> ## Documentation Index
> Fetch the complete documentation index at: https://docs.openmail.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Replace correspondent policy

> Declaratively set a scope's entire policy in one call — ideal for automated provisioning. Sets the inbound and/or outbound mode and REPLACES the scope's own rules for any direction you include. Rules created here are fail-closed (an empty allowlist denies all). Omitted directions are left untouched. Requires an account-wide API key.



## OpenAPI

````yaml /api-reference/openapi.json put /v1/policy
openapi: 3.0.3
info:
  title: OpenMail API
  description: >-
    Email infrastructure API for AI agents. Create inboxes, send and receive
    email, and get real-time notifications via webhooks.
  version: 1.0.0
  license:
    name: Proprietary
servers:
  - url: https://api.openmail.sh
security:
  - bearerAuth: []
tags:
  - name: pods
    description: Isolated sub-accounts for your end users or tenants
  - name: inboxes
    description: Email inboxes and their webhook configuration
  - name: messages
    description: Sending and listing messages
  - name: threads
    description: Conversation threads and read status
  - name: attachments
    description: Downloading and extracting text from attachments
  - name: policy
    description: >-
      Correspondent policy — provider-enforced allow/block rules and allowlist
      mode, scoped per account, pod, or inbox. Account-wide key only.
  - name: feedback
    description: Reporting bugs, friction, and feature requests to the OpenMail team
paths:
  /v1/policy:
    put:
      tags:
        - policy
      summary: Replace correspondent policy
      description: >-
        Declaratively set a scope's entire policy in one call — ideal for
        automated provisioning. Sets the inbound and/or outbound mode and
        REPLACES the scope's own rules for any direction you include. Rules
        created here are fail-closed (an empty allowlist denies all). Omitted
        directions are left untouched. Requires an account-wide API key.
      operationId: replacePolicy
      parameters:
        - schema:
            type: string
          in: query
          name: podId
          required: false
          description: >-
            Confine the operation to one pod's policy. Accepts the pod ID.
            Mutually exclusive with `inboxId`.
        - schema:
            type: string
          in: query
          name: inboxId
          required: false
          description: >-
            Confine the operation to one inbox's policy. Mutually exclusive with
            `podId`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: false
              properties:
                inbound:
                  type: object
                  additionalProperties: false
                  description: >-
                    Inbound (who may send to this scope) policy to set. Omit to
                    leave inbound untouched.
                  properties:
                    mode:
                      type: string
                      enum:
                        - none
                        - allowlist
                        - inherit
                      description: >-
                        `none` = no filtering; `allowlist` = only listed
                        correspondents are permitted (empty allowlist denies all
                        — fail closed); `inherit` = defer to the parent scope
                        (pod, then account). Not valid at the account scope.
                    rules:
                      type: array
                      maxItems: 500
                      description: >-
                        Replaces this scope's own inbound rules. Omit to leave
                        rules untouched; pass [] to clear them.
                      items:
                        type: object
                        additionalProperties: false
                        required:
                          - type
                          - value
                        properties:
                          type:
                            type: string
                            enum:
                              - allow
                              - block
                          value:
                            type: string
                            minLength: 3
                            maxLength: 253
                            description: >-
                              An email address (user@example.com) or a whole
                              domain (example.com).
                outbound:
                  type: object
                  additionalProperties: false
                  description: >-
                    Outbound (who this scope may send to) policy to set. Omit to
                    leave outbound untouched.
                  properties:
                    mode:
                      type: string
                      enum:
                        - none
                        - allowlist
                        - inherit
                      description: >-
                        `none` = no filtering; `allowlist` = only listed
                        correspondents are permitted (empty allowlist denies all
                        — fail closed); `inherit` = defer to the parent scope
                        (pod, then account). Not valid at the account scope.
                    rules:
                      type: array
                      maxItems: 500
                      description: >-
                        Replaces this scope's own outbound rules. Omit to leave
                        rules untouched; pass [] to clear them.
                      items:
                        type: object
                        additionalProperties: false
                        required:
                          - type
                          - value
                        properties:
                          type:
                            type: string
                            enum:
                              - allow
                              - block
                          value:
                            type: string
                            minLength: 3
                            maxLength: 253
      responses:
        '200':
          description: The resulting policy for the scope
          content:
            application/json:
              schema:
                description: The resulting policy for the scope
                type: object
                additionalProperties: true
        '403':
          description: The authenticating key is scoped and cannot manage policy
          content:
            application/json:
              schema:
                description: The authenticating key is scoped and cannot manage policy
                allOf:
                  - $ref: '#/components/schemas/Error'
        '404':
          description: Pod or inbox not found
          content:
            application/json:
              schema:
                description: Pod or inbox not found
                allOf:
                  - $ref: '#/components/schemas/Error'
        '422':
          description: Invalid mode for the scope, or an invalid rule value
          content:
            application/json:
              schema:
                description: Invalid mode for the scope, or an invalid rule value
                allOf:
                  - $ref: '#/components/schemas/Error'
components:
  schemas:
    Error:
      type: object
      additionalProperties: true
      properties:
        error:
          type: string
        message:
          type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: API key

````