---
title: "Set inbox mail policy"
method: PUT
path: "/mail/v1/inboxes/{inboxId}/policy"
tags: ["Agents"]
---

# Set inbox mail policy

`PUT /mail/v1/inboxes/{inboxId}/policy`

Set the sender allowlist and send/reply/read access rules for an inbox owned by the authenticated organization.

## Path parameters

- `inboxId` string, required

## Request body

- object
  - `enforceSenderAllowlist` boolean
  - `allowedSenderPatterns` string[] — Exact emails, @domain rules, or *
  - `readAccessRules` string[] — Rules like organization, operator, user:<id>, api_key, api_key:<id>, clerk_session, or *
  - `replyAccessRules` string[] — Rules like organization, operator, user:<id>, api_key, api_key:<id>, clerk_session, or *
  - `sendAccessRules` string[] — Rules like organization, user:<id>, api_key, api_key:<id>, clerk_session, or *

## Response `200`

Inbox policy updated successfully

## Other responses

- `400` — Invalid inbox policy payload
- `401` — Invalid API key
- `403` — Write access required
- `404` — Inbox not found

---

[API](https://skmtc.net/casemark/apis/case-dev-api.md) · [All operations](https://skmtc.net/casemark/apis/case-dev-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/casemark/case-dev-api/versions/5b7e64e6d6f9/schema)