Email Quarantine Management

When a scanned message triggers the quarantine policy, Arbitex holds it in a dual-layer store: structured metadata (sender, recipients, findings, risk level) in the quarantined_emails database table, and the raw .eml file on the platform filesystem at /var/quarantine. Messages stay quarantined until an admin explicitly releases or deletes them.

For quarantine policy configuration, see Email DLP Configuration. For relay setup, see Email DLP Setup.

---

How quarantine works

  Haraka relay
       │
       ▼
  POST /v1/internal/dlp/scan
       │
       │  action="quarantine"
       ▼
  ┌─────────────────────────────────────────┐
  │          Quarantine Store               │
  │                                         │
  │  quarantined_emails table               │
  │  ├── scan_id (unique)                   │
  │  ├── org_id                             │
  │  ├── sender, recipients, subject        │
  │  ├── risk_level, action                 │
  │  ├── entities[] (JSONB)                 │
  │  ├── attachment_findings[] (JSONB)      │
  │  ├── quarantined_at                     │
  │  ├── released_at, released_by           │
  │  └── deleted_at (soft-delete)           │
  │                                         │
  │  /var/quarantine/{scan_id}.eml          │
  │  (raw message, immutable)               │
  └─────────────────────────────────────────┘
       │
       │  POST /v1/admin/email/quarantine/{scan_id}/release
       ▼
  Downstream MTA (SMTP re-delivery)
  X-Arbitex-DLP-Released header appended

The raw .eml is stored as-is at ingest time. It is never modified — even on release, the platform opens a new SMTP connection to the downstream MTA and transmits the original message bytes with the additional header appended at delivery time.

---

Viewing quarantined emails

List endpoint

GET /v1/admin/email/quarantine
Authorization: Bearer <admin-token>

Returns a paginated list of quarantine records. Default page size is 25; maximum is 100.

Query parameters:

Parameter	Type	Description
page	int	Page number (1-indexed, default: 1)
page_size	int	Results per page (1–100, default: 25)
org_id	int	Filter to a specific organization
risk_level	str	Filter by risk level: critical, high, medium, low
action	str	Filter by action taken: quarantine, reject, tag
sender_domain	str	Filter by sender domain (e.g., acme.com)
date_from	str	ISO 8601 datetime (inclusive lower bound)
date_to	str	ISO 8601 datetime (inclusive upper bound)
has_attachments	bool	Filter to messages with (true) or without (false) attachments
sort_by	str	Field to sort by: quarantined_at (default), risk_level, sender
sort_order	str	asc or desc (default: desc)

Example — high-risk messages in the last 7 days:

curl -s "https://platform.arbitex.ai/v1/admin/email/quarantine?risk_level=high&date_from=2026-03-17T00:00:00Z&sort_order=desc" \
  -H "Authorization: Bearer <admin-token>"

Response:

{
  "items": [
    {
      "scan_id": "scan_01HXYZ",
      "org_id": 42,
      "sender": "[email protected]",
      "recipients": ["[email protected]"],
      "subject": "Patient update - urgent",
      "risk_level": "high",
      "action": "quarantine",
      "entity_count": 2,
      "quarantined_at": "2026-03-20T09:14:22Z",
      "released_at": null,
      "released_by": null
    }
  ],
  "total_count": 1,
  "page": 1,
  "page_size": 25,
  "total": 1,
  "offset": 0,
  "limit": 25
}

---

Aggregate statistics

The stats endpoint provides a dashboard-ready summary of quarantine activity:

GET /v1/admin/email/quarantine/stats
Authorization: Bearer <admin-token>

Returns aggregated counts for all non-deleted quarantined emails. All aggregation is performed server-side.

{
  "total_quarantined": 842,
  "by_risk_level": {
    "critical": 12,
    "high": 187,
    "medium": 501,
    "low": 142
  },
  "by_action": {
    "quarantine": 700,
    "reject": 98,
    "tag": 44
  },
  "by_org": {
    "42": 412,
    "58": 430
  },
  "time_series_7d": [
    {"date": "2026-03-17", "count": 98},
    {"date": "2026-03-18", "count": 115},
    {"date": "2026-03-19", "count": 107},
    {"date": "2026-03-20", "count": 143},
    {"date": "2026-03-21", "count": 132},
    {"date": "2026-03-22", "count": 119},
    {"date": "2026-03-23", "count": 128}
  ],
  "time_series_30d": [ "..." ],
  "top_entity_types": [
    {"entity_type": "ssn", "count": 234},
    {"entity_type": "health_info", "count": 198},
    {"entity_type": "credit_card", "count": 87}
  ],
  "avg_scan_latency_ms": 108
}

---

Examining a quarantined message

Detail view

GET /v1/admin/email/quarantine/{scan_id}
Authorization: Bearer <admin-token>

Returns full metadata including detected entities and per-attachment findings:

{
  "scan_id": "scan_01HXYZ",
  "org_id": 42,
  "sender": "[email protected]",
  "recipients": ["[email protected]"],
  "subject": "Patient update - urgent",
  "risk_level": "high",
  "action": "quarantine",
  "entity_count": 2,
  "quarantined_at": "2026-03-20T09:14:22Z",
  "released_at": null,
  "released_by": null,
  "entities": [
    {
      "entity_type": "ssn",
      "confidence": 0.97,
      "detection_tier": 1,
      "span_start": 36,
      "span_end": 47
    },
    {
      "entity_type": "date_of_birth",
      "confidence": 0.88,
      "detection_tier": 2,
      "span_start": 54,
      "span_end": 64
    }
  ],
  "attachment_findings": [
    {
      "filename": "patient-summary.pdf",
      "status": "scanned",
      "findings": [
        {
          "entity_type": "health_info",
          "confidence": 0.91,
          "detection_tier": 2
        }
      ]
    }
  ],
  "eml_path": "/var/quarantine/scan_01HXYZ.eml"
}

Note

The entities array records span offsets and confidence but does not include the matched text. This follows the same privacy principle as the gateway DLP audit log — sensitive content is not re-stored in metadata. See DLP Pipeline Architecture for details on finding schemas.

---

Downloading raw .eml files

For investigation or legal review, download the original message as an RFC 2822 .eml file:

GET /v1/admin/email/quarantine/{scan_id}/eml
Authorization: Bearer <admin-token>

Response: application/octet-stream — the raw .eml bytes.

curl -s "https://platform.arbitex.ai/v1/admin/email/quarantine/scan_01HXYZ/eml" \
  -H "Authorization: Bearer <admin-token>" \
  -o patient-update.eml

The downloaded file is the original message as received by the Haraka relay, including all original headers. Open it in any RFC 2822-compliant mail client or viewer (Apple Mail, Thunderbird, Outlook Import) to read the full message, attachments, and MIME structure.

Caution

Downloaded .eml files contain the sensitive content that triggered quarantine. Handle them according to your organization’s data classification policy. Delete them from local storage after review. Do not forward .eml files to recipients — use the release workflow instead.

---

Releasing quarantined messages

Releasing a message re-delivers it to its original recipients via the downstream MTA.

POST /v1/admin/email/quarantine/{scan_id}/release
Authorization: Bearer <admin-token>

No request body is required. The admin identity is inferred from the authentication token.

What happens on release:

1. The platform opens an SMTP connection to DOWNSTREAM_MTA_HOST:DOWNSTREAM_MTA_PORT

2. The original .eml is transmitted with X-Arbitex-DLP-Released headers appended

3. An audit event (email_quarantine_released) is written recording the scan ID and the admin who released it

4. The quarantine record’s released_at and released_by fields are updated

Response on success (200 OK):

{
  "status": "released",
  "scan_id": "scan_01HXYZ"
}

If the downstream MTA rejects the re-delivery, a 502 Bad Gateway is returned and the email remains quarantined. Check DOWNSTREAM_MTA_HOST and DOWNSTREAM_MTA_PORT configuration if this occurs.

Note

Release is an audit-logged, non-reversible operation. Once delivered, the message cannot be recalled. Verify findings against the detail view and download the .eml for review before releasing messages containing regulated data.

---

Deleting quarantined messages

Deletion removes the quarantine record from active views. It is a soft delete — the metadata record is marked deleted and the .eml is moved to a deletion-pending store, where it is purged after the org’s data retention period.

DELETE /v1/admin/email/quarantine/{scan_id}
Authorization: Bearer <admin-token>

Response (200 OK):

{
  "status": "deleted",
  "scan_id": "scan_01HXYZ"
}

An audit event (email_quarantine_deleted) is recorded. Soft-deleted records are excluded from the list endpoint and stats by default. The raw .eml remains on disk until the org’s data retention period expires.

---

Overview dashboard

The overview endpoint provides a per-org Email DLP summary for the admin dashboard:

GET /v1/admin/email/overview
Authorization: Bearer <admin-token>

Returns all organizations with their email DLP status, quarantine counts, and applied compliance templates:

{
  "orgs": [
    {
      "org_id": 42,
      "org_name": "Acme Corp",
      "enabled": true,
      "quarantine_policy": "quarantine",
      "templates_applied": ["hipaa", "pci_dss"],
      "quarantine_count": 23,
      "scan_volume_24h": 412
    },
    {
      "org_id": 58,
      "org_name": "Globex Inc",
      "enabled": true,
      "quarantine_policy": "tag",
      "templates_applied": ["gdpr"],
      "quarantine_count": 7,
      "scan_volume_24h": 198
    }
  ],
  "global_enabled": true,
  "total_quarantine_count": 30
}

The global_enabled flag reflects the system-wide email_dlp.enabled toggle. When false, no email scanning occurs regardless of per-org settings. Per-org quarantine_count includes only active records (non-deleted, non-released). Organizations without a per-org config row appear with system defaults applied.

---

Common workflows

Review all unresolved high-risk messages

curl -s "https://platform.arbitex.ai/v1/admin/email/quarantine?risk_level=high&sort_by=quarantined_at&sort_order=asc" \
  -H "Authorization: Bearer <admin-token>"

Work through the list from oldest to newest. For each message:

1. Fetch the detail view to review findings
2. Download the .eml if deeper inspection is needed
3. Release (confirmed false positive) or delete (confirmed true positive, no re-delivery needed)

Filter by sender domain after a security incident

curl -s "https://platform.arbitex.ai/v1/admin/email/quarantine?sender_domain=suspicious.com&date_from=2026-03-01T00:00:00Z" \
  -H "Authorization: Bearer <admin-token>"

Pull attachment-only quarantine for file DLP review

curl -s "https://platform.arbitex.ai/v1/admin/email/quarantine?has_attachments=true&risk_level=critical" \
  -H "Authorization: Bearer <admin-token>"

---

Related pages

• Email DLP Setup — relay installation, TLS, DNS, and end-to-end verification
• Email DLP Configuration — quarantine policies, compliance templates, rate limiting
• DLP Pipeline Architecture — 5-tier detection, audit event schema, and finding confidence scoring