--- title: "Create" method: POST path: "/api/v1/policies" tags: ["Policy"] --- # Create `POST /api/v1/policies` Create a policy. ## Request body - C1ApiPolicyV1CreatePolicyRequest — The CreatePolicyRequest message is used to create a new policy. - `annotations` object — Bounded key/value metadata bag for IaC marking and customer tags. See .rfcs/object-annotations.md §2. Limits: ≤16 entries; keys 1–128 chars matching ^[A-Za-z][A-Za-z0-9._/-]{0,127}$; values 0–256 chars matching URL-safe ASCII; total serialized ≤4096 bytes. Keys starting with `c1/` are reserved for server-managed use and rejected on write. Well-known keys: `managed_by`, `iac_workspace`, `iac_resource_address`, `iac_tool_version`. - `baselinePolicyId` string — When set, the new policy's baseline defers to another policy of the same type when no rule matches, instead of an inline baseline step list. Mutually exclusive with the baseline entry in policy_steps. Requires the POLICY_REFERENCES_POLICY feature; obeys the same depth/cycle/self rules as Rule.policy_id. - `description` string — The description of the new policy. - `displayName` string, required — The display name of the new policy. - `policySteps` object — Step sequences for this policy. The map must include a baseline entry keyed by the lowercased policy type (e.g., "grant"). Additional entries with opaque keys can be added for conditional routing via the rules array. - `policyType` 'POLICY_TYPE_UNSPECIFIED' | 'POLICY_TYPE_GRANT' | 'POLICY_TYPE_REVOKE' | 'POLICY_TYPE_CERTIFY' | 'POLICY_TYPE_ACCESS_REQUEST' | 'POLICY_TYPE_PROVISION' — The type of policy to create (grant, revoke, or certify). - `postActions` C1ApiPolicyV1PolicyPostActions[], nullable — Ordered actions to execute after the policy completes processing. - `certifyRemediateImmediately` boolean, nullable — Only valid on certify policies. When true, any revocations resulting from the certification are applied immediately when the campaign task closes. This field is part of the `action` oneof. See the documentation for `c1.api.policy.v1.PolicyPostActions` for more details. - `reassignTasksToDelegates` boolean — This field is no longer used. Configure delegate reassignment in the policy step instead. - `rules` C1ApiPolicyV1Rule[], nullable — Conditional routing rules. See the Policy message for details on evaluation order. - `condition` string — A CEL expression that is evaluated against the request context. If it returns true, the step sequence identified by the outcome is used. - `policyId` string, nullable — The ID of another Policy that is evaluated recursively when this rule matches. The referenced policy must share this policy's policy_type, must not introduce a cycle, and must not push any reachable chain over depth 5. Gated by the POLICY_REFERENCES_POLICY feature flag. This field is part of the `outcome` oneof. See the documentation for `c1.api.policy.v1.Rule` for more details. - `policyKey` string — Deprecated: prefer outcome.step_key. Still read by the request path for backward compatibility with rules persisted before the outcome oneof existed. - `stepKey` string, nullable — A key into the policy's policy_steps map identifying which step sequence to execute when this rule's condition matches. This field is part of the `outcome` oneof. See the documentation for `c1.api.policy.v1.Rule` for more details. - `scope` C1ApiPolicyV1PolicyScope — Scopes a policy to an app or to a single entitlement within an app. - `appEntitlementId` string — Optional. When set, the policy is scoped to this entitlement of app_id rather than to the whole app. - `appId` string — The ID of the app this policy is scoped to. - `slot` 'POLICY_SCOPE_SLOT_UNSPECIFIED' | 'POLICY_SCOPE_SLOT_EMERGENCY' — Which of the object's local-policy slots this policy occupies. Part of the scope, and immutable with it. ## Response `200` The CreatePolicyResponse message contains the created policy object. - C1ApiPolicyV1CreatePolicyResponse — The CreatePolicyResponse message contains the created policy object. - `policy` C1ApiPolicyV1Policy — A policy defines a workflow (sequence of steps) that runs when processing access requests, reviews, or revocations. Policies support conditional routing: different conditions can trigger different step sequences, with a baseline fallback. - `annotations` object — Key/value metadata. Up to 16 entries; keys 1-128 chars; values 0-256 chars; URL-safe ASCII. Keys starting with `c1/` are reserved. Updates have PATCH semantics: keys absent from the request are preserved; an empty value deletes the key. Well-known keys: `managed_by`, `iac_workspace`, `iac_resource_address`, `iac_tool_version`. - `baselinePolicyId` string — When set, the baseline defers to another policy of the same type when no rule matches, instead of the baseline entry in policy_steps (keyed by the lowercased policy_type). Mutually exclusive with that baseline entry: set one or the other, not both. The referenced policy must share this policy's policy_type, must not introduce a cycle or self-reference, and must not push any reachable chain over depth 5. Gated by the POLICY_REFERENCES_POLICY feature flag. - `createdAt` string, date-time, nullable - `deletedAt` string, date-time, nullable - `description` string — The description of the Policy. - `displayName` string — The display name of the Policy. - `id` string — The ID of the Policy. - `policySteps` object — A map from string keys to step sequences. One entry is always the baseline, keyed by the lowercased policy_type (e.g., "grant", "revoke", "certify"). Additional entries have opaque keys (UUIDs) and are referenced by the rules array for conditional routing. If no conditional rules are configured, only the baseline entry exists. - `policyType` 'POLICY_TYPE_UNSPECIFIED' | 'POLICY_TYPE_GRANT' | 'POLICY_TYPE_REVOKE' | 'POLICY_TYPE_CERTIFY' | 'POLICY_TYPE_ACCESS_REQUEST' | 'POLICY_TYPE_PROVISION' — The type of this policy (grant, revoke, or certify). The lowercased type name (e.g., "grant") is also the key for the baseline entry in policy_steps. - `postActions` C1ApiPolicyV1PolicyPostActions[], nullable — Ordered actions to execute after the policy completes processing. - `certifyRemediateImmediately` boolean, nullable — Only valid on certify policies. When true, any revocations resulting from the certification are applied immediately when the campaign task closes. This field is part of the `action` oneof. See the documentation for `c1.api.policy.v1.PolicyPostActions` for more details. - `reassignTasksToDelegates` boolean — This field is no longer used. Configure delegate reassignment in the policy step instead. - `rules` C1ApiPolicyV1Rule[], nullable — Ordered conditional routing rules. Evaluated top-to-bottom; the first matching rule selects a step sequence from policy_steps. If no rule matches (or if this array is empty), the baseline entry in policy_steps is used. - `condition` string — A CEL expression that is evaluated against the request context. If it returns true, the step sequence identified by the outcome is used. - `policyId` string, nullable — The ID of another Policy that is evaluated recursively when this rule matches. The referenced policy must share this policy's policy_type, must not introduce a cycle, and must not push any reachable chain over depth 5. Gated by the POLICY_REFERENCES_POLICY feature flag. This field is part of the `outcome` oneof. See the documentation for `c1.api.policy.v1.Rule` for more details. - `policyKey` string — Deprecated: prefer outcome.step_key. Still read by the request path for backward compatibility with rules persisted before the outcome oneof existed. - `stepKey` string, nullable — A key into the policy's policy_steps map identifying which step sequence to execute when this rule's condition matches. This field is part of the `outcome` oneof. See the documentation for `c1.api.policy.v1.Rule` for more details. - `scope` C1ApiPolicyV1PolicyScope — Scopes a policy to an app or to a single entitlement within an app. - `appEntitlementId` string — Optional. When set, the policy is scoped to this entitlement of app_id rather than to the whole app. - `appId` string — The ID of the app this policy is scoped to. - `slot` 'POLICY_SCOPE_SLOT_UNSPECIFIED' | 'POLICY_SCOPE_SLOT_EMERGENCY' — Which of the object's local-policy slots this policy occupies. Part of the scope, and immutable with it. - `systemBuiltin` boolean — Whether this policy is a builtin system policy. Builtin system policies cannot be edited. - `updatedAt` string, date-time, nullable --- [API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)