---
title: "List email security rules"
method: GET
path: "/v2/email-security/settings/rules"
tags: ["Email Security"]
---

# List email security rules

`GET /v2/email-security/settings/rules`

## Request

- Base URL: `https://api.adaptivesecurity.com`
- URL: `https://api.adaptivesecurity.com/v2/email-security/settings/rules`
- Auth: HTTP bearer

Returns enabled, company-configured, non-deleted sender rules ordered by creation time. Adaptive-configured rules are excluded. Omit listType to return both allow and deny rules. Response fields use snake_case.

**Required permission:** `email_security:read`

## Query parameters

- `listType` 'ALLOW' | 'DENY', nullable

## Response `200`

Successfully retrieved rules. Returns an empty rules array when no rules match.

- EmailSenderRuleListResponseDto: Email security sender rules
  - `rules` EmailSenderRuleDto[], required: Matching rules ordered by creation time
    - `auth_requirement` 'AUTHENTICATED' | 'NONE', required: Sender authentication requirement
    - `created` string, date-time, required: Creation time
    - `header_rules` HeaderMatchRuleSetDto, required: Header conditions attached to a sender rule
      - `operator` 'AND' | 'OR', required: How to combine conditions; always AND for one condition
      - `rules` HeaderMatchRuleDto[], required: Header conditions
        - `header` string, required: Header name
        - `value` string, required: Value or regular expression to match
        - `value_type` 'STATIC' | 'REGEX' | 'CONTAINS' | 'STARTS_WITH', required: How to match the value
    - `id` string, uuid, required: Rule identifier
    - `list_type` 'ALLOW' | 'DENY', required: Whether the rule allows or denies matching mail
    - `name` string, required: Display name
    - `rule_type` 'DMI_HEADER' | 'DOMAIN' | 'EMAIL' | 'IP' | 'IP_RANGE', required: Kind of sender match
    - `updated` string, date-time, required: Last update time
    - `value` string, required: Value matched by the rule

## Other responses

- `400`: Invalid listType
- `401`: Invalid or missing authentication token
- `403`: Company is not enabled for Email Security
- `429`: Rate limit exceeded
- `500`: Internal server error

## Changes

- **2026-10-19** `41f0ca9c551a`: 3 breaking
  - added `#/components/schemas/HeaderMatchRuleSetDto, subschema #2` to the `rules/items/header_rules` response property `oneOf` list for the response status `200`
  - removed the required property `rules/items/header_rules/operator` from the response with the `200` status
  - removed the required property `rules/items/header_rules/rules` from the response with the `200` status
- **2026-10-09** `1e527b1a2d31`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/changes/v2/email-security/settings/rules/get.md)

---

[API](https://skmtc.dev/adaptivesecurity/apis/adaptive-api.md) - [All operations](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/revisions/c367e8f673f3?raw)