antiPhishRules

Anti-Phishing Rules. Recipient-scoping rules that bind anti-phishing policies. The antiPhishRules entity set lives under /exchange/v1.0/antiPhishRules in the Threat protection category.

Fact	Value
Path	/exchange/v1.0/antiPhishRules
Category	Threat protection
Tier	Tier 4, Threat protection
Read role	ThreatPolicy.Read.All (Community)
Write role	ThreatPolicy.ReadWrite.All (Enterprise)
Backing cmdlets	Get-AntiPhishRule, Set-AntiPhishRule, New-AntiPhishRule, Remove-AntiPhishRule, Enable-AntiPhishRule, Disable-AntiPhishRule

Routes

Method	Path	Synopsis	Role	Plan
GET	/exchange/v1.0/antiPhishRules	List antiPhishRules entries.	ThreatPolicy.Read	Community
POST	/exchange/v1.0/antiPhishRules	Create a new antiPhishRules entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.	ThreatPolicy.ReadWrite	Enterprise
GET	/exchange/v1.0/antiPhishRules/{key}	Get a single antiPhishRules entry by Identity.	ThreatPolicy.Read	Community
PATCH	/exchange/v1.0/antiPhishRules/{key}	Partial update of the antiPhishRules at /antiPhishRules/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when name is in the body).	ThreatPolicy.ReadWrite	Enterprise
DELETE	/exchange/v1.0/antiPhishRules/{key}	Remove the antiPhishRules at /antiPhishRules/{key}. Returns 204 with no body.	ThreatPolicy.ReadWrite	Enterprise
POST	/exchange/v1.0/antiPhishRules/{key}/disable	POST /antiPhishRules/{key}/disable - bound action via Disable-AntiPhishRule. Returns 204.	ThreatPolicy.ReadWrite	Enterprise
POST	/exchange/v1.0/antiPhishRules/{key}/enable	POST /antiPhishRules/{key}/enable - bound action via Enable-AntiPhishRule. Returns 204.	ThreatPolicy.ReadWrite	Enterprise

GET /exchange/v1.0/antiPhishRules

List antiPhishRules entries.

Backing cmdlet: Get-AntiPhishRule. Role: ThreatPolicy.Read (Community).

Parameter	In	Type	Required	Description
state	query	string		Server-side filter by rule enablement state (Get-AntiPhishRule -State). One of: Enabled | Disabled.

POST /exchange/v1.0/antiPhishRules

Create a new antiPhishRules entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.

Backing cmdlet: New-AntiPhishRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
antiPhishPolicy	body		yes
name	body		yes
comments	body
enabled	body
exceptIfRecipientDomainIs	body
exceptIfSentTo	body
exceptIfSentToMemberOf	body
priority	body
recipientDomainIs	body
sentTo	body
sentToMemberOf	body
dryRun	query	bool (switch)

Create an anti-phishing rule with a missing required field

Rejected create via New-AntiPhishRule when the required antiPhishPolicy field is omitted. New-AntiPhishRule requires both name and antiPhishPolicy.

POST /exchange/v1.0/antiPhishRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-antiPhishRules"
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": {
    "code": "BadRequest",
    "message": "The 'antiPhishPolicy' field is required.",
    "target": "antiPhishPolicy"
  },
  "correlationId": "0HN7K2QF9M3AB:00000001"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/antiPhishRules

Create an anti-phishing rule

Creates a new anti-phishing rule via New-AntiPhishRule. The rule binds an anti-phishing policy to recipient conditions and a priority.

POST /exchange/v1.0/antiPhishRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-antiPhishRules",
  "antiPhishPolicy": "exonaut-sample-antiPhishPolicy",
  "enabled": true,
  "comments": "EXONAUT sample anti-phishing rule.",
  "priority": 0,
  "recipientDomainIs": [
    "contoso.com"
  ],
  "sentTo": [
    "[email protected]"
  ]
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/antiPhishRules/exonaut-sample-antiPhishRules

{
  "Id": "exonaut-sample-antiPhishRules",
  "Identity": "exonaut-sample-antiPhishRules",
  "Name": "exonaut-sample-antiPhishRules",
  "AntiPhishPolicy": "exonaut-sample-antiPhishPolicy",
  "Priority": 0,
  "State": "Enabled",
  "RecipientDomainIs": [
    "contoso.com"
  ],
  "SentTo": [
    "[email protected]"
  ],
  "Comments": "EXONAUT sample anti-phishing rule."
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/antiPhishRules

GET /exchange/v1.0/antiPhishRules/{key}

Get a single antiPhishRules entry by Identity.

Backing cmdlet: Get-AntiPhishRule. Role: ThreatPolicy.Read (Community).

PATCH /exchange/v1.0/antiPhishRules/{key}

Partial update of the antiPhishRules at /antiPhishRules/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when name is in the body).

Backing cmdlet: Set-AntiPhishRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
antiPhishPolicy	body
comments	body
exceptIfRecipientDomainIs	body
exceptIfSentTo	body
exceptIfSentToMemberOf	body
name	body
priority	body
recipientDomainIs	body
sentTo	body
sentToMemberOf	body
dryRun	query	bool (switch)

Update an anti-phishing rule

Partial update of an anti-phishing rule via Set-AntiPhishRule. Only the body fields supplied are passed to the cmdlet; returns the post-update entity.

PATCH /exchange/v1.0/antiPhishRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "priority": 1,
  "comments": "EXONAUT sample anti-phishing rule (updated).",
  "recipientDomainIs": [
    "contoso.com",
    "sub.contoso.com"
  ]
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-antiPhishRules",
  "Identity": "exonaut-sample-antiPhishRules",
  "Name": "exonaut-sample-antiPhishRules",
  "AntiPhishPolicy": "exonaut-sample-antiPhishPolicy",
  "Priority": 1,
  "State": "Enabled",
  "RecipientDomainIs": [
    "contoso.com",
    "sub.contoso.com"
  ],
  "Comments": "EXONAUT sample anti-phishing rule (updated)."
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/antiPhishRules

DELETE /exchange/v1.0/antiPhishRules/{key}

Remove the antiPhishRules at /antiPhishRules/{key}. Returns 204 with no body.

Backing cmdlet: Remove-AntiPhishRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
dryRun	query	bool (switch)

Delete an anti-phishing rule

Removes an anti-phishing rule via Remove-AntiPhishRule. Returns 204 with no body.

DELETE /exchange/v1.0/antiPhishRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/antiPhishRules

POST /exchange/v1.0/antiPhishRules/{key}/disable

POST /antiPhishRules/{key}/disable - bound action via Disable-AntiPhishRule. Returns 204.

Backing cmdlet: Disable-AntiPhishRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
dryRun	query	bool (switch)

Disable an anti-phishing rule

Sub-resource of the anti-phishing rule at GET /antiPhishRules/{key} - disables the rule via the Disable-AntiPhishRule bound action. State becomes Disabled. Returns 204.

POST /exchange/v1.0/antiPhishRules/{key}/disable HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/antiPhishRules

POST /exchange/v1.0/antiPhishRules/{key}/enable

POST /antiPhishRules/{key}/enable - bound action via Enable-AntiPhishRule. Returns 204.

Defender rules use Enable/Disable bound actions instead of an enabled body field on Set-AntiPhishRule (Wiki SYNTAX has no -Enabled). State is observable on the rule entity’s State field (Enabled / Disabled).

Backing cmdlet: Enable-AntiPhishRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
dryRun	query	bool (switch)

Enable an antiPhishRule (bound action)

Bound action on the antiPhishRule at GET /antiPhishRules/{key}. Toggles the rule’s State to Enabled via Enable-AntiPhishRule. Defender rule families don’t expose -Enabled on Set-AntiPhishRule (per Wiki SYNTAX) - state changes go through these Enable/Disable bound actions instead. The same pattern applies across all 7 Defender rule families (safeLinksRules, safeAttachmentRules, malwareFilterRules, hostedContentFilterRules, hostedOutboundSpamFilterRules, reportSubmissionRules). Pass ?dryRun=true to preview via -WhatIf without flipping state.

POST /exchange/v1.0/antiPhishRules/{key}/enable HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 204 No Content

Related: POST /exchange/v1.0/antiPhishRules/{key}/disable, GET /exchange/v1.0/antiPhishRules/{key}, PATCH /exchange/v1.0/antiPhishRules/{key}

?dryRun=true previews of any write stay on Community.