> ## Documentation Index > Fetch the complete documentation index at: https://inbound.new/docs/llms.txt > Use this file to discover all available pages before exploring further. # Create guard rule > Create an active email filtering rule for the authenticated account. For an `explicit` rule, configure one or more of `subject`, `from`, `to`, `hasAttachment`, and `hasWords`. Different configured criteria are combined with AND. Within a criterion, `OR` matches any value and `AND` requires every value. Address criteria support exact, case-insensitive addresses and whole-domain patterns such as `*@example.com`. The `to` criterion matches the actual delivered recipient, which makes it suitable for limiting a rule to one inbox. Subject and body criteria use case-insensitive substring matching. Rules are evaluated from highest priority to lowest, and the first matching rule wins. A matching rule can `allow`, `block`, mark as `junk`, or `route` the email to an active endpoint owned by the account. If action is omitted, it defaults to `allow`. `junk` marks the email as junk without blocking it: it is still delivered to endpoints (with `spam.isJunk: true` in the webhook) and appears in mailbox Junk folders. `allow` also marks the email as not junk, overriding the spam filter. For an `ai_prompt` rule, provide a non-empty natural-language `prompt` describing when the rule should match. ## OpenAPI ````yaml https://inbound.new/openapi.json post /api/e2/guard openapi: 3.1.0 info: title: Inbound Email API description: >+ # Inbound API The Inbound API allows you to manage email infrastructure programmatically - domains, email addresses, webhooks, and more. ## Authentication All API requests require a Bearer token in the Authorization header: ```bash curl -H "Authorization: Bearer YOUR_API_KEY" \ https://inbound.new/api/e2/domains ``` ## Base URL ``` https://inbound.new/api/e2 ``` ## Quick Start 1. **Create a domain** - Register your domain with Inbound 2. **Configure DNS** - Add the provided DNS records to your domain 3. **Create an email address** - Set up addresses to receive emails 4. **Create an endpoint** - Configure where emails are delivered (webhook, forwarding, etc.) version: 2.0.0 servers: - url: https://inbound.new description: Production API server security: - bearerAuth: [] tags: - name: Webhooks description: Webhooks sent by Inbound to your configured endpoints when events occur. - name: Emails description: >- Send, list, and manage emails. Supports immediate sending, scheduling, replies, and retry functionality. - name: Mail description: >- Inbox and thread views for received emails. Filter by domain, address, or search. - name: Domains description: >- Manage domains for sending and receiving emails. Domains must be verified via DNS before use. - name: Endpoints description: >- Configure where incoming emails are delivered - webhooks, email forwarding, or custom handlers. - name: Email Addresses description: Create and manage email addresses on your verified domains. - name: Attachments description: Download email attachments using authenticated requests. paths: /api/e2/guard: post: tags: - Guard summary: Create guard rule description: >- Create an active email filtering rule for the authenticated account. For an `explicit` rule, configure one or more of `subject`, `from`, `to`, `hasAttachment`, and `hasWords`. Different configured criteria are combined with AND. Within a criterion, `OR` matches any value and `AND` requires every value. Address criteria support exact, case-insensitive addresses and whole-domain patterns such as `*@example.com`. The `to` criterion matches the actual delivered recipient, which makes it suitable for limiting a rule to one inbox. Subject and body criteria use case-insensitive substring matching. Rules are evaluated from highest priority to lowest, and the first matching rule wins. A matching rule can `allow`, `block`, mark as `junk`, or `route` the email to an active endpoint owned by the account. If action is omitted, it defaults to `allow`. `junk` marks the email as junk without blocking it: it is still delivered to endpoints (with `spam.isJunk: true` in the webhook) and appears in mailbox Junk folders. `allow` also marks the email as not junk, overriding the spam filter. For an `ai_prompt` rule, provide a non-empty natural-language `prompt` describing when the rule should match. operationId: postApiE2Guard requestBody: required: true content: application/json: schema: examples: - name: Block suspicious support invoices description: Block invoice emails with attachments sent to support. type: explicit priority: 100 config: to: operator: OR values: - support@example.com subject: operator: OR values: - invoice - payment overdue hasAttachment: true action: action: block - name: Route partner purchase orders type: explicit priority: 50 config: from: operator: OR values: - '*@partner.example' hasWords: operator: AND values: - purchase order - account number action: action: route endpointId: endpoint_123 - name: Block credential phishing type: ai_prompt config: mode: simple prompt: >- Match messages attempting to steal passwords, MFA codes, or login credentials. action: action: block type: object properties: name: minLength: 1 description: A descriptive name for the rule. type: string description: description: Optional explanation of what the rule handles. type: string type: type: string enum: - explicit - ai_prompt config: description: >- Configuration matching the selected rule type. See the request examples for complete explicit and AI configurations. oneOf: - title: Explicit rule configuration type: object properties: mode: type: string enum: - simple - advanced subject: type: object required: - operator - values properties: operator: type: string enum: - OR - AND description: >- OR matches any value; AND requires every value to match. values: type: array minItems: 1 items: type: string description: Case-insensitive substrings to match. from: type: object required: - operator - values properties: operator: type: string enum: - OR - AND description: >- OR matches any address; AND requires every pattern to match. values: type: array minItems: 1 items: type: string description: >- Exact email addresses or whole-domain patterns such as *@example.com. to: type: object required: - operator - values properties: operator: type: string enum: - OR - AND description: >- OR matches any address; AND requires every pattern to match. values: type: array minItems: 1 items: type: string description: >- Exact email addresses or whole-domain patterns such as *@example.com. hasAttachment: type: boolean description: >- Match emails based on whether they contain attachments. hasWords: type: object required: - operator - values properties: operator: type: string enum: - OR - AND description: >- OR matches any value; AND requires every value to match. values: type: array minItems: 1 items: type: string description: Case-insensitive substrings to match. - title: AI prompt rule configuration type: object required: - prompt properties: mode: type: string enum: - simple - advanced prompt: type: string minLength: 1 description: >- Natural-language description of when the rule should match. priority: description: >- Evaluation priority. Higher values run first; the first matching rule wins. Defaults to 0. default: 0 type: number action: description: >- Action to take when the rule matches: allow (also marks the email as not junk), block, junk, or route to an owned endpoint. Defaults to allow when omitted. oneOf: - title: Allow description: Deliver the email and mark it as not junk. type: object required: - action properties: action: const: allow - title: Block type: object required: - action properties: action: const: block - title: Junk description: >- Mark the email as junk. It is still delivered to endpoints, and shown in the Junk folder of mailboxes. type: object required: - action properties: action: const: junk - title: Route type: object required: - action - endpointId properties: action: const: route endpointId: type: string description: ID of an active endpoint owned by the account. required: - name - type - config application/x-www-form-urlencoded: schema: examples: - name: Block suspicious support invoices description: Block invoice emails with attachments sent to support. type: explicit priority: 100 config: to: operator: OR values: - support@example.com subject: operator: OR values: - invoice - payment overdue hasAttachment: true action: action: block - name: Route partner purchase orders type: explicit priority: 50 config: from: operator: OR values: - '*@partner.example' hasWords: operator: AND values: - purchase order - account number action: action: route endpointId: endpoint_123 - name: Block credential phishing type: ai_prompt config: mode: simple prompt: >- Match messages attempting to steal passwords, MFA codes, or login credentials. action: action: block type: object properties: name: minLength: 1 description: A descriptive name for the rule. type: string description: description: Optional explanation of what the rule handles. type: string type: type: string enum: - explicit - ai_prompt config: description: >- Configuration matching the selected rule type. See the request examples for complete explicit and AI configurations. oneOf: - title: Explicit rule configuration type: object properties: mode: type: string enum: - simple - advanced subject: type: object required: - operator - values properties: operator: type: string enum: - OR - AND description: >- OR matches any value; AND requires every value to match. values: type: array minItems: 1 items: type: string description: Case-insensitive substrings to match. from: type: object required: - operator - values properties: operator: type: string enum: - OR - AND description: >- OR matches any address; AND requires every pattern to match. values: type: array minItems: 1 items: type: string description: >- Exact email addresses or whole-domain patterns such as *@example.com. to: type: object required: - operator - values properties: operator: type: string enum: - OR - AND description: >- OR matches any address; AND requires every pattern to match. values: type: array minItems: 1 items: type: string description: >- Exact email addresses or whole-domain patterns such as *@example.com. hasAttachment: type: boolean description: >- Match emails based on whether they contain attachments. hasWords: type: object required: - operator - values properties: operator: type: string enum: - OR - AND description: >- OR matches any value; AND requires every value to match. values: type: array minItems: 1 items: type: string description: Case-insensitive substrings to match. - title: AI prompt rule configuration type: object required: - prompt properties: mode: type: string enum: - simple - advanced prompt: type: string minLength: 1 description: >- Natural-language description of when the rule should match. priority: description: >- Evaluation priority. Higher values run first; the first matching rule wins. Defaults to 0. default: 0 type: number action: description: >- Action to take when the rule matches: allow (also marks the email as not junk), block, junk, or route to an owned endpoint. Defaults to allow when omitted. oneOf: - title: Allow description: Deliver the email and mark it as not junk. type: object required: - action properties: action: const: allow - title: Block type: object required: - action properties: action: const: block - title: Junk description: >- Mark the email as junk. It is still delivered to endpoints, and shown in the Junk folder of mailboxes. type: object required: - action properties: action: const: junk - title: Route type: object required: - action - endpointId properties: action: const: route endpointId: type: string description: ID of an active endpoint owned by the account. required: - name - type - config multipart/form-data: schema: examples: - name: Block suspicious support invoices description: Block invoice emails with attachments sent to support. type: explicit priority: 100 config: to: operator: OR values: - support@example.com subject: operator: OR values: - invoice - payment overdue hasAttachment: true action: action: block - name: Route partner purchase orders type: explicit priority: 50 config: from: operator: OR values: - '*@partner.example' hasWords: operator: AND values: - purchase order - account number action: action: route endpointId: endpoint_123 - name: Block credential phishing type: ai_prompt config: mode: simple prompt: >- Match messages attempting to steal passwords, MFA codes, or login credentials. action: action: block type: object properties: name: minLength: 1 description: A descriptive name for the rule. type: string description: description: Optional explanation of what the rule handles. type: string type: type: string enum: - explicit - ai_prompt config: description: >- Configuration matching the selected rule type. See the request examples for complete explicit and AI configurations. oneOf: - title: Explicit rule configuration type: object properties: mode: type: string enum: - simple - advanced subject: type: object required: - operator - values properties: operator: type: string enum: - OR - AND description: >- OR matches any value; AND requires every value to match. values: type: array minItems: 1 items: type: string description: Case-insensitive substrings to match. from: type: object required: - operator - values properties: operator: type: string enum: - OR - AND description: >- OR matches any address; AND requires every pattern to match. values: type: array minItems: 1 items: type: string description: >- Exact email addresses or whole-domain patterns such as *@example.com. to: type: object required: - operator - values properties: operator: type: string enum: - OR - AND description: >- OR matches any address; AND requires every pattern to match. values: type: array minItems: 1 items: type: string description: >- Exact email addresses or whole-domain patterns such as *@example.com. hasAttachment: type: boolean description: >- Match emails based on whether they contain attachments. hasWords: type: object required: - operator - values properties: operator: type: string enum: - OR - AND description: >- OR matches any value; AND requires every value to match. values: type: array minItems: 1 items: type: string description: Case-insensitive substrings to match. - title: AI prompt rule configuration type: object required: - prompt properties: mode: type: string enum: - simple - advanced prompt: type: string minLength: 1 description: >- Natural-language description of when the rule should match. priority: description: >- Evaluation priority. Higher values run first; the first matching rule wins. Defaults to 0. default: 0 type: number action: description: >- Action to take when the rule matches: allow (also marks the email as not junk), block, junk, or route to an owned endpoint. Defaults to allow when omitted. oneOf: - title: Allow description: Deliver the email and mark it as not junk. type: object required: - action properties: action: const: allow - title: Block type: object required: - action properties: action: const: block - title: Junk description: >- Mark the email as junk. It is still delivered to endpoints, and shown in the Junk folder of mailboxes. type: object required: - action properties: action: const: junk - title: Route type: object required: - action - endpointId properties: action: const: route endpointId: type: string description: ID of an active endpoint owned by the account. required: - name - type - config responses: '201': description: The newly created active guard rule. content: application/json: schema: description: The newly created active guard rule. examples: - success: true data: id: V1StGXR8_Z5jdHi6B-myT userId: user_123 name: Block suspicious support invoices description: Block invoice emails with attachments sent to support. type: explicit config: >- {"to":{"operator":"OR","values":["support@example.com"]},"subject":{"operator":"OR","values":["invoice","payment overdue"]},"hasAttachment":true} isActive: true priority: 100 lastTriggeredAt: null triggerCount: 0 actions: '{"action":"block"}' createdAt: '2026-06-12T17:00:00.000Z' updatedAt: '2026-06-12T17:00:00.000Z' type: object properties: success: const: true type: boolean data: type: object properties: id: type: string userId: type: string name: type: string description: nullable: true anyOf: - type: string - type: 'null' type: type: string config: type: string isActive: nullable: true anyOf: - type: boolean - type: 'null' priority: nullable: true anyOf: - type: number - type: 'null' lastTriggeredAt: nullable: true anyOf: - type: string - type: 'null' triggerCount: nullable: true anyOf: - type: number - type: 'null' actions: nullable: true anyOf: - type: string - type: 'null' createdAt: nullable: true anyOf: - type: string - type: 'null' updatedAt: nullable: true anyOf: - type: string - type: 'null' required: - id - userId - name - description - type - config - isActive - priority - lastTriggeredAt - triggerCount - actions - createdAt - updatedAt required: - success - data '400': description: Response for status 400 content: application/json: schema: type: object properties: error: type: string required: - error '401': description: Response for status 401 content: application/json: schema: type: object properties: error: type: string required: - error '500': description: Response for status 500 content: application/json: schema: type: object properties: error: type: string required: - error x-codeSamples: - lang: typescript label: TypeScript source: |- import Inbound from "inboundemail"; const inbound = new Inbound(); const result = await inbound.guard.create({ name: "Block suspicious support invoices", type: "explicit", config: { to: { operator: "OR", values: [ "support@example.com" ] }, subject: { operator: "OR", values: [ "invoice", "payment overdue" ] }, hasAttachment: true }, description: "Block invoice emails with attachments sent to support.", priority: 100, action: { action: "block" } }); - lang: curl label: cURL source: |- curl -X POST 'https://inbound.new/api/e2/guard' \ -H "Authorization: Bearer $INBOUND_API_KEY" \ -H 'Content-Type: application/json' \ -d '{ "name": "Block suspicious support invoices", "type": "explicit", "config": { "to": { "operator": "OR", "values": [ "support@example.com" ] }, "subject": { "operator": "OR", "values": [ "invoice", "payment overdue" ] }, "hasAttachment": true }, "description": "Block invoice emails with attachments sent to support.", "priority": 100, "action": { "action": "block" } }' components: securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: API Key description: >- Your Inbound API key. Include it in the Authorization header as: Bearer ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.