omeConfiguration

Message Encryption (OME). Branding and settings for Office 365 Message Encryption. The omeConfiguration entity set lives under /exchange/v1.0/omeConfiguration in the Encryption & rights category.

Fact	Value
Path	`/exchange/v1.0/omeConfiguration`
Category	Encryption & rights
Tier	Tier 9, Hybrid and organization
Read role	`OrganizationConfig.Read.All` (Community)
Write role	`OrganizationConfig.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-OMEConfiguration, Set-OMEConfiguration, New-OMEConfiguration, Remove-OMEConfiguration

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/omeConfiguration`	List Office Message Encryption (OME) portal branding configurations - corporate logo + colors shown on encrypted-mail recipient portals.	`OrganizationConfig.Read`	Community
POST	`/exchange/v1.0/omeConfiguration`	POST /omeConfiguration - create a new branded OME configuration. Required: identity (config name). Optional image (base64). Returns 201 + Location.	`OrganizationConfig.ReadWrite`	Enterprise
GET	`/exchange/v1.0/omeConfiguration/{key}`	Get a single OME configuration by Identity. Returns 404 if absent.	`OrganizationConfig.Read`	Community
PATCH	`/exchange/v1.0/omeConfiguration/{key}`	PATCH /omeConfiguration/{key} - update branding (colors, disclaimer, intro/portal/email text, logo image). Returns 200 + post-Set config.	`OrganizationConfig.ReadWrite`	Enterprise
DELETE	`/exchange/v1.0/omeConfiguration/{key}`	DELETE /omeConfiguration/{key} - remove an OME branded configuration. Returns 204.	`OrganizationConfig.ReadWrite`	Enterprise

GET /exchange/v1.0/omeConfiguration

List Office Message Encryption (OME) portal branding configurations - corporate logo + colors shown on encrypted-mail recipient portals.

Backing cmdlet: Get-OMEConfiguration. Role: OrganizationConfig.Read (Community).

POST /exchange/v1.0/omeConfiguration

POST /omeConfiguration - create a new branded OME configuration. Required: identity (config name). Optional image (base64). Returns 201 + Location.

Backing cmdlet: New-OMEConfiguration. Role: OrganizationConfig.ReadWrite (Enterprise).

Parameter	In	Type	Required
`identity`	body		yes
`backgroundColor`	body
`disclaimerText`	body
`emailText`	body
`externalMailExpiryInDays`	body
`image`	body
`introductionText`	body
`otpEnabled`	body
`portalText`	body
`privacyStatementUrl`	body
`readButtonText`	body
`socialIdSignIn`	body
`dryRun`	query	bool (switch)

Create a branded OME configuration

Provision an Office Message Encryption configuration with custom branding via New-OMEConfiguration. Required: identity (config name; the tenant’s default config is named ‘OME Configuration’ and cannot be removed). The image field accepts a base64-encoded PNG/JPEG of the corporate logo (controller decodes to Byte[] before invoking the cmdlet - same pattern as Block 2 FileData uploads). Other fields cover branding text (intro/portal/email/disclaimer/read-button), portal background color, external mail expiry, and end-user authentication options.

POST /exchange/v1.0/omeConfiguration HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "identity": "Contoso-Finance-Branding",
  "backgroundColor": "#0078D4",
  "introductionText": "Contoso Finance - secure message portal.",
  "portalText": "This message was sent by an authorized Contoso employee.",
  "emailText": "Click the button below to view the encrypted message in the secure portal.",
  "readButtonText": "Read Secure Message",
  "disclaimerText": "Confidential - do not forward.",
  "privacyStatementUrl": "https://contoso.com/privacy",
  "externalMailExpiryInDays": 30,
  "image": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQI12P4//8/AwAI/AL+Hgs1ywAAAABJRU5ErkJggg=="
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/omeConfiguration/Contoso-Finance-Branding

{
  "@odata.context": "https://api.contoso.com/exchange/v1.0/$metadata#omeConfiguration/$entity",
  "Id": "ome-finance-branding",
  "Name": "Contoso-Finance-Branding",
  "Identity": "Contoso-Finance-Branding",
  "BackgroundColor": "#0078D4",
  "IntroductionText": "Contoso Finance - secure message portal.",
  "PortalText": "This message was sent by an authorized Contoso employee.",
  "ReadButtonText": "Read Secure Message",
  "ExternalMailExpiryInDays": 30
}

GET /exchange/v1.0/omeConfiguration/{key}

Get a single OME configuration by Identity. Returns 404 if absent.

Backing cmdlet: Get-OMEConfiguration. Role: OrganizationConfig.Read (Community).

PATCH /exchange/v1.0/omeConfiguration/{key}

PATCH /omeConfiguration/{key} - update branding (colors, disclaimer, intro/portal/email text, logo image). Returns 200 + post-Set config.

Backing cmdlet: Set-OMEConfiguration. Role: OrganizationConfig.ReadWrite (Enterprise).

Parameter	In	Type
`backgroundColor`	body
`disclaimerText`	body
`emailText`	body
`externalMailExpiryInDays`	body
`image`	body
`introductionText`	body
`otpEnabled`	body
`portalText`	body
`privacyStatementUrl`	body
`readButtonText`	body
`socialIdSignIn`	body
`dryRun`	query	bool (switch)

Update OME branding configuration

Update an Office Message Encryption configuration’s branding via Set-OMEConfiguration. The {key} is the configuration Identity. Settable branding fields include portal background color, intro/portal/email/disclaimer/read-button text, external mail expiry, the logo image (base64-encoded PNG/JPEG, decoded to Byte[] controller-side), and end-user auth options (otpEnabled / socialIdSignIn). Returns 200 with the post-Set configuration.

PATCH /exchange/v1.0/omeConfiguration/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "backgroundColor": "#107C10",
  "introductionText": "Exonaut Finance - secure message portal.",
  "externalMailExpiryInDays": 14
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "@odata.context": "https://api.contoso.com/exchange/v1.0/$metadata#omeConfiguration/$entity",
  "Id": "exonaut-sample-omeConfiguration",
  "Name": "exonaut-sample-omeConfiguration",
  "Identity": "exonaut-sample-omeConfiguration",
  "BackgroundColor": "#107C10",
  "IntroductionText": "Exonaut Finance - secure message portal.",
  "ExternalMailExpiryInDays": 14
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

DELETE /exchange/v1.0/omeConfiguration/{key}

DELETE /omeConfiguration/{key} - remove an OME branded configuration. Returns 204.

Backing cmdlet: Remove-OMEConfiguration. Role: OrganizationConfig.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Remove an OME branding configuration

Remove an Office Message Encryption branded configuration via Remove-OMEConfiguration. The {key} is the configuration Identity. The tenant’s default configuration (‘OME Configuration’) cannot be removed. Returns 204 No Content.

DELETE /exchange/v1.0/omeConfiguration/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.