{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Replaces an existing allow policy in full. Unlike PATCH, every field is taken from the request body, so optional fields that are omitted are reset rather than left untouched. Use this when managing policies declaratively.","properties":{"path":{"type":"object","properties":{"account_id":{"$ref":"#/definitions/email-security_identifier","description":"Account identifier tag."},"policy_id":{"$ref":"#/definitions/email-security_AllowPolicyId"}},"required":["account_id","policy_id"],"additionalProperties":false},"body":{"$ref":"#/definitions/email-security_CreateAllowPolicy"}},"required":["path","body"],"additionalProperties":false,"definitions":{"email-security_identifier":{"description":"Identifier.","type":"string","maxLength":32,"examples":["023e105f4ecef8ad9ca31a8372d0c353"]},"email-security_AllowPolicyId":{"description":"Allow policy identifier.","type":"string","format":"uuid","examples":["f174e90a-fafe-4643-bbbc-4a0ed4fc8415"]},"email-security_CreateAllowPolicy":{"description":"Create an allow policy.","allOf":[{"$ref":"#/definitions/email-security_AllowPolicy"}],"required":["is_exempt_recipient","is_trusted_sender","is_acceptable_sender","pattern","is_regex","verify_sender","pattern_type"]},"email-security_AllowPolicy":{"description":"An email allow policy.","type":"object","properties":{"comments":{"type":["string","null"],"maxLength":1024,"examples":["Trust all messages send from test@example.com"]},"expires_at":{"description":"Timestamp at which the policy expires. After this time, Email Security ignores the policy. The value must lie in the future. Send `null` to clear the expiration.","type":["string","null"],"format":"date-time","examples":["2027-01-01T00:00:00Z"]},"is_acceptable_sender":{"description":"Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply.","type":"boolean","examples":[false]},"is_exempt_recipient":{"description":"Bypasses all detections for messages to this recipient.","type":"boolean","examples":[false]},"is_recipient":{"description":"Deprecated as of July 1, 2025. Use `is_exempt_recipient` instead. End of life: July 1, 2026.","type":"boolean","examples":[false]},"is_regex":{"type":"boolean","examples":[false]},"is_sender":{"description":"Deprecated as of July 1, 2025. Use `is_trusted_sender` instead. End of life: July 1, 2026.","type":"boolean","examples":[true]},"is_spoof":{"description":"Deprecated as of July 1, 2025. Use `is_acceptable_sender` instead. End of life: July 1, 2026.","type":"boolean","examples":[false]},"is_trusted_sender":{"description":"Bypasses all detections and link following for messages from this sender.","type":"boolean","examples":[true]},"pattern":{"description":"The pattern value to match. The format depends on `pattern_type`: a valid email address for EMAIL (e.g. `user@example.com`), a valid domain name for DOMAIN (e.g. `example.com`), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. `1.2.3.4`, `1.2.3.0/24`, `2606:4700:4700::1111`, or `2606:4700:4700::/48`); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. The API also rejects a pattern that equals a domain onboarded to the account, ignoring case.","type":"string","maxLength":1024,"minLength":1,"examples":["test@example.com"]},"pattern_type":{"$ref":"#/definitions/email-security_PatternType"},"verify_sender":{"description":"Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication.","type":"boolean","examples":[true]}},"required":[]},"email-security_PatternType":{"description":"Type of pattern matching.\n- EMAIL: matches a full email address (e.g. `user@example.com`)\n- DOMAIN: matches a domain name (e.g. `example.com`)\n- IP: matches a plain IPv4 or IPv6 address (e.g. `1.2.3.4` or `2606:4700:4700::1111`) or CIDR block (e.g. `1.2.3.0/24` or `2606:4700:4700::/48`). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.\n- UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.\n","type":"string","enum":["EMAIL","DOMAIN","IP","UNKNOWN"],"examples":["EMAIL"]}}},"name":"Replace an email allow policy","id":"cloudflare.email_security_replace_allow_policy","example":{"path":{"account_id":"023e105f4ecef8ad9ca31a8372d0c353","policy_id":"f174e90a-fafe-4643-bbbc-4a0ed4fc8415"},"body":{"is_exempt_recipient":false,"is_trusted_sender":true,"is_acceptable_sender":false,"pattern":"test@example.com","is_regex":false,"verify_sender":true,"pattern_type":"EMAIL"}},"maxRequests":1,"summary":false}}