Shield rules

Create a shield rule

Allow, block, or reroute matching mail before it is stored.

POST/api/v1/shield-rules

cURL

curl -X POST "https://inboundr.net/api/v1/shield-rules" \
  -H "Authorization: Bearer $INBOUNDR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "<name>",
    "action": "<action>",
    "conditions": [],
    "field": "<field>",
    "operator": "<operator>",
    "value": "<value>",
    "endpointIds": [],
    "domainId": "<domainId>",
    "addressId": "<addressId>"
  }'

Creates a Shield rule. New rules are added last in the order, so adding one never changes what your existing rules do. Once you've confirmed it matches what you intended, move it up with Reorder.

namestringbodyrequired

A short label, up to 60 characters. It's shown in the console and on every block record the rule creates.

actionstringbodyrequired

One of allow, block or route.

allow: deliver normally and stop checking. Put one above a broad block to make an exception to it.
block: permanently drop the message. It's never stored or delivered, and only an envelope record is kept (see Reviewing blocked mail); the body can't be recovered. It does still count toward your monthly allotment, because the message was received before any rule could check it.
route: deliver to endpointIds instead of the address's own destinations.

conditionsarraybodyrequired

1 to 8 conditions. All of them must match (AND). For "either this or that", create two rules.

›Show condition

fieldstringbodyrequired

from, from_domain, to, subject, body, has_attachment, attachment_name, attachment_type, spam_verdict, spf_verdict, or dkim_verdict.

operatorstringbodyrequired

contains, not_contains, equals, starts_with, ends_with, is_true or is_false. Not every operator works with every field; see the table in Shield.

valuestringbody

Compared without regard to case. Leave it out for is_true and is_false.

endpointIdsarraybody

For route only. At most one webhook, the same limit addresses have. An empty array quarantines the message: it's stored and readable over the API, but delivered nowhere.

domainIdstringbody

Limit the rule to one domain (dom_…). Omit both scope fields to apply it to every domain on the account.

addressIdstringbody

Limit the rule to one address route (addr_…). Mutually exclusive with domainId.

Example response

201

{
  "id": "gr_123",
  "name": "Drop flagged spam",
  "action": "block",
  "priority": 2,
  "enabled": true,
  "scope": "account",
  "domainId": null,
  "addressId": null,
  "conditions": [
    { "field": "spam_verdict", "operator": "equals", "value": "FAIL" }
  ],
  "endpointIds": [],
  "createdAt": "2026-07-20T10:00:00.000Z"
}

A block rule deletes mail. There's no quarantine folder to recover it from and no body to look at afterwards, only the sender, recipient and subject in the block log. To see what a new rule catches before it deletes anything, test it first as a route rule with an empty endpointIds.

Each plan limits how many rules an account can have: 3 on Free, 10 on Basic and 50 on Pro, with no limit on Scale. Above the limit, this returns 402.