Skip to main content
POST
Create a policy rule (project)

Authorizations

Authorization
string
header
required

API key obtained from the dashboard or GET /user/api-key

Body

application/json

rateLimit/rateLimitWindow are paired and, like requireApproval, valid only with action: allow.

name
string
required
Maximum string length: 255
action
enum<string>
required
Available options:
allow,
block
targets
object[]
required
Required array length: 1 - 100 elements
description
string
Maximum string length: 1000
enabled
boolean
default:true
rateLimit
integer
Required range: 1 <= x <= 1000000
rateLimitWindow
enum<string>
Available options:
minute,
hour,
day
requireApproval
boolean
conditions
any

A conditions array (max 10) or a session-policy object ({repositories: [...]} / {folders: [...]}; allow rules with a connection target only).

identities
object[]
Maximum array length: 100

Response

The created draft rule

A policy-engine rule (the staged draft → publish model). Writes land in the draft; only a publish makes them enforced. Published row ids regenerate on every publish; logicalId is the identity stable across statuses and generations.

id
string
scope
enum<string>
Available options:
project,
organization
status
enum<string>
Available options:
draft,
published
generation
integer

0 for the draft working copy; the snapshot number for published rows.

priority
integer

First-match order (lower evaluates first).

enabled
boolean
isDefault
boolean

True on the scope's terminal Default Rule.

logicalId
string

Generation-stable identity; compare rules across draft/published by this, never by id.

source
string

custom (user-owned, editable), default (the Default Rule), or system-managed blocklist/equipment rows. Self-hosted deployments that have not cut over to the policy engine may also expose read-only app_permission rows derived from the legacy model.

name
string
description
string | null
action
enum<string>
Available options:
allow,
block
rateLimit
integer | null
rateLimitWindow
enum<string> | null
Available options:
minute,
hour,
day,
null
requireApproval
boolean
conditions
any | null

A conditions array, a session-policy object ({repositories} / {folders}), or null.

identities
object[]
targets
object[]
createdAt
string<date-time>