# Rules & Restrictions

Each API token is authenticated and authorized. API authorization rules come from your Workspace Settings Restriction configuration.

### Gift Recipient Restrictions

| Restriction | Description |
|  --- | --- |
| Workspace Member | Senders are restricted to sending to `active` Workspace Members |
| Preloaded Recipient | Senders are restricted to sending to `active` Preloaded Recipients of the Workspace |
| Authorized Domain | Senders are restricted to sending to `whitelisted` domain recipients |


These restrictions can all be enabled individually. Here is the behaviour of each configuration

- Workspace and Preloaded is an **OR** logic, as long as recipient belongs to one
- Authorized Domain, **AND** logic, recipient email must be also part of the authorized domain
- Logic: `(Workspace || Preloaded Recipient) && Authorized Domain`


### Restriction Scenario Matrix

| Recipient Scenario | Workspace Recipient | Pre-loaded Recipient | Authorized Domain Recipient | Can Send? |
|  --- | --- | --- | --- | --- |
| - Part of Workspace member
- Part of authorized domain

 | Enabled `(passed)` | Enabled `(failed)` | Enabled `(passed)` | ✅ |
| - Part of Pre-loaded Recipient list
- Part of authorized domain

 | Enabled `(failed`) | Enabled `(passed)` | Enabled `(passed)` | ✅ |
| - Part of Workspace member
- Not part of authorized domain

 | Enabled `(passed)` | Enabled `(failed)` | Enabled `(failed)` | ❌ |
| - Part of Pre-loaded Recipient list
- Not part of authorized domain

 | Enabled `(failed)` | Enabled `(passed)` | Enabled `(failed)` | ❌ |
| - Part of Workspace member

 | Enabled `(passed)` | Enabled `(failed)` | Disabled | ✅ |
| - Part of Pre-loaded Recipient list

 | Enabled `(failed)` | Enabled `(passed)` | Disabled | ✅ |
| - Not Pre-loaded or Workspace Recipient

 | Enabled `(failed)` | Enabled `(failed)` | Disabled | ❌ |
| - Part of Workspace member

 | Enabled `(passed)` | Disabled | Disabled | ✅ |
| - Not Part of Workspace member

 | Enabled `(failed)` | Disabled | Disabled | ❌ |
| - Part of Pre-loaded Recipient list

 | Disabled | Enabled `(passed)` | Disabled | ✅ |
| - Not Part of Pre-loaded Recipient list

 | Disabled | Enabled `(failed)` | Disabled | ❌ |
| - Part of Authorized domain

 | Disabled | Disabled | Enabled `(passed)` | ✅ |
| - Not part of Authorized domain

 | Disabled | Disabled | Enabled `(failed)` | ❌ |
| - Part of Workspace member
- Recipient part of Authorized domain

 | Enabled `(passed)` | Disabled | Enabled `(passed)` | ✅ |
| - Not Part of Workspace member
- Recipient part of Authorized domain

 | Enabled `(failed)` | Disabled | Enabled `(passed)` | ❌ |
| - Part of Workspace member
- Not Recipient part of Authorized domain

 | Enabled `(passed)` | Disabled | Enabled `(failed)` | ❌ |
| - Not Part of Workspace member
- Not Recipient part of Authorized domain

 | Enabled `(failed)` | Disabled | Enabled `(failed)` | ❌ |
| - Part of Pre-loaded Recipient list
- Recipient part of Authorized domain

 | Disabled | Enabled `(passed)` | Enabled `(passed)` | ✅ |
| - Not Part of Pre-loaded Recipient list
- Recipient part of Authorized domain

 | Disabled | Enabled `(failed)` | Enabled `(passed)` | ❌ |
| - Part of Pre-loaded Recipient list
- Not Recipient part of Authorized domain

 | Disabled | Enabled `(passed)` | Enabled `(failed)` | ❌ |
| - Not Part of Pre-loaded Recipient list
- Not Recipient part of Authorized domain

 | Disabled | Enabled `(failed)` | Enabled `(failed)` | ❌ |


br
Need to generate a token? [See here](/version/pages/generate-api-token)