---
title: "Create a receive rule"
method: POST
path: "/v1/email/mailboxes/{mailbox_id}/receive-rules"
tags: ["email-mailboxes"]
---

# Create a receive rule

`POST /v1/email/mailboxes/{mailbox_id}/receive-rules`

## Request

- Base URL: `https://us1.platform.bird.com`
- URL: `https://us1.platform.bird.com/v1/email/mailboxes/{mailbox_id}/receive-rules`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `bird_session`

Adds an allow or block rule to the mailbox. Rules match the message's envelope sender. Domain entries also match subdomains. Block rules always win, both over allow rules and over the reply admission on allowlist mailboxes. An entry is either allow or block. Rules have no update operation, so a rule that needs the other action is a new rule and the old one is removed. A mailbox holds up to 200 rules.

## Headers

- `Idempotency-Key` string
- `X-Workspace-Id` string
- `X-Organization-Id` string

## Request body

- ReceiveRuleCreate: Parameters for adding a receive rule to a mailbox.
  - `action` 'allow' | 'block', required: What the rule does when it matches. Block rules always win. To flip an entry's action, delete the existing rule and re-create it.
  - `entry` string, required: The sender address (`alice@example.com`) or domain (`example.com`) to match. Domains also match their subdomains. Stored lowercase.
  - `note` string: Your own note about why the rule exists.

## Response `201`

Receive rule created.

- ReceiveRule: An allow or block entry on a mailbox, evaluated when inbound mail arrives. Matching is against the message's envelope sender; domain entries also match subdomains. A given entry can be allow or block, never both.
  - `id` string, required
  - `mailbox_id` string, required
  - `action` 'allow' | 'block', required: What the rule does when it matches. Block rules always win: over allow rules and over the reply admission on allowlist mailboxes.
  - `entry` string, required: The sender address or domain the rule matches. Domains also match their subdomains.
  - `entry_type` 'address' | 'domain', required: Whether the entry is a full address or a domain.
  - `note` string, nullable, required: Your own note about why the rule exists. `null` when unset.
  - `created_at` string, date-time, required: When the rule was created.

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Insufficient permissions
- `404`: Resource not found
- `409`: Resource conflict
- `422`: The request has invalid field values, violates a business rule, or carries a query parameter the endpoint does not declare. Field validation errors use `type: validation_error` and include the affected fields in `details`. Business-rule errors identify the failed rule in `type`.
- `429`: Rate limit exceeded
- `500`: Internal server error
- `503`: The service is temporarily unavailable. If `Retry-After` is present, wait for that delay before retrying; otherwise, retry with exponential backoff. Reuse the same idempotency key and request when retrying a mutation.

---

[API](https://skmtc.dev/messagebird/apis/bird-api.md) · [All operations](https://skmtc.dev/messagebird/apis/bird-api/llms.txt) · [OpenAPI document](https://skmtc.dev/messagebird/apis/bird-api/revisions/3e2a50466454?raw)