---
title: "Create"
method: POST
path: "/api/v1/credential-inventory-policies"
tags: ["Credential Inventory"]
---

# Create

`POST /api/v1/credential-inventory-policies`

Create a credential inventory policy.

## Request body

- C1ApiCredentialInventoryV1CredentialInventoryPolicyServiceCreateRequest — The CredentialInventoryPolicyServiceCreateRequest message.
  - `delegated` C1ApiCredentialInventoryV1DelegatedConstraints — DelegatedConstraints controls which third-party sign-in providers are accepted as proof of email ownership, and how they are scoped.
    - `googleEnabled` boolean — Accept "Sign in with Google".
    - `googleHostedDomains` string[], nullable — Restrict Google sign-in to these Google Workspace domains. Empty = any domain.
    - `microsoftEnabled` boolean — Accept "Sign in with Microsoft".
    - `microsoftTenantIds` string[], nullable — Restrict Microsoft sign-in to these Microsoft tenant IDs. Empty = any tenant.
  - `displayName` string, required — A human-readable name for the policy.
  - `emailOtp` C1ApiCredentialInventoryV1EmailOTPConstraints — EmailOTPConstraints configures one-time codes delivered by email.
    - `codeLength` integer — Number of digits in each code.
    - `maxAttempts` integer — Number of incorrect attempts allowed before the code is invalidated.
    - `ttlSeconds` integer — How long a code remains valid, in seconds.
  - `enabledTypes` string[], nullable — The credential types users are permitted to enroll under this policy.
  - `passkey` C1ApiCredentialInventoryV1PasskeyConstraints — PasskeyConstraints controls how users may enroll passkeys (FIDO2 / WebAuthn).
    - `allowedAaguids` string[], nullable — Allowed authenticator models, by AAGUID. Leave empty to permit any authenticator.
    - `attestation` 'ATTESTATION_REQUIREMENT_UNSPECIFIED' | 'ATTESTATION_REQUIREMENT_NONE' | 'ATTESTATION_REQUIREMENT_INDIRECT' | 'ATTESTATION_REQUIREMENT_DIRECT' | 'ATTESTATION_REQUIREMENT_ENTERPRISE' — How strictly the authenticator's origin must be attested.
    - `requireUserVerification` boolean — Require the authenticator to verify the user (PIN or biometric) at enrollment.
  - `password` C1ApiCredentialInventoryV1PasswordConstraints — PasswordConstraints sets the complexity rules a user's password must satisfy.
    - `checkBreached` boolean — Reject passwords found in known-breach corpora.
    - `historyDepth` integer — Number of previous passwords to remember and disallow reuse of.
    - `minLength` integer — Minimum length, in characters.
    - `requireMixedCase` boolean — Require both uppercase and lowercase letters.
    - `requireNumber` boolean — Require at least one digit.
    - `requireSymbol` boolean — Require at least one symbol.
  - `priority` integer — When a user matches more than one policy, the policy with the highest priority applies.
  - `totp` C1ApiCredentialInventoryV1TOTPConstraints — TOTPConstraints configures authenticator-app one-time codes (RFC 6238).
    - `codeLength` integer — Number of digits in each code.
    - `periodSeconds` integer — How often a new code is generated, in seconds (typically 30 or 60).
    - `skewTolerance` integer — How many adjacent time windows to accept, to tolerate clock drift.

## Response `200`

Successful response

- C1ApiCredentialInventoryV1CredentialInventoryPolicyServiceCreateResponse — The CredentialInventoryPolicyServiceCreateResponse message.
  - `credentialInventoryPolicy` C1ApiCredentialInventoryV1CredentialInventoryPolicy — CredentialInventoryPolicy defines which credential types your users may enroll and the rules for each type.
    - `createdAt` string, date-time, nullable
    - `delegated` C1ApiCredentialInventoryV1DelegatedConstraints — DelegatedConstraints controls which third-party sign-in providers are accepted as proof of email ownership, and how they are scoped.
      - `googleEnabled` boolean — Accept "Sign in with Google".
      - `googleHostedDomains` string[], nullable — Restrict Google sign-in to these Google Workspace domains. Empty = any domain.
      - `microsoftEnabled` boolean — Accept "Sign in with Microsoft".
      - `microsoftTenantIds` string[], nullable — Restrict Microsoft sign-in to these Microsoft tenant IDs. Empty = any tenant.
    - `deletedAt` string, date-time, nullable
    - `displayName` string — A human-readable name for the policy.
    - `emailOtp` C1ApiCredentialInventoryV1EmailOTPConstraints — EmailOTPConstraints configures one-time codes delivered by email.
      - `codeLength` integer — Number of digits in each code.
      - `maxAttempts` integer — Number of incorrect attempts allowed before the code is invalidated.
      - `ttlSeconds` integer — How long a code remains valid, in seconds.
    - `enabledTypes` string[], nullable — The credential types users are permitted to enroll under this policy.
    - `id` string — Unique identifier for the policy.
    - `isBuiltin` boolean — True for built-in policies provided by ConductorOne. Built-in policies cannot be edited or deleted.
    - `passkey` C1ApiCredentialInventoryV1PasskeyConstraints — PasskeyConstraints controls how users may enroll passkeys (FIDO2 / WebAuthn).
      - `allowedAaguids` string[], nullable — Allowed authenticator models, by AAGUID. Leave empty to permit any authenticator.
      - `attestation` 'ATTESTATION_REQUIREMENT_UNSPECIFIED' | 'ATTESTATION_REQUIREMENT_NONE' | 'ATTESTATION_REQUIREMENT_INDIRECT' | 'ATTESTATION_REQUIREMENT_DIRECT' | 'ATTESTATION_REQUIREMENT_ENTERPRISE' — How strictly the authenticator's origin must be attested.
      - `requireUserVerification` boolean — Require the authenticator to verify the user (PIN or biometric) at enrollment.
    - `password` C1ApiCredentialInventoryV1PasswordConstraints — PasswordConstraints sets the complexity rules a user's password must satisfy.
      - `checkBreached` boolean — Reject passwords found in known-breach corpora.
      - `historyDepth` integer — Number of previous passwords to remember and disallow reuse of.
      - `minLength` integer — Minimum length, in characters.
      - `requireMixedCase` boolean — Require both uppercase and lowercase letters.
      - `requireNumber` boolean — Require at least one digit.
      - `requireSymbol` boolean — Require at least one symbol.
    - `priority` integer — When a user matches more than one policy, the policy with the highest priority applies.
    - `totp` C1ApiCredentialInventoryV1TOTPConstraints — TOTPConstraints configures authenticator-app one-time codes (RFC 6238).
      - `codeLength` integer — Number of digits in each code.
      - `periodSeconds` integer — How often a new code is generated, in seconds (typically 30 or 60).
      - `skewTolerance` integer — How many adjacent time windows to accept, to tolerate clock drift.
    - `updatedAt` string, date-time, nullable

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)