---
title: "Add correspondent policy rule"
method: POST
path: "/v1/policy/rules"
tags: ["policy"]
---

# Add correspondent policy rule

`POST /v1/policy/rules`

## Request

- Base URL: `https://api.openmail.sh`
- URL: `https://api.openmail.sh/v1/policy/rules`
- Auth: HTTP bearer

Add one allow/block rule for a direction of a scope's policy. Inbox-scoped keys are rejected. A pod-scoped key may mutate its own pod or an inbox in that pod, never account-wide policy. Pod keys cannot add allows on a parent allowlist (blocks are fine).

## Query parameters

- `podId` string
- `inboxId` string

## Request body

- object
  - `type` 'allow' | 'block', required
  - `value` string, required: An email address (`user@example.com`), a whole domain (`example.com`), or a domain and all its subdomains (`*.example.com`, which also covers `example.com` itself).
  - `direction` 'inbound' | 'outbound': `inbound` governs who may send to the inbox; `outbound` governs who the inbox may send to (enforced across To, Cc, Bcc, and Reply-To on every send path).

## Response `201`

Rule created

- object: Rule created

## Other responses

- `403`: The authenticating key is scoped and cannot manage policy
- `404`: Pod or inbox not found
- `409`: An identical rule already exists (`rule_exists`)
- `422`: The value is not a valid email or domain

---

[API](https://skmtc.dev/openmail/apis/openmail-api.md) · [All operations](https://skmtc.dev/openmail/apis/openmail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/openmail/apis/openmail-api/revisions/b943eecca7e2?raw)