Create a policy rule (project)
Creates a DRAFT rule; it enforces only after a publish. Project rules take agent identities only (or none = all agents).
Authorizations
API key obtained from the dashboard or GET /user/api-key
Body
rateLimit/rateLimitWindow are paired and, like requireApproval, valid only with action: allow.
255allow, block 1 - 100 elements10001 <= x <= 1000000minute, hour, day A conditions array (max 10) or a session-policy object ({repositories: [...]} / {folders: [...]}; allow rules with a connection target only).
100Response
The created draft rule
A policy-engine rule (the staged draft → publish model). Writes land in the draft; only a publish makes them enforced. Published row ids regenerate on every publish; logicalId is the identity stable across statuses and generations.
project, organization draft, published 0 for the draft working copy; the snapshot number for published rows.
First-match order (lower evaluates first).
True on the scope's terminal Default Rule.
Generation-stable identity; compare rules across draft/published by this, never by id.
custom (user-owned, editable), default (the Default Rule), or system-managed blocklist/equipment rows. Self-hosted deployments that have not cut over to the policy engine may also expose read-only app_permission rows derived from the legacy model.
allow, block minute, hour, day, null A conditions array, a session-policy object ({repositories} / {folders}), or null.