safeLinksRules

Safe Links Rules. Rules mapping recipients to a Safe Links policy. The safeLinksRules entity set lives under /exchange/v1.0/safeLinksRules in the Threat protection category.

Fact	Value
Path	/exchange/v1.0/safeLinksRules
Category	Threat protection
Tier	Tier 4, Threat protection
Read role	ThreatPolicy.Read.All (Community)
Write role	ThreatPolicy.ReadWrite.All (Enterprise)
Backing cmdlets	Get-SafeLinksRule, Set-SafeLinksRule, New-SafeLinksRule, Remove-SafeLinksRule, Enable-SafeLinksRule, Disable-SafeLinksRule

Routes

Method	Path	Synopsis	Role	Plan
GET	/exchange/v1.0/safeLinksRules	List safeLinksRules entries.	ThreatPolicy.Read	Community
POST	/exchange/v1.0/safeLinksRules	Create a new safeLinksRules entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.	ThreatPolicy.ReadWrite	Enterprise
GET	/exchange/v1.0/safeLinksRules/{key}	Get a single safeLinksRules entry by Identity.	ThreatPolicy.Read	Community
PATCH	/exchange/v1.0/safeLinksRules/{key}	Partial update of the safeLinksRules at /safeLinksRules/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when name is in the body).	ThreatPolicy.ReadWrite	Enterprise
DELETE	/exchange/v1.0/safeLinksRules/{key}	Remove the safeLinksRules at /safeLinksRules/{key}. Returns 204 with no body.	ThreatPolicy.ReadWrite	Enterprise
POST	/exchange/v1.0/safeLinksRules/{key}/disable	POST /safeLinksRules/{key}/disable - bound action via Disable-SafeLinksRule. Returns 204.	ThreatPolicy.ReadWrite	Enterprise
POST	/exchange/v1.0/safeLinksRules/{key}/enable	POST /safeLinksRules/{key}/enable - bound action via Enable-SafeLinksRule. Returns 204.	ThreatPolicy.ReadWrite	Enterprise

GET /exchange/v1.0/safeLinksRules

List safeLinksRules entries.

Backing cmdlet: Get-SafeLinksRule. Role: ThreatPolicy.Read (Community).

Parameter	In	Type	Required	Description
state	query	string		Server-side filter by rule enablement state (Get-SafeLinksRule -State). One of: Enabled | Disabled.

List safeLinksRules

Stub auto-generated example for the safeLinksRules collection. Backing cmdlet: Get-SafeLinksRule. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.

GET /exchange/v1.0/safeLinksRules?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#safeLinksRules",
  "value": []
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

Related: GET /exchange/v1.0/safeLinksRules/{key}

POST /exchange/v1.0/safeLinksRules

Create a new safeLinksRules entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.

Backing cmdlet: New-SafeLinksRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
name	body		yes
safeLinksPolicy	body		yes
comments	body
enabled	body
exceptIfRecipientDomainIs	body
exceptIfSentTo	body
exceptIfSentToMemberOf	body
priority	body
recipientDomainIs	body
sentTo	body
sentToMemberOf	body
dryRun	query	bool (switch)

Create a Safe Links rule - missing required field

New-SafeLinksRule requires both name and safeLinksPolicy. Omitting safeLinksPolicy fails validation before the cmdlet runs and returns a 400 envelope.

POST /exchange/v1.0/safeLinksRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-safeLinksRules"
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": {
    "code": "BadRequest",
    "message": "The field 'safeLinksPolicy' is required.",
    "target": "safeLinksPolicy"
  },
  "correlationId": "0HN7Q2K3M4P5R-00000001"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/safeLinksRules

Create a Safe Links rule

Creates a new Safe Links rule via New-SafeLinksRule. The rule binds recipient conditions to a Safe Links policy (referenced by name through safeLinksPolicy).

POST /exchange/v1.0/safeLinksRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-safeLinksRules",
  "safeLinksPolicy": "exonaut-sample-safeLinksPolicy",
  "enabled": true,
  "comments": "EXONAUT sample Safe Links rule",
  "priority": 0,
  "recipientDomainIs": [
    "contoso.com"
  ],
  "sentTo": [
    "user@contoso.com"
  ]
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/safeLinksRules/exonaut-sample-safeLinksRules

{
  "Id": "exonaut-sample-safeLinksRules",
  "Identity": "exonaut-sample-safeLinksRules",
  "Name": "exonaut-sample-safeLinksRules",
  "SafeLinksPolicy": "exonaut-sample-safeLinksPolicy",
  "State": "Enabled",
  "Priority": 0,
  "Comments": "EXONAUT sample Safe Links rule",
  "RecipientDomainIs": [
    "contoso.com"
  ],
  "SentTo": [
    "user@contoso.com"
  ]
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/safeLinksRules

GET /exchange/v1.0/safeLinksRules/{key}

Get a single safeLinksRules entry by Identity.

Backing cmdlet: Get-SafeLinksRule. Role: ThreatPolicy.Read (Community).

Get a single safeLinksRules entry

Stub auto-generated example for GET /safeLinksRules/{key}. Backing cmdlet: Get-SafeLinksRule with -Identity {key}. Returns the full entity body; 404 if the identity doesn’t resolve.

GET /exchange/v1.0/safeLinksRules/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#safeLinksRules/$entity"
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

Related: GET /exchange/v1.0/safeLinksRules

PATCH /exchange/v1.0/safeLinksRules/{key}

Partial update of the safeLinksRules at /safeLinksRules/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when name is in the body).

Backing cmdlet: Set-SafeLinksRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
comments	body
exceptIfRecipientDomainIs	body
exceptIfSentTo	body
exceptIfSentToMemberOf	body
name	body
priority	body
recipientDomainIs	body
safeLinksPolicy	body
sentTo	body
sentToMemberOf	body
dryRun	query	bool (switch)

Update a Safe Links rule

Sub-resource of the rule at GET /safeLinksRules/{key} - partially updates it via Set-SafeLinksRule. Only the body fields supplied are passed to the cmdlet; the post-Set entity is returned.

PATCH /exchange/v1.0/safeLinksRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "comments": "Updated EXONAUT sample Safe Links rule",
  "priority": 1,
  "recipientDomainIs": [
    "contoso.com",
    "fabrikam.contoso.com"
  ]
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-safeLinksRules",
  "Identity": "exonaut-sample-safeLinksRules",
  "Name": "exonaut-sample-safeLinksRules",
  "SafeLinksPolicy": "exonaut-sample-safeLinksPolicy",
  "Priority": 1,
  "Comments": "Updated EXONAUT sample Safe Links rule",
  "RecipientDomainIs": [
    "contoso.com",
    "fabrikam.contoso.com"
  ]
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/safeLinksRules

DELETE /exchange/v1.0/safeLinksRules/{key}

Remove the safeLinksRules at /safeLinksRules/{key}. Returns 204 with no body.

Backing cmdlet: Remove-SafeLinksRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
dryRun	query	bool (switch)

Delete a Safe Links rule

Sub-resource of the rule at GET /safeLinksRules/{key} - removes it via Remove-SafeLinksRule. Returns 204 with no body.

DELETE /exchange/v1.0/safeLinksRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/safeLinksRules

POST /exchange/v1.0/safeLinksRules/{key}/disable

POST /safeLinksRules/{key}/disable - bound action via Disable-SafeLinksRule. Returns 204.

Backing cmdlet: Disable-SafeLinksRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
dryRun	query	bool (switch)

Disable a Safe Links rule

Sub-resource of the rule at GET /safeLinksRules/{key} - bound action that disables it via Disable-SafeLinksRule. Returns 204 with no body.

POST /exchange/v1.0/safeLinksRules/{key}/disable HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/safeLinksRules

POST /exchange/v1.0/safeLinksRules/{key}/enable

POST /safeLinksRules/{key}/enable - bound action via Enable-SafeLinksRule. Returns 204.

Backing cmdlet: Enable-SafeLinksRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
dryRun	query	bool (switch)

Enable a Safe Links rule

Sub-resource of the rule at GET /safeLinksRules/{key} - bound action that enables it via Enable-SafeLinksRule. Returns 204 with no body.

POST /exchange/v1.0/safeLinksRules/{key}/enable HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/safeLinksRules

?dryRun=true previews of any write stay on Community.