reportSubmissionRules

User Reporting Rules. Pair a user-reporting policy with the mailbox that receives reports. The reportSubmissionRules entity set lives under /exchange/v1.0/reportSubmissionRules in the Threat protection category.

Fact	Value
Path	`/exchange/v1.0/reportSubmissionRules`
Category	Threat protection
Tier	Tier 4, Threat protection
Read role	`ThreatPolicy.Read.All` (Community)
Write role	`ThreatPolicy.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-ReportSubmissionRule, Set-ReportSubmissionRule, New-ReportSubmissionRule, Remove-ReportSubmissionRule, Enable-ReportSubmissionRule, Disable-ReportSubmissionRule

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/reportSubmissionRules`	List reportSubmissionRules entries.	`ThreatPolicy.Read`	Community
POST	`/exchange/v1.0/reportSubmissionRules`	Create a new reportSubmissionRules entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.	`ThreatPolicy.ReadWrite`	Enterprise
GET	`/exchange/v1.0/reportSubmissionRules/{key}`	Get a single reportSubmissionRules entry by Identity.	`ThreatPolicy.Read`	Community
PATCH	`/exchange/v1.0/reportSubmissionRules/{key}`	Partial update of the reportSubmissionRules at /reportSubmissionRules/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when `name` is in the body).	`ThreatPolicy.ReadWrite`	Enterprise
DELETE	`/exchange/v1.0/reportSubmissionRules/{key}`	Remove the reportSubmissionRules at /reportSubmissionRules/{key}. Returns 204 with no body.	`ThreatPolicy.ReadWrite`	Enterprise
POST	`/exchange/v1.0/reportSubmissionRules/{key}/disable`	POST /reportSubmissionRules/{key}/disable - bound action via Disable-ReportSubmissionRule. Returns 204.	`ThreatPolicy.ReadWrite`	Enterprise
POST	`/exchange/v1.0/reportSubmissionRules/{key}/enable`	POST /reportSubmissionRules/{key}/enable - bound action via Enable-ReportSubmissionRule. Returns 204.	`ThreatPolicy.ReadWrite`	Enterprise

GET /exchange/v1.0/reportSubmissionRules

List reportSubmissionRules entries.

Backing cmdlet: Get-ReportSubmissionRule. Role: ThreatPolicy.Read (Community).

Parameter	In	Type	Required	Description
`state`	query	string		Server-side filter by rule enablement state (Get-ReportSubmissionRule -State). One of: Enabled \| Disabled.

List reportSubmissionRules

Stub auto-generated example for the reportSubmissionRules collection. Backing cmdlet: Get-ReportSubmissionRule. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.

GET /exchange/v1.0/reportSubmissionRules?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#reportSubmissionRules",
  "value": []
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

POST /exchange/v1.0/reportSubmissionRules

Create a new reportSubmissionRules entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.

Backing cmdlet: New-ReportSubmissionRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required
`name`	body		yes
`reportSubmissionPolicy`	body		yes
`comments`	body
`enabled`	body
`sentTo`	body
`dryRun`	query	bool (switch)

Create fails when a required field is missing

New-ReportSubmissionRule requires both name and reportSubmissionPolicy. Omitting reportSubmissionPolicy yields a 400 from body validation before the cmdlet is invoked.

POST /exchange/v1.0/reportSubmissionRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-reportSubmissionRules"
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": {
    "code": "BadRequest",
    "message": "The field 'reportSubmissionPolicy' is required.",
    "target": "reportSubmissionPolicy"
  },
  "correlationId": "0HN5K9F3A2B1C-00000001"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Create a report submission rule

Creates a report submission rule via the New-ReportSubmissionRule cmdlet. The rule associates a report submission policy with reporting behavior such as the destination mailbox for user-reported messages.

POST /exchange/v1.0/reportSubmissionRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-reportSubmissionRules",
  "reportSubmissionPolicy": "DefaultReportSubmissionPolicy",
  "enabled": true,
  "comments": "Created by Exonaut sample automation.",
  "sentTo": "secops@contoso.com"
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/reportSubmissionRules/exonaut-sample-reportSubmissionRules

{
  "Id": "exonaut-sample-reportSubmissionRules",
  "Identity": "exonaut-sample-reportSubmissionRules",
  "Name": "exonaut-sample-reportSubmissionRules",
  "ReportSubmissionPolicy": "DefaultReportSubmissionPolicy",
  "Enabled": true,
  "Comments": "Created by Exonaut sample automation.",
  "SentTo": "secops@contoso.com"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

GET /exchange/v1.0/reportSubmissionRules/{key}

Get a single reportSubmissionRules entry by Identity.

Backing cmdlet: Get-ReportSubmissionRule. Role: ThreatPolicy.Read (Community).

Get a single reportSubmissionRules entry

Stub auto-generated example for GET /reportSubmissionRules/{key}. Backing cmdlet: Get-ReportSubmissionRule with -Identity {key}. Returns the full entity body; 404 if the identity doesn’t resolve.

GET /exchange/v1.0/reportSubmissionRules/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#reportSubmissionRules/$entity"
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

PATCH /exchange/v1.0/reportSubmissionRules/{key}

Partial update of the reportSubmissionRules at /reportSubmissionRules/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when name is in the body).

Backing cmdlet: Set-ReportSubmissionRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type
`comments`	body
`name`	body
`reportSubmissionPolicy`	body
`sentTo`	body
`dryRun`	query	bool (switch)

Update a report submission rule

Partial update of a report submission rule via the Set-ReportSubmissionRule cmdlet. Only the body fields present are passed to the cmdlet; the post-Set entity is returned.

PATCH /exchange/v1.0/reportSubmissionRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "comments": "Updated by Exonaut sample automation.",
  "sentTo": "soc-team@contoso.com"
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-reportSubmissionRules",
  "Identity": "exonaut-sample-reportSubmissionRules",
  "Name": "exonaut-sample-reportSubmissionRules",
  "ReportSubmissionPolicy": "DefaultReportSubmissionPolicy",
  "Comments": "Updated by Exonaut sample automation.",
  "SentTo": "soc-team@contoso.com"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

DELETE /exchange/v1.0/reportSubmissionRules/{key}

Remove the reportSubmissionRules at /reportSubmissionRules/{key}. Returns 204 with no body.

Backing cmdlet: Remove-ReportSubmissionRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Delete a report submission rule

Removes a report submission rule via the Remove-ReportSubmissionRule cmdlet. Returns 204 with no body on success.

DELETE /exchange/v1.0/reportSubmissionRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

POST /exchange/v1.0/reportSubmissionRules/{key}/disable

POST /reportSubmissionRules/{key}/disable - bound action via Disable-ReportSubmissionRule. Returns 204.

Backing cmdlet: Disable-ReportSubmissionRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Disable a report submission rule

Sub-resource action of the report submission rule at GET /reportSubmissionRules/{key} - disables the rule via the Disable-ReportSubmissionRule cmdlet. Returns 204 with no body.

POST /exchange/v1.0/reportSubmissionRules/{key}/disable HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

POST /exchange/v1.0/reportSubmissionRules/{key}/enable

POST /reportSubmissionRules/{key}/enable - bound action via Enable-ReportSubmissionRule. Returns 204.

Backing cmdlet: Enable-ReportSubmissionRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Enable a report submission rule

Sub-resource action of the report submission rule at GET /reportSubmissionRules/{key} - enables the rule via the Enable-ReportSubmissionRule cmdlet. Returns 204 with no body.

POST /exchange/v1.0/reportSubmissionRules/{key}/enable HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.