---
title: "POST /access-policies"
method: POST
path: "/access-policies"
---

# POST /access-policies

`POST /access-policies`

Creates an access policy that grants the specified identity (IAM Identity Center user, IAM Identity Center group, or IAM user) access to the specified IoT SiteWise Monitor portal or project resource.

## Request body

- object
  - `accessPolicyIdentity` object, required — <p>Contains an identity that can access an IoT SiteWise Monitor resource.</p> <note> <p>Currently, you can't use Amazon Web Services APIs to retrieve IAM Identity Center identity IDs. You can find the IAM Identity Center identity IDs in the URL of user and group pages in the <a href="https://console.aws.amazon.com/singlesignon">IAM Identity Center console</a>.</p> </note>
    - `user` object — An IAM Identity Center user identity.
      - `id` string, required — The IAM Identity Center ID of the user.
    - `group` object — An IAM Identity Center group identity.
      - `id` string, required — The IAM Identity Center ID of the group.
    - `iamUser` object — An IAM user identity.
      - `arn` string, required — <p>The ARN of the IAM user. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html">IAM ARNs</a> in the <i>IAM User Guide</i>.</p> <note> <p>If you delete the IAM user, access policies that contain this identity include an empty <code>arn</code>. You can delete the access policy for the IAM user that no longer exists.</p> </note>
    - `iamRole` object — An IAM role identity.
      - `arn` string, required — The ARN of the IAM role. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html">IAM ARNs</a> in the <i>IAM User Guide</i>.
  - `accessPolicyResource` object, required — Contains an IoT SiteWise Monitor resource ID for a portal or project.
    - `portal` object — A portal resource.
      - `id` string, required — The ID of the portal.
    - `project` object — A project resource.
      - `id` string, required — The ID of the project.
  - `accessPolicyPermission` 'ADMINISTRATOR' | 'VIEWER', required — The permission level for this access policy. Note that a project <code>ADMINISTRATOR</code> is also known as a project owner.
  - `clientToken` string — A unique case-sensitive identifier that you can provide to ensure the idempotency of the request. Don't reuse this client token if a new idempotent request is required.
  - `tags` object — A list of key-value pairs that contain metadata for the access policy. For more information, see <a href="https://docs.aws.amazon.com/iot-sitewise/latest/userguide/tag-resources.html">Tagging your IoT SiteWise resources</a> in the <i>IoT SiteWise User Guide</i>.

## Response `201`

Success

- CreateAccessPolicyResponse
  - `accessPolicyId` string, required — The ID of the access policy.
  - `accessPolicyArn` string, required — <p>The <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">ARN</a> of the access policy, which has the following format.</p> <p> <code>arn:${Partition}:iotsitewise:${Region}:${Account}:access-policy/${AccessPolicyId}</code> </p>

## Other responses

- `480` — InvalidRequestException
- `481` — ResourceNotFoundException
- `482` — InternalFailureException
- `483` — ThrottlingException
- `484` — LimitExceededException

---

[API](https://skmtc.net/aws/apis/iotsitewise.md) · [All operations](https://skmtc.net/aws/apis/iotsitewise/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/iotsitewise/versions/d13e5d3e0a6f/schema)