{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Protects a new email domain by adding it to Email Security. Accepts a flat configuration object covering all delivery modes. Returns the newly created domain configuration.","properties":{"path":{"type":"object","properties":{"account_id":{"$ref":"#/definitions/email-security_identifier","description":"Account identifier tag."}},"required":["account_id"],"additionalProperties":false},"body":{"$ref":"#/definitions/email-security_CreateDomain"}},"required":["path","body"],"additionalProperties":false,"definitions":{"email-security_identifier":{"description":"Identifier.","type":"string","maxLength":32,"examples":["023e105f4ecef8ad9ca31a8372d0c353"]},"email-security_CreateDomain":{"type":"object","properties":{"allowed_delivery_modes":{"description":"Delivery modes to onboard the domain through.","type":"array","items":{"$ref":"#/definitions/email-security_DeliveryMode"},"maxItems":10,"minItems":1},"domain":{"description":"The email domain to protect.","type":"string"},"drop_dispositions":{"description":"Dispositions to drop instead of delivering, e.g. `[\"MALICIOUS\", \"SPAM\"]`.","type":"array","items":{"$ref":"#/definitions/email-security_DispositionLabel"},"maxItems":10},"folder":{"description":"The mailbox folder to scan, for API-scanning domains.","allOf":[{"$ref":"#/definitions/email-security_ScannableFolder"}]},"integration_id":{"description":"Identifier of the CASB integration that authorizes this domain. The integration also enables API scanning, post-delivery actions, and directory sync.","type":["string","null"],"format":"uuid"},"ip_restrictions":{"description":"Source IP ranges mail is accepted from. Any other source is rejected.","type":"array","items":{"type":"string"},"maxItems":100,"examples":[["192.0.2.0/24","2001:db8::/32"]]},"lookback_hops":{"description":"Number of hops to trace back through received headers when reconstructing the original message (1-20).","type":["integer","null"],"maximum":20,"minimum":1},"regions":{"description":"Regions that process messages for this domain, e.g. `[\"GLOBAL\"]` or `[\"US\"]`.","type":"array","items":{"$ref":"#/definitions/email-security_Region"},"maxItems":10,"minItems":1},"require_tls_inbound":{"description":"Require TLS on inbound connections.","type":["boolean","null"]},"require_tls_outbound":{"description":"Require TLS on outbound connections.","type":["boolean","null"]},"transport":{"description":"The mail transport hostname for MX/Inline delivery — the MX record Cloudflare delivers email to (e.g. `mx.example.com`).","type":["string","null"]}},"additionalProperties":false,"required":["domain","allowed_delivery_modes","ip_restrictions","drop_dispositions","regions"]},"email-security_DeliveryMode":{"type":"string","enum":["DIRECT","BCC","JOURNAL","API","RETRO_SCAN"]},"email-security_DispositionLabel":{"description":"The verdict Email Security assigns to a message.","type":"string","enum":["MALICIOUS","MALICIOUS-BEC","SUSPICIOUS","SPOOF","SPAM","BULK","ENCRYPTED","EXTERNAL","UNKNOWN","NONE"]},"email-security_ScannableFolder":{"description":"The mailbox folder to scan, for API-scanning domains.","type":["string","null"],"enum":["AllItems","Inbox",null]},"email-security_Region":{"description":"The region that processes messages for this domain.","type":"string","enum":["GLOBAL","AU","DE","IN","US"]}}},"name":"Add a new email domain","id":"cloudflare.email_security_create_domains","example":{"path":{"account_id":"023e105f4ecef8ad9ca31a8372d0c353"},"body":{"domain":"example","allowed_delivery_modes":["DIRECT"],"ip_restrictions":["192.0.2.0/24","2001:db8::/32"],"drop_dispositions":[],"regions":["GLOBAL"]}},"maxRequests":1,"summary":false}}