tenantAllowBlockListSpoofItems

Spoofing Allow/Block Entries. Allow or block spoof exceptions that override anti-spoofing protection. The tenantAllowBlockListSpoofItems entity set lives under /exchange/v1.0/tenantAllowBlockListSpoofItems in the Threat protection category.

Fact	Value
Path	`/exchange/v1.0/tenantAllowBlockListSpoofItems`
Category	Threat protection
Tier	Tier 4, Threat protection
Read role	`ThreatPolicy.Read.All` (Community)
Write role	`ThreatPolicy.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-TenantAllowBlockListSpoofItems, New-TenantAllowBlockListSpoofItems, Set-TenantAllowBlockListSpoofItems, Remove-TenantAllowBlockListSpoofItems

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/tenantAllowBlockListSpoofItems`	List tenantAllowBlockListSpoofItems entries.	`ThreatPolicy.Read`	Community
POST	`/exchange/v1.0/tenantAllowBlockListSpoofItems`	Create a new tenantAllowBlockListSpoofItems entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.	`ThreatPolicy.ReadWrite`	Enterprise
PATCH	`/exchange/v1.0/tenantAllowBlockListSpoofItems/{key}`	PATCH /tenantAllowBlockListSpoofItems/{key} - only action (Allow/Block) is mutable. URL key → -Ids, Identity hardcoded to “Default”.	`ThreatPolicy.ReadWrite`	Enterprise
DELETE	`/exchange/v1.0/tenantAllowBlockListSpoofItems/{key}`	Remove the tenantAllowBlockListSpoofItems at /tenantAllowBlockListSpoofItems/{key}. Returns 204 with no body.	`ThreatPolicy.ReadWrite`	Enterprise

GET /exchange/v1.0/tenantAllowBlockListSpoofItems

List tenantAllowBlockListSpoofItems entries.

Backing cmdlet: Get-TenantAllowBlockListSpoofItems. Role: ThreatPolicy.Read (Community).

Parameter	In	Type	Required	Description
`action`	query	string
`spoofType`	query	string

List tenantAllowBlockListSpoofItems

Stub auto-generated example for the tenantAllowBlockListSpoofItems collection. Backing cmdlet: Get-TenantAllowBlockListSpoofItems. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.

GET /exchange/v1.0/tenantAllowBlockListSpoofItems?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#tenantAllowBlockListSpoofItems",
  "value": []
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

POST /exchange/v1.0/tenantAllowBlockListSpoofItems

Create a new tenantAllowBlockListSpoofItems entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.

Backing cmdlet: New-TenantAllowBlockListSpoofItems. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required
`action`	body		yes
`sendingInfrastructure`	body		yes
`spoofedUser`	body		yes
`spoofType`	body		yes
`dryRun`	query	bool (switch)

Create rejected when a required field is missing

New-TenantAllowBlockListSpoofItems requires action, sendingInfrastructure, spoofedUser, and spoofType. Omitting any of them yields a 400 with the canonical error envelope before the cmdlet is invoked.

POST /exchange/v1.0/tenantAllowBlockListSpoofItems HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "action": "Allow",
  "sendingInfrastructure": "contoso.com",
  "spoofType": "External"
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": {
    "code": "BadRequest",
    "message": "Body is missing required property 'spoofedUser'.",
    "target": "spoofedUser"
  },
  "correlationId": "0HN6Q2K9F3A1B"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Create an anti-spoof allow exception

Creates a Tenant Allow/Block List anti-spoof entry via New-TenantAllowBlockListSpoofItems. The Identity is always the implicit Default policy (set server-side); each entry is keyed by the SpoofedUser, SendingInfrastructure, and SpoofType triple.

POST /exchange/v1.0/tenantAllowBlockListSpoofItems HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "action": "Allow",
  "sendingInfrastructure": "contoso.com",
  "spoofedUser": "exonaut-sample@contoso.com",
  "spoofType": "External"
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/tenantAllowBlockListSpoofItems/exonaut-sample-tenantAllowBlockListSpoofItems

{
  "Id": "exonaut-sample-tenantAllowBlockListSpoofItems",
  "Identity": "Default",
  "action": "Allow",
  "sendingInfrastructure": "contoso.com",
  "spoofedUser": "exonaut-sample@contoso.com",
  "spoofType": "External"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

PATCH /exchange/v1.0/tenantAllowBlockListSpoofItems/{key}

PATCH /tenantAllowBlockListSpoofItems/{key} - only action (Allow/Block) is mutable. URL key → -Ids, Identity hardcoded to “Default”.

Backing cmdlet: Set-TenantAllowBlockListSpoofItems. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`action`	body		yes
`dryRun`	query	bool (switch)

Flip an anti-spoof entry from Allow to Block

Sub-resource of tenantAllowBlockListSpoofItems at GET /tenantAllowBlockListSpoofItems/{key} - updates an existing anti-spoof entry via Set-TenantAllowBlockListSpoofItems. Only the action field (Allow/Block) is mutable; the URL key maps to -Ids and Identity is hardcoded to Default.

PATCH /exchange/v1.0/tenantAllowBlockListSpoofItems/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "action": "Block"
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-tenantAllowBlockListSpoofItems",
  "Identity": "Default",
  "action": "Block",
  "sendingInfrastructure": "contoso.com",
  "spoofedUser": "exonaut-sample@contoso.com",
  "spoofType": "External"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

DELETE /exchange/v1.0/tenantAllowBlockListSpoofItems/{key}

Remove the tenantAllowBlockListSpoofItems at /tenantAllowBlockListSpoofItems/{key}. Returns 204 with no body.

Backing cmdlet: Remove-TenantAllowBlockListSpoofItems. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Remove an anti-spoof entry

Sub-resource of tenantAllowBlockListSpoofItems at GET /tenantAllowBlockListSpoofItems/{key} - removes an anti-spoof entry via Remove-TenantAllowBlockListSpoofItems. The URL key maps to -Ids and Identity is hardcoded to Default. Returns 204 with no body.

DELETE /exchange/v1.0/tenantAllowBlockListSpoofItems/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.