safeAttachmentRules

Safe Attachments Rules. Rules mapping recipients to a Safe Attachments policy. The safeAttachmentRules entity set lives under /exchange/v1.0/safeAttachmentRules in the Threat protection category.

Fact	Value
Path	/exchange/v1.0/safeAttachmentRules
Category	Threat protection
Tier	Tier 4, Threat protection
Read role	ThreatPolicy.Read.All (Community)
Write role	ThreatPolicy.ReadWrite.All (Enterprise)
Backing cmdlets	Get-SafeAttachmentRule, Set-SafeAttachmentRule, New-SafeAttachmentRule, Remove-SafeAttachmentRule, Enable-SafeAttachmentRule, Disable-SafeAttachmentRule

Routes

Method	Path	Synopsis	Role	Plan
GET	/exchange/v1.0/safeAttachmentRules	List safeAttachmentRules entries.	ThreatPolicy.Read	Community
POST	/exchange/v1.0/safeAttachmentRules	Create a new safeAttachmentRules entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.	ThreatPolicy.ReadWrite	Enterprise
GET	/exchange/v1.0/safeAttachmentRules/{key}	Get a single safeAttachmentRules entry by Identity.	ThreatPolicy.Read	Community
PATCH	/exchange/v1.0/safeAttachmentRules/{key}	Partial update of the safeAttachmentRules at /safeAttachmentRules/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when name is in the body).	ThreatPolicy.ReadWrite	Enterprise
DELETE	/exchange/v1.0/safeAttachmentRules/{key}	Remove the safeAttachmentRules at /safeAttachmentRules/{key}. Returns 204 with no body.	ThreatPolicy.ReadWrite	Enterprise
POST	/exchange/v1.0/safeAttachmentRules/{key}/disable	POST /safeAttachmentRules/{key}/disable - bound action via Disable-SafeAttachmentRule. Returns 204.	ThreatPolicy.ReadWrite	Enterprise
POST	/exchange/v1.0/safeAttachmentRules/{key}/enable	POST /safeAttachmentRules/{key}/enable - bound action via Enable-SafeAttachmentRule. Returns 204.	ThreatPolicy.ReadWrite	Enterprise

GET /exchange/v1.0/safeAttachmentRules

List safeAttachmentRules entries.

Backing cmdlet: Get-SafeAttachmentRule. Role: ThreatPolicy.Read (Community).

Parameter	In	Type	Required	Description
state	query	string		Server-side filter by rule enablement state (Get-SafeAttachmentRule -State). One of: Enabled | Disabled.

List safeAttachmentRules

Stub auto-generated example for the safeAttachmentRules collection. Backing cmdlet: Get-SafeAttachmentRule. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.

GET /exchange/v1.0/safeAttachmentRules?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#safeAttachmentRules",
  "value": []
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

Related: GET /exchange/v1.0/safeAttachmentRules/{key}

POST /exchange/v1.0/safeAttachmentRules

Create a new safeAttachmentRules entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.

Backing cmdlet: New-SafeAttachmentRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
name	body		yes
safeAttachmentPolicy	body		yes
comments	body
enabled	body
exceptIfRecipientDomainIs	body
exceptIfSentTo	body
exceptIfSentToMemberOf	body
priority	body
recipientDomainIs	body
sentTo	body
sentToMemberOf	body
dryRun	query	bool (switch)

Create rejected - missing required SafeAttachmentPolicy

New-SafeAttachmentRule requires both name and safeAttachmentPolicy. Omitting safeAttachmentPolicy fails body validation with a canonical 400 envelope before the cmdlet is invoked.

POST /exchange/v1.0/safeAttachmentRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-safeAttachmentRules"
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": {
    "code": "BadRequest",
    "message": "The required field 'safeAttachmentPolicy' is required.",
    "target": "safeAttachmentPolicy"
  },
  "correlationId": "0HN7K2P9QF3R4:00000001"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/safeAttachmentRules

Create a Safe Attachments rule

Creates a Safe Attachments rule that binds a Safe Attachments policy to recipient conditions, backed by New-SafeAttachmentRule. The Name and SafeAttachmentPolicy fields are required.

POST /exchange/v1.0/safeAttachmentRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-safeAttachmentRules",
  "safeAttachmentPolicy": "exonaut-sample-safeAttachmentPolicy",
  "enabled": true,
  "priority": 0,
  "comments": "Applies Safe Attachments protection to the contoso.com domain.",
  "recipientDomainIs": [
    "contoso.com"
  ],
  "sentTo": [
    "[email protected]"
  ]
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/safeAttachmentRules/exonaut-sample-safeAttachmentRules

{
  "Id": "exonaut-sample-safeAttachmentRules",
  "Identity": "exonaut-sample-safeAttachmentRules",
  "Name": "exonaut-sample-safeAttachmentRules",
  "SafeAttachmentPolicy": "exonaut-sample-safeAttachmentPolicy",
  "State": "Enabled",
  "Priority": 0,
  "Comments": "Applies Safe Attachments protection to the contoso.com domain.",
  "RecipientDomainIs": [
    "contoso.com"
  ],
  "SentTo": [
    "[email protected]"
  ]
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/safeAttachmentRules

GET /exchange/v1.0/safeAttachmentRules/{key}

Get a single safeAttachmentRules entry by Identity.

Backing cmdlet: Get-SafeAttachmentRule. Role: ThreatPolicy.Read (Community).

Get a single safeAttachmentRules entry

Stub auto-generated example for GET /safeAttachmentRules/{key}. Backing cmdlet: Get-SafeAttachmentRule with -Identity {key}. Returns the full entity body; 404 if the identity doesn’t resolve.

GET /exchange/v1.0/safeAttachmentRules/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#safeAttachmentRules/$entity"
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

Related: GET /exchange/v1.0/safeAttachmentRules

PATCH /exchange/v1.0/safeAttachmentRules/{key}

Partial update of the safeAttachmentRules at /safeAttachmentRules/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when name is in the body).

Backing cmdlet: Set-SafeAttachmentRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
comments	body
exceptIfRecipientDomainIs	body
exceptIfSentTo	body
exceptIfSentToMemberOf	body
name	body
priority	body
recipientDomainIs	body
safeAttachmentPolicy	body
sentTo	body
sentToMemberOf	body
dryRun	query	bool (switch)

Update a Safe Attachments rule

Sub-resource of the rule at GET /safeAttachmentRules/{key} - partially updates the rule via Set-SafeAttachmentRule. Only the body fields supplied are passed to the cmdlet; returns 200 plus the re-fetched entity.

PATCH /exchange/v1.0/safeAttachmentRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "priority": 1,
  "comments": "Updated: scoped to the contoso.com finance team.",
  "sentToMemberOf": [
    "[email protected]"
  ]
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-safeAttachmentRules",
  "Identity": "exonaut-sample-safeAttachmentRules",
  "Name": "exonaut-sample-safeAttachmentRules",
  "SafeAttachmentPolicy": "exonaut-sample-safeAttachmentPolicy",
  "Priority": 1,
  "Comments": "Updated: scoped to the contoso.com finance team.",
  "SentToMemberOf": [
    "[email protected]"
  ]
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/safeAttachmentRules

DELETE /exchange/v1.0/safeAttachmentRules/{key}

Remove the safeAttachmentRules at /safeAttachmentRules/{key}. Returns 204 with no body.

Backing cmdlet: Remove-SafeAttachmentRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
dryRun	query	bool (switch)

Delete a Safe Attachments rule

Sub-resource of the rule at GET /safeAttachmentRules/{key} - removes the rule via Remove-SafeAttachmentRule. Returns 204 with no body.

DELETE /exchange/v1.0/safeAttachmentRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/safeAttachmentRules

POST /exchange/v1.0/safeAttachmentRules/{key}/disable

POST /safeAttachmentRules/{key}/disable - bound action via Disable-SafeAttachmentRule. Returns 204.

Backing cmdlet: Disable-SafeAttachmentRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
dryRun	query	bool (switch)

Disable a Safe Attachments rule

Sub-resource of the rule at GET /safeAttachmentRules/{key} - bound action that disables the rule via Disable-SafeAttachmentRule. Returns 204 with no body.

POST /exchange/v1.0/safeAttachmentRules/{key}/disable HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/safeAttachmentRules

POST /exchange/v1.0/safeAttachmentRules/{key}/enable

POST /safeAttachmentRules/{key}/enable - bound action via Enable-SafeAttachmentRule. Returns 204.

Backing cmdlet: Enable-SafeAttachmentRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
dryRun	query	bool (switch)

Enable a Safe Attachments rule

Sub-resource of the rule at GET /safeAttachmentRules/{key} - bound action that enables the rule via Enable-SafeAttachmentRule. Returns 204 with no body.

POST /exchange/v1.0/safeAttachmentRules/{key}/enable HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/safeAttachmentRules

?dryRun=true previews of any write stay on Community.