---
title: "Allowlist an inbox sender"
method: POST
path: "/v2/bills/inbox/senders"
---

# Allowlist an inbox sender

`POST /v2/bills/inbox/senders`

## Request

- Base URL: `https://api.slash.com`
- URL: `https://api.slash.com/v2/bills/inbox/senders`
- Auth: API key in header `X-API-Key`

Allow an email address or a whole domain to send bills to the inbox. Public email domains such as `gmail.com` can't be allowed as a domain.

## Request body

- BillInboxSenderCreate: Allowlist an email address or a whole domain for the accounts-payable inbox.
  - `type` 'email' | 'domain', required: `email` to allowlist one address, `domain` to allowlist every address at a domain.
  - `value` string, required: The address (`billing@vendor.com`) or bare domain (`vendor.com`), matched case-insensitively. Public mail providers such as `gmail.com` cannot be allowlisted as a domain; add the individual address instead.

## Response `200`

The allowlisted sender.

- BillInboxSender: An email address or domain the legal entity has allowlisted for its accounts-payable inbox. Invoices from an allowlisted sender become draft bills even when the sender is not a user, on the company's domain, or a known vendor.
  - `id` string, required: Sender id with the `ais_` prefix. Remove the sender with `DELETE /v2/bills/inbox/senders/{senderId}`.
  - `type` 'email' | 'domain', required: `email` matches one address exactly; `domain` matches every address at that domain.
  - `value` string, required: The lowercased address or bare domain.
  - `createdAt` string, date-time, required: When the sender was allowlisted.

## Other responses

- `400`: - `invalid_request (request shape)` — The body, query, or headers failed validation, or a required header is missing. `details` has one entry per failing location, keyed by JSON pointer or header name.
- `401`: - `unauthorized` — API key authentication is missing or invalid.
- `403`: - `forbidden` — The credential is not permitted to perform this action on the resource. When the resource is a field of the request, `details` names that `field` and the `id` it received. - `forbidden (legal entity)` — The credential is not permitted to act for the selected legal entity. - `not_available` — Public API v2 is not yet available. Use [Public API v1](https://docs.slash.com/introduction) in the meantime. - `user_api_key_required` — The API key is scoped to a legal entity rather than a user. Every v2 request needs a user API key, created under Settings → API keys in the Slash dashboard, together with the `x-legal-entity` header.
- `429`: The request exceeded the applicable rate limit. The response body is plain text, not the error object; clients must not depend on its wording.
- `500`: - `internal` — Slash could not complete the request. Quote `referenceId` when contacting Slash support.

## Changes

- **2026-10-16** `8b5d371ffeea`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/slashfi/apis/slash-public-api/changes/v2/bills/inbox/senders/post.md)

---

[API](https://skmtc.dev/slashfi/apis/slash-public-api.md) - [All operations](https://skmtc.dev/slashfi/apis/slash-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/slashfi/apis/slash-public-api/revisions/eaed2d63c9e2?raw)