Create a shield rule

curl --request POST \
  --url https://inboundr.net/api/v1/shield-rules \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "action": "<string>",
  "conditions": [
    {
      "field": "<string>",
      "operator": "<string>",
      "value": "<string>"
    }
  ],
  "endpointIds": [
    {}
  ],
  "domainId": "<string>",
  "addressId": "<string>"
}
'

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: '<string>',
    action: '<string>',
    conditions: [{field: '<string>', operator: '<string>', value: '<string>'}],
    endpointIds: [{}],
    domainId: '<string>',
    addressId: '<string>'
  })
};

fetch('https://inboundr.net/api/v1/shield-rules', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://inboundr.net/api/v1/shield-rules"

payload = {
    "name": "<string>",
    "action": "<string>",
    "conditions": [
        {
            "field": "<string>",
            "operator": "<string>",
            "value": "<string>"
        }
    ],
    "endpointIds": [{}],
    "domainId": "<string>",
    "addressId": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://inboundr.net/api/v1/shield-rules",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => '<string>',
    'action' => '<string>',
    'conditions' => [
        [
                'field' => '<string>',
                'operator' => '<string>',
                'value' => '<string>'
        ]
    ],
    'endpointIds' => [
        [
                
        ]
    ],
    'domainId' => '<string>',
    'addressId' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

{
  "id": "gr_123",
  "name": "Drop flagged spam",
  "action": "block",
  "priority": 2,
  "enabled": true,
  "scope": "account",
  "domainId": null,
  "addressId": null,
  "conditions": [
    { "field": "spam_verdict", "operator": "equals", "value": "FAIL" }
  ],
  "endpointIds": [],
  "createdAt": "2026-07-20T10:00:00.000Z"
}

POST

api

shield-rules

Create a shield rule

curl --request POST \
  --url https://inboundr.net/api/v1/shield-rules \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "action": "<string>",
  "conditions": [
    {
      "field": "<string>",
      "operator": "<string>",
      "value": "<string>"
    }
  ],
  "endpointIds": [
    {}
  ],
  "domainId": "<string>",
  "addressId": "<string>"
}
'

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: '<string>',
    action: '<string>',
    conditions: [{field: '<string>', operator: '<string>', value: '<string>'}],
    endpointIds: [{}],
    domainId: '<string>',
    addressId: '<string>'
  })
};

fetch('https://inboundr.net/api/v1/shield-rules', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://inboundr.net/api/v1/shield-rules"

payload = {
    "name": "<string>",
    "action": "<string>",
    "conditions": [
        {
            "field": "<string>",
            "operator": "<string>",
            "value": "<string>"
        }
    ],
    "endpointIds": [{}],
    "domainId": "<string>",
    "addressId": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://inboundr.net/api/v1/shield-rules",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => '<string>',
    'action' => '<string>',
    'conditions' => [
        [
                'field' => '<string>',
                'operator' => '<string>',
                'value' => '<string>'
        ]
    ],
    'endpointIds' => [
        [
                
        ]
    ],
    'domainId' => '<string>',
    'addressId' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

{
  "id": "gr_123",
  "name": "Drop flagged spam",
  "action": "block",
  "priority": 2,
  "enabled": true,
  "scope": "account",
  "domainId": null,
  "addressId": null,
  "conditions": [
    { "field": "spam_verdict", "operator": "equals", "value": "FAIL" }
  ],
  "endpointIds": [],
  "createdAt": "2026-07-20T10:00:00.000Z"
}

Creates a shield rule. New rules are appended last in the evaluation order, so adding one can never change what your existing rules do — move it up with Reorder once you’ve confirmed it matches what you meant.

string

required

Short label, up to 60 characters. Shown in the console and on every block record the rule produces.

string

required

One of allow, block, or route.

allow — deliver normally and stop. Put one above a broad block to carve out an exception.
block — permanently drop the message. It is never stored or delivered, and only an envelope record is kept (see List blocks); the body cannot be recovered. It does still count against your monthly allotment — the message was received before any rule could look at it.
route — deliver to endpointIds instead of the address’s own destinations.

array

required

1–8 conditions. All of them must match (AND). For “either/or”, create two rules.

Show condition

string

required

from, from_domain, to, subject, body, has_attachment, attachment_name, attachment_type, spam_verdict, spf_verdict, or dkim_verdict.

string

required

contains, not_contains, equals, starts_with, ends_with, is_true, or is_false. Not every operator suits every field — see the table in Shield.

string

Compared case-insensitively. Omit for is_true / is_false.

array

route only. At most one webhook and one email destination, the same fan-out limit addresses live under. An empty array quarantines: the message is stored and readable over the API, and delivered nowhere.

string

Limit the rule to one domain (dom_…). Omit both scope fields to apply it to every domain on the account.

string

Limit the rule to one address route (addr_…). Mutually exclusive with domainId.

{
  "id": "gr_123",
  "name": "Drop flagged spam",
  "action": "block",
  "priority": 2,
  "enabled": true,
  "scope": "account",
  "domainId": null,
  "addressId": null,
  "conditions": [
    { "field": "spam_verdict", "operator": "equals", "value": "FAIL" }
  ],
  "endpointIds": [],
  "createdAt": "2026-07-20T10:00:00.000Z"
}

A block rule deletes mail. There is no quarantine folder to recover it from and no body to inspect afterwards — only the sender, recipient, and subject in the block log. Test a new rule as route with an empty endpointIds first if you want to see what it catches before it starts destroying anything.

Plans cap how many rules an account may hold (3 on Free, 200 on Scale). Over the cap, this returns 402.

Reference

Domains

Email Addresses

Shield Rules

Endpoints

Emails

Threads

Attachments

Create a shield rule