quarantineMessages

Quarantined Messages. Quarantined mail with release, preview, and delete actions. The quarantineMessages entity set lives under /exchange/v1.0/quarantineMessages in the Threat protection category.

Fact	Value
Path	/exchange/v1.0/quarantineMessages
Category	Threat protection
Tier	Tier 4, Threat protection
Read role	ThreatPolicy.Read.All (Community)
Write role	ThreatPolicy.ReadWrite.All (Enterprise)
Backing cmdlets	Get-QuarantineMessage, Get-QuarantineMessageHeader, Preview-QuarantineMessage, Release-QuarantineMessage, Delete-QuarantineMessage

Routes

Method	Path	Synopsis	Role	Plan
GET	/exchange/v1.0/quarantineMessages	GET /quarantineMessages - rich filter surface. Up to ~24 query params (subset of Get-QuarantineMessage’s parameter set). Common usage: filter by ?senderAddress= + ?startReceivedDate=.	ThreatPolicy.Read	Community
POST	/exchange/v1.0/quarantineMessages/delete	POST /quarantineMessages/delete - BULK delete via Delete-QuarantineMessage -Identities. Body: { “ids”: [“GUID1\GUID2”, …] }. ?hardDelete=true bypasses the recoverable window. 204 on success. POST (not DELETE) because the operation carries a request body of ids.	ThreatPolicy.ReadWrite	Enterprise
POST	/exchange/v1.0/quarantineMessages/release	POST /quarantineMessages/release - BULK release via Release-QuarantineMessage -Identities. Body: { “ids”: [“GUID1\GUID2”, …] } (each id is the composite identity from GET /quarantineMessages). The bulk (Identities) parameter set releases to the original recipients; it does NOT take releaseToAll/user (use the per-message POST /quarantineMessages/{key}/release for targeted release). Query switches mirror the single release: ?actionType, ?allowSender, ?reportFalsePositive, ?force. 204 on success.	ThreatPolicy.ReadWrite	Enterprise
GET	/exchange/v1.0/quarantineMessages/{key}	Get a single quarantineMessages entry by Identity.	ThreatPolicy.Read	Community
DELETE	/exchange/v1.0/quarantineMessages/{key}	DELETE /quarantineMessages/{key} - bound to Delete-QuarantineMessage. Use ?hardDelete=true to bypass the recoverable-items window, ?recipientAddress=<smtp> + ?entityType= to scope a per-recipient or per-entity delete.	ThreatPolicy.ReadWrite	Enterprise
GET	/exchange/v1.0/quarantineMessages/{key}/headers	GET /quarantineMessages/{key}/headers - Get-QuarantineMessageHeader.	ThreatPolicy.Read	Community
GET	/exchange/v1.0/quarantineMessages/{key}/preview	GET /quarantineMessages/{key}/preview - Preview-QuarantineMessage. Returns the message body without releasing it. Cmdlet emits an opaque PSObject; we surface as a generic JSON payload.	ThreatPolicy.Read	Community
POST	/exchange/v1.0/quarantineMessages/{key}/release	POST /quarantineMessages/{key}/release - bound action via Release-QuarantineMessage. Body picks the recipient set: {“releaseToAll”: true} → release to ALL original recipients{“user”: [“[email protected]”, “[email protected]”]} → release only to listed users Query params: ?actionType=Deny|Release|Request (no “Approve” value - Release also approves pending release requests), ?allowSender=true (also bypass spam scoring for future messages from this sender), ?reportFalsePositive=true (report to Microsoft as miscategorized), ?force=true.	ThreatPolicy.ReadWrite	Enterprise

GET /exchange/v1.0/quarantineMessages

GET /quarantineMessages - rich filter surface. Up to ~24 query params (subset of Get-QuarantineMessage’s parameter set). Common usage: filter by ?senderAddress= + ?startReceivedDate=.

Backing cmdlet: Get-QuarantineMessage. Role: ThreatPolicy.Read (Community).

Parameter	In	Type	Required	Description
messageId	query	string
subject	query	string
senderAddress	query	String[]
recipientAddress	query	String[]
domain	query	String[]
direction	query	string
type	query	string
quarantineTypes	query	String[]
policyTypes	query	String[]
policyName	query	string
entityType	query	string
startReceivedDate	query	datetime
endReceivedDate	query	datetime
startExpiresDate	query	datetime
endExpiresDate	query	datetime
releaseStatus	query	String[]
recipientTag	query	String[]
reported	query	bool (switch)
includeMessagesFromBlockedSenderAddress	query	bool (switch)
myItems	query	bool (switch)
teamsConversationTypes	query	String[]
page	query	int
pageSize	query	int

List quarantineMessages

Stub auto-generated example for the quarantineMessages collection. Backing cmdlet: Get-QuarantineMessage. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.

GET /exchange/v1.0/quarantineMessages?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#quarantineMessages",
  "value": []
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

Related: GET /exchange/v1.0/quarantineMessages/{key}

POST /exchange/v1.0/quarantineMessages/delete

POST /quarantineMessages/delete - BULK delete via Delete-QuarantineMessage -Identities. Body: { “ids”: [“GUID1\GUID2”, …] }. ?hardDelete=true bypasses the recoverable window. 204 on success. POST (not DELETE) because the operation carries a request body of ids.

When -Identities is used -Identity is required but ignored - placeholder “000” per the cmdlet Wiki.

Backing cmdlet: Delete-QuarantineMessage. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
ids	body	array	yes
hardDelete	query	bool (switch)
dryRun	query	bool (switch)

POST /exchange/v1.0/quarantineMessages/release

POST /quarantineMessages/release - BULK release via Release-QuarantineMessage -Identities. Body: { “ids”: [“GUID1\GUID2”, …] } (each id is the composite identity from GET /quarantineMessages). The bulk (Identities) parameter set releases to the original recipients; it does NOT take releaseToAll/user (use the per-message POST /quarantineMessages/{key}/release for targeted release). Query switches mirror the single release: ?actionType, ?allowSender, ?reportFalsePositive, ?force. 204 on success.

Per the cmdlet Wiki, when -Identities is used -Identity is required but ignored - we send the documented placeholder “000”.

Backing cmdlet: Release-QuarantineMessage. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
ids	body	array	yes
actionType	query	string
allowSender	query	bool (switch)
reportFalsePositive	query	bool (switch)
force	query	bool (switch)
dryRun	query	bool (switch)

GET /exchange/v1.0/quarantineMessages/{key}

Get a single quarantineMessages entry by Identity.

Backing cmdlet: Get-QuarantineMessage. Role: ThreatPolicy.Read (Community).

Get a single quarantineMessages entry

Stub auto-generated example for GET /quarantineMessages/{key}. Backing cmdlet: Get-QuarantineMessage with -Identity {key}. Returns the full entity body; 404 if the identity doesn’t resolve.

GET /exchange/v1.0/quarantineMessages/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#quarantineMessages/$entity"
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

Related: GET /exchange/v1.0/quarantineMessages

DELETE /exchange/v1.0/quarantineMessages/{key}

DELETE /quarantineMessages/{key} - bound to Delete-QuarantineMessage. Use ?hardDelete=true to bypass the recoverable-items window, ?recipientAddress=<smtp> + ?entityType= to scope a per-recipient or per-entity delete.

Backing cmdlet: Delete-QuarantineMessage. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
hardDelete	query	bool (switch)
recipientAddress	query	string
entityType	query	string
dryRun	query	bool (switch)

Delete a quarantined message

Deletes a quarantined message by its opaque Identity key via Delete-QuarantineMessage. Use ?hardDelete=true to bypass the recoverable-items window, or ?recipientAddress= + ?entityType= to scope a per-recipient delete.

DELETE /exchange/v1.0/quarantineMessages/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/quarantineMessages

GET /exchange/v1.0/quarantineMessages/{key}/headers

GET /quarantineMessages/{key}/headers - Get-QuarantineMessageHeader.

Backing cmdlet: Get-QuarantineMessageHeader. Role: ThreatPolicy.Read (Community).

Parameter	In	Type	Required	Description
recipientAddress	query	string
entityType	query	string

GET /exchange/v1.0/quarantineMessages/{key}/preview

GET /quarantineMessages/{key}/preview - Preview-QuarantineMessage. Returns the message body without releasing it. Cmdlet emits an opaque PSObject; we surface as a generic JSON payload.

Backing cmdlet: Get-QuarantineMessage. Role: ThreatPolicy.Read (Community).

Parameter	In	Type	Required	Description
recipientAddress	query	string
entityType	query	string

POST /exchange/v1.0/quarantineMessages/{key}/release

POST /quarantineMessages/{key}/release - bound action via Release-QuarantineMessage. Body picks the recipient set: {“releaseToAll”: true} → release to ALL original recipients{“user”: [“[email protected]”, “[email protected]”]} → release only to listed users Query params: ?actionType=Deny|Release|Request (no “Approve” value - Release also approves pending release requests), ?allowSender=true (also bypass spam scoring for future messages from this sender), ?reportFalsePositive=true (report to Microsoft as miscategorized), ?force=true.

Backing cmdlet: Release-QuarantineMessage. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
releaseToAll	body	boolean
user	body	array
actionType	query	string
allowSender	query	bool (switch)
reportFalsePositive	query	bool (switch)
force	query	bool (switch)
dryRun	query	bool (switch)

Release a quarantined message to recipients

Sub-resource of the quarantined message at GET /quarantineMessages/{key} - releases the held message via Release-QuarantineMessage. Body picks the recipient set: {“releaseToAll”: true} releases to all original recipients, or {“user”: [“…”]} releases only to the listed SMTP addresses.

POST /exchange/v1.0/quarantineMessages/{key}/release HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "user": [
    "[email protected]"
  ]
}

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/quarantineMessages

?dryRun=true previews of any write stay on Community.