Post email rules
Authorizations
JWT Bearer token obtained from authentication. Pass as: Authorization: Bearer
Body
Request body for creating an email allow/block rule
SEND governs who this org's agents may email (enforced when a send is attempted); RECEIVE governs whose mail is accepted for them (enforced at ingest, before the message is stored or any webhook fires). Reply-scope is not implemented.
SEND, RECEIVE BLOCK refuses the matching address. ALLOW does two things: it carves an exception out of a broader BLOCK, AND it switches that scope+direction into allow-list mode — once any ALLOW rule exists, addresses it does not cover are refused. Adding one ALLOW rule therefore restricts far more than it permits.
ALLOW, BLOCK ADDRESS matches one exact address. DOMAIN matches the domain and its subdomains ('example.com' covers 'a@mail.example.com' but never 'a@notexample.com'). ADDRESS beats DOMAIN when both match.
ADDRESS, DOMAIN The address or domain this rule matches. Normalized to lowercase. Validated against patternType.
1 - 320Scope the rule to one agent. Omit or null for an org-wide rule. An agent's own rules take precedence over org-wide rules — including its allow-list, which does NOT inherit the org's.
^[cC][^\s-]{8,}$Optional operator note ('known phisher', 'competitor'). Surfaced in the error a blocked send returns and in the security event, so a refusal is diagnosable without opening the console.
500Response
OK
An email allow/block rule
Unique identifier of the rule
^[cC][^\s-]{8,}$SEND governs who this org's agents may email (enforced when a send is attempted); RECEIVE governs whose mail is accepted for them (enforced at ingest, before the message is stored or any webhook fires). Reply-scope is not implemented.
SEND, RECEIVE BLOCK refuses the matching address. ALLOW does two things: it carves an exception out of a broader BLOCK, AND it switches that scope+direction into allow-list mode — once any ALLOW rule exists, addresses it does not cover are refused. Adding one ALLOW rule therefore restricts far more than it permits.
ALLOW, BLOCK ADDRESS matches one exact address. DOMAIN matches the domain and its subdomains ('example.com' covers 'a@mail.example.com' but never 'a@notexample.com'). ADDRESS beats DOMAIN when both match.
ADDRESS, DOMAIN The normalized (lowercase) address or domain this rule matches
The agent this rule is scoped to, or null for an org-wide rule
^[cC][^\s-]{8,}$Operator note, or null if not set
Timestamp when the rule was created
Timestamp when the rule was last modified
