> ## Documentation Index
> Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Email permissions

> IAM actions for the Email API and the additional grants used across services.

Identity management, sending, diagnostics, and received-message access have separate IAM actions. The table includes the additional topic permission required when saving an incoming-mail rule.

## Actions

The endpoint reference describes request fields and responses. This table maps each call to its IAM action.

| Call | Required action |
| - | - |
| `GET /v1/identities/{identity_id}/receiving` | `email:GetReceivingConfiguration` |
| `PATCH /v1/identities/{identity_id}/receiving` | `email:UpdateReceivingConfiguration` |
| `GET /v1/received-messages` | `email:ListReceivedMessages` |
| `GET /v1/received-messages/{message_id}` | `email:DescribeReceivedMessage` |
| `GET /v1/received-messages/{message_id}/content` | `email:GetReceivedMessageContent` |
| `GET /v1/identities` | `email:ListIdentities` |
| `POST /v1/identities` | `email:CreateIdentity` |
| `GET /v1/identities/{identity_id}` | `email:DescribeIdentity` |
| `DELETE /v1/identities/{identity_id}` | `email:DeleteIdentity` |
| `PATCH /v1/identities/{identity_id}` | `email:UpdateIdentity` |
| `POST /v1/identities/{identity_id}/verify` | `email:VerifyIdentity` |
| `POST /v1/identities/{identity_id}/dkim/rotate` | `email:RotateDKIM` |
| `DELETE /v1/identities/{identity_id}/dkim/rotate` | `email:RotateDKIM` |
| `POST /v1/identities/{identity_id}/dkim/rotate/finalize` | `email:RotateDKIM` |
| `PATCH /v1/identities/{identity_id}/mail-from-domain` | `email:SetMailFromDomain` |
| `POST /v1/identities/{identity_id}/mail-from-domain/verify` | `email:VerifyMailFromDomain` |
| `PATCH /v1/identities/{identity_id}/bimi` | `email:SetBIMI` |
| `POST /v1/identities/{identity_id}/bimi/verify` | `email:VerifyBIMI` |
| `GET /v1/sent-messages` | `email:ListMessages` |
| `POST /v1/sent-messages` | `email:SendMessage` |
| `GET /v1/sent-messages/{message_id}` | `email:DescribeMessage` |
| `GET /v1/sent-messages/{message_id}/engagement` | `email:GetMessageEngagement` |
| `GET /v1/rejections` | `email:ListRejections` |
| `GET /v1/suppressions` | `email:ListSuppressions` |
| `POST /v1/suppressions` | `email:CreateSuppression` |
| `GET /v1/templates` | `email:ListTemplates` |
| `POST /v1/templates` | `email:CreateTemplate` |
| `GET /v1/templates/{template_id}` | `email:DescribeTemplate` |
| `PATCH /v1/templates/{template_id}` | `email:UpdateTemplate` |
| `DELETE /v1/templates/{template_id}` | `email:DeleteTemplate` |
| `GET /v1/configuration-sets` | `email:ListConfigurationSets` |
| `POST /v1/configuration-sets` | `email:CreateConfigurationSet` |
| `GET /v1/configuration-sets/{configuration_set_id}` | `email:DescribeConfigurationSet` |
| `PATCH /v1/configuration-sets/{configuration_set_id}` | `email:UpdateConfigurationSet` |
| `DELETE /v1/configuration-sets/{configuration_set_id}` | `email:DeleteConfigurationSet` |
| `POST /v1/configuration-sets/{configuration_set_id}/suppression-overrides` | `email:UpdateConfigurationSet` |
| `DELETE /v1/configuration-sets/{configuration_set_id}/suppression-overrides/{address}` | `email:UpdateConfigurationSet` |
| `GET /v1/ip-pools` | `email:ListIPPools` |
| `POST /v1/ip-pools` | `email:CreateIPPool` |
| `GET /v1/ip-pools/{ip_pool_id}` | `email:DescribeIPPool` |
| `PATCH /v1/ip-pools/{ip_pool_id}` | `email:UpdateIPPool` |
| `DELETE /v1/ip-pools/{ip_pool_id}` | `email:DeleteIPPool` |
| `GET /v1/dedicated-ips` | `email:ListDedicatedIPs` |
| `POST /v1/dedicated-ips` | `email:RequestDedicatedIP` |
| `GET /v1/dedicated-ips/{dedicated_ip_id}` | `email:DescribeDedicatedIP` |
| `PATCH /v1/dedicated-ips/{dedicated_ip_id}` | `email:UpdateDedicatedIP` |
| `DELETE /v1/dedicated-ips/{dedicated_ip_id}` | `email:ReleaseDedicatedIP` |
| `GET /v1/identities/{identity_id}/recipient-rules` | `email:ListRecipientRules` |
| `POST /v1/identities/{identity_id}/recipient-rules` | `notifications:Publish` |
| `GET /v1/identities/{identity_id}/recipient-rules/{rule_id}` | `email:DescribeRecipientRule` |
| `PATCH /v1/identities/{identity_id}/recipient-rules/{rule_id}` | `email:UpdateRecipientRule` |
| `DELETE /v1/identities/{identity_id}/recipient-rules/{rule_id}` | `email:DeleteRecipientRule` |
| `GET /v1/sent-messages/{message_id}/content` | `email:GetSentMessageContent` |
| `GET /v1/sent-messages/{message_id}/raw` | `email:GetSentMessageContent` |
| `GET /v1/sent-messages/{message_id}/attachments/{attachment_id}` | `email:GetSentMessageContent` |
| `GET /v1/received-messages/{message_id}/raw` | `email:GetReceivedMessageContent` |
| `GET /v1/received-messages/{message_id}/attachments/{attachment_id}` | `email:GetReceivedMessageContent` |
| `POST /v1/sent-messages/batch` | `email:SendMessage` |
| `GET /v1/suppressions/{suppression_id}` | `email:DescribeSuppression` |
| `PATCH /v1/suppressions/{suppression_id}` | `email:UpdateSuppression` |
| `DELETE /v1/suppressions/{suppression_id}` | `email:DeleteSuppression` |
| `GET /v1/identities/{identity_id}/dmarc-reports` | `email:ListDMARCReports` |

## Receiving rules require two grants

Saving a recipient rule requires `email:CreateRecipientRule` on the identity
and `notifications:Publish` on the destination topic. The topic must belong
to the same account. An explicit deny in its resource policy also blocks the
rule.

## Metadata and content are separate

`email:DescribeReceivedMessage` reads received-message metadata.
`email:GetReceivedMessageContent` reads content and downloads attachments.
Grant the content action only to callers that need access to the mail itself.

Open and click tracking URLs are used by recipient mail clients and browsers.
They are not management operations.

## Telemetry

Email charts use `telemetry:ReadMetrics`. This grant is separate from
`email:DescribeIdentity` and the diagnostic Email actions. See
[Email metrics](/email/metrics) for metric names and scope.

## Example policy

This policy grants only the listed collection reads. It does not grant permission to send messages or manage resources.

```json theme={null}
{
  "version": "2024-01-01",
  "statements": [
    {
      "effect": "allow",
      "actions": [
        "email:ListIdentities",
        "email:ListTemplates"
      ],
      "resources": [
        "*"
      ]
    }
  ]
}
```

See [IAM policies](/iam/policies) for policy evaluation and [Email](/email) for the service overview.

## Attachment buckets

Selecting a receiving bucket requires `storage:PutObject` and `storage:GetObject`
on its `email/{identity_id}/*` objects. This creates a bounded delegation for email
processing; current identity policies, permission boundaries, bucket policies, and
any session scope-down still apply. Bucket access failures defer incoming delivery.

Sending an existing object requires `storage:GetObject` on that object. Sending raw
MIME attachments to `attachments_bucket` requires both operations under
`email/{identity_id}/sent/*`. Customer buckets must be in the same account and region.
Message content permissions do not grant general access to unrelated bucket objects.

Template content requires `email:SendMessage` on the identity and `email:SendTemplatedMessage` on the template for both single and batch sends. Explicit denies apply to both resources. Updating a recipient rule requires `email:UpdateRecipientRule` and publication permission on its destination topic.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.