# Change one or more rules of the sending policy

`PUT /api/v1/email/policy`

- Authentication: Secret API key as a bearer token
- Billing: Free.
- Group: Email

Names only the rules that change; the rest stay as they were, and the change applies to the account's next lookup. `max_risk_score: null` ignores the score, `block_signals: []` blocks on no signal. A body naming none of the three rules is refused with a 422 keyed `policy`, because that is the shape a misspelled key takes.

## Request body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `max_risk_score` | integer | null | no | Block when risk_score is above this; null ignores the score. |
| `block_signals` | string[] | null | no | Signals that block whenever they fire, whatever the score. |
| `min_mailbox_confidence` | integer | null | no | Block an unconfirmed mailbox whose mailbox_confidence is below this; null ignores it. |

## Example request

```bash
curl -X PUT https://spaw.co/api/v1/email/policy \
  -H "Authorization: Bearer sk_live_…" \
  -H "Content-Type: application/json" \
  -d '{
  "max_risk_score": 40,
  "block_signals": [
    "disposable",
    "likely_typo",
    "parked_domain",
    "mx_blocklisted",
    "no_reply",
    "catch_all"
  ]
}'
```

## Responses

### 200 — The policy now in force.

## Error codes

- `UNAUTHENTICATED` — https://spaw.co/docs/errors/UNAUTHENTICATED
- `RATE_LIMITED` — https://spaw.co/docs/errors/RATE_LIMITED
- `VALIDATION_FAILED` — https://spaw.co/docs/errors/VALIDATION_FAILED

---

Canonical page: https://spaw.co/docs/api/update-email-policy · OpenAPI document: https://spaw.co/openapi.json · All endpoints: https://spaw.co/docs/api