email-mailboxes

Create a receive rule

Adds an allow or block rule to the mailbox. Rules match the message's envelope sender. Domain entries also match subdomains. Block rules always win, both over allow rules and over the reply admission on allowlist mailboxes. An entry is either allow or block. Rules have no update operation, so a rule that needs the other action is a new rule and the old one is removed. A mailbox holds up to 200 rules.

post/v1/email/mailboxes/{mailbox_id}/receive-rules

Request

  • Base URL: https://us1.platform.bird.com
  • URL: https://us1.platform.bird.com/v1/email/mailboxes/{mailbox_id}/receive-rules
  • Auth: one of:
    • HTTP bearer
    • API key in cookie bird_session

Headers

Idempotency-Keystring

Client-supplied key. On operations supporting request deduplication, a retained response is replayed for duplicate requests with the same key within the idempotency window (3 hours by default). This protection requires a workspace, organization, or staff-account scope. User-only and unscoped unauthenticated operations, streams, and operations with a separate replay contract do not use this response replay.

On a supported operation, if idempotency protection is unavailable before execution, the API returns 503 IdempotencyUnavailable (E01033) without executing this attempt. Retry with backoff using the same key and request. An operation that takes effect before its response is retained can still execute again on retry.

Two distinct 409 errors signal misuse:

  • request_in_progress (E01004): The same key is currently being processed by a concurrent request. Wait briefly and retry. The lock expires within 30 seconds.
  • idempotency_key_reuse (E01005): The same key has already completed against a different request body or method. Generate a new key.

Recommended key format is <event-type>/<entity-id> (for example welcome-user/usr_abc123).

X-Workspace-Idstring

Workspace context for the request. Required for dashboard authentication and master keys. Workspace keys and access tokens already identify their workspace; send that workspace or omit the header. A different one is rejected.

X-Organization-Idstring

Organization context for the request. Required for dashboard authentication. An API key or access token carries its own organization, so send either that organization or no header at all; a different one is rejected.

Request body

action'allow' | 'block' required

What the rule does when it matches. Block rules always win. To flip an entry's action, delete the existing rule and re-create it.

entrystring required

The sender address (alice@example.com) or domain (example.com) to match. Domains also match their subdomains. Stored lowercase.

notestring

Your own note about why the rule exists.

Example request

{
  "action": "allow",
  "entry": "partner.example.com",
  "note": "Approved partner senders"
}

Response

Receive rule created.

idstring required
mailbox_idstring required
action'allow' | 'block' required

What the rule does when it matches. Block rules always win: over allow rules and over the reply admission on allowlist mailboxes.

entrystring required

The sender address or domain the rule matches. Domains also match their subdomains.

entry_type'address' | 'domain' required

Whether the entry is a full address or a domain.

notestring nullable required

Your own note about why the rule exists. null when unset.

created_atstring date-time required

When the rule was created.

Example response

{
  "id": "erl_01krdgeqcxet5s7t44vh8rt9mg",
  "mailbox_id": "mbx_01krdgeqcxet5s7t44vh8rt9mg",
  "entry": "partner.example.com"
}

Changes

No recorded changes to this operation across all 2 revisions of this API.