---
title: "Add users (custodians) to a legal hold policy - v4"
method: POST
path: "/legalholds/v4/policies/{policyId}/users"
tags: ["Legal Hold"]
---

# Add users (custodians) to a legal hold policy - v4

`POST /legalholds/v4/policies/{policyId}/users`

## Request

- Base URL: `https://apis.druva.com/insync`
- URL: `https://apis.druva.com/insync/legalholds/v4/policies/{policyId}/users`
- Auth: API key in header `Authorization`

Adds users to a Druva inSync legal hold policy. Up to 500 email addresses are processed per request; additional addresses are excluded, with the response message confirming the applied threshold.

## Path parameters

- `policyId` integer, required

## Request body

- RequestV4CustodianEmails
  - `emailIDs` string[], required: Email addresses of custodians to add or remove. The list must not be empty. Only the first 500 addresses are processed.

## Response `200`

OK

- ResponseV4AddCustodians
  - `usersAdded` string[]: Email addresses that were added to the legal hold policy.
  - `usersNotAdded` string[]: If a user is already subject to a legal hold when being added to a legal hold policy, their email address will be included in this list.
  - `notInSyncMails` string[]: If a user is not a valid inSync user when being added to a legal hold policy, their email address will be returned in this list.
  - `message` string: Outcome summary. Contains details indicating if any users were previously placed on legal hold, along with a notification if the request exceeded the limit and was capped at 500 emails.

## Other responses

- `400`: Bad Request. Invalid request parameters: policyId must be an integer, emailIDs cannot be empty, and all provided emails must have a valid format.
- `401`: Unauthorized: You are unauthorized or lack the required administrative permissions for this policy.
- `403`: Access denied: Callers using developer or client credentials lack sufficient permissions. Details: https://help.druva.com/en/articles/15069296
- `404`: Not found
- `500`: Internal Server Error: Failed to add either the custodians or Additional Data Collection devices.

---

[API](https://skmtc.dev/druva/apis/insync-cloud.md) - [All operations](https://skmtc.dev/druva/apis/insync-cloud/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/insync-cloud/revisions/a0ce6d05033c?raw)