---
title: "Get a mailbox's mail policy"
method: GET
path: "/v1/mailboxes/{mailbox_id}/policy"
tags: ["policy"]
---

# Get a mailbox's mail policy

`GET /v1/mailboxes/{mailbox_id}/policy`

## Request

- Base URL: `https://mbag.ai/api`
- URL: `https://mbag.ai/api/v1/mailboxes/{mailbox_id}/policy`
- Auth: HTTP bearer

## Path parameters

- `mailbox_id` integer, required

## Response `200`

The stored policy. `warnings` is always empty on GET.

- PolicyResponse: Field names are snake_case here (this wrapper predates the camelCase `MailPolicy` convention); only `policy`'s own fields are camelCase.
  - `mailbox_id` integer, required
  - `policy` MailPolicy, required: camelCase on the wire. On PUT, `senders`/`contentGuards`/`blocklist` default to empty and `mode` defaults to `live` when omitted; the GET/PUT response always includes all of them (`blocklist` omitted when empty).
    - `auditLog` AuditConfig, required
      - `includeBodyHash` boolean, required
      - `retentionDays` integer, required
    - `blocklist` string[]: Recipient addresses/bare domains this mailbox may never send to. Omitted when empty.
    - `contentGuards` ContentGuard[], required
      - `reason` string, required
      - `reject` string, required: Regex source (Rust `regex` crate flavour); compiled at PUT time.
    - `defaultAction` 'bounce' | 'drop', required
    - `mode` 'live' | 'supervised' | 'shadow', required
    - `senders` SenderRule[], required
      - `allowedHosts` string[]
      - `capabilities` string[], required: Opaque capability strings; unknown values warn but don't reject at PUT time.
      - `match` SenderMatch, required
        - `address` string
        - `domain` string
        - `requireDkim` boolean, required
        - `requireSpf` boolean, required
      - `passive` boolean, required: When true, matching mail is accepted and audited but never invokes the agent.
      - `rateLimit` RateLimit
        - `perDay` integer
        - `perHour` integer
      - `tokenBudget` TokenBudget
        - `perDay` integer
        - `perThread` integer
  - `version` integer, required
  - `warnings` string[]: Non-fatal validation warnings from PUT (e.g. unknown capability names). Omitted when empty; always empty on GET.

## Other responses

- `401`: Missing or invalid credential, raised by the `ApiKeyAuth` extractor (`backend/src/api_keys.rs`) before the handler runs: no `Authorization` header, a non-`Bearer` scheme, a key that doesn't hash-match any row, or a key whose status isn't `active`. A header that isn't valid UTF-8, has no scheme token, or has `Bearer` with no key value returns 400 with this same JSON shape instead of 401.
- `403`: Mailbox exists but is owned by another user. Plain-text body.
- `404`: Mailbox not found, or the mailbox has no policy row. Plain-text body.
- `500`: Database error. Plain-text body.

---

[API](https://skmtc.dev/mailbuttons/apis/mailbuttons-agent-mail-api.md) · [All operations](https://skmtc.dev/mailbuttons/apis/mailbuttons-agent-mail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mailbuttons/apis/mailbuttons-agent-mail-api/revisions/fe2761823978?raw)