-QuarantineMessage. Role: ThreatPolicy.ReadWrite (Enterprise).
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
releaseToAll |
body | boolean | ||
user |
body | array | ||
actionType |
query | string | ||
allowSender |
query | bool (switch) | ||
reportFalsePositive |
query | bool (switch) | ||
force |
query | bool (switch) | ||
dryRun |
query | bool (switch) |
Release a quarantined message to recipients
Section titled “Release a quarantined message to recipients”Sub-resource of the quarantined message at GET /quarantineMessages/{key} - releases the held message via Release-QuarantineMessage. Body picks the recipient set: {“releaseToAll”: true} releases to all original recipients, or {“user”: [“…”]} releases only to the listed SMTP addresses.
POST /exchange/v1.0/quarantineMessages/{key}/release HTTP/1.1Authorization: Bearer {token}Content-Type: application/json
{ "user": [ "user@contoso.com" ]}HTTP/1.1 204 No ContentNotes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.
Related: GET /exchange/v1.0/quarantineMessages
?dryRun=true previews of any write stay on Community.