---
title: "Create"
method: POST
path: "/api/v1/policies"
tags: ["Policy"]
---

# Create

`POST /api/v1/policies`

Create a policy.

## Request body

- C1ApiPolicyV1CreatePolicyRequest — The CreatePolicyRequest message is used to create a new policy.
  - `annotations` object — Bounded key/value metadata bag for IaC marking and customer tags. See .rfcs/object-annotations.md §2. Limits: ≤16 entries; keys 1–128 chars matching ^[A-Za-z][A-Za-z0-9._/-]{0,127}$; values 0–256 chars matching URL-safe ASCII; total serialized ≤4096 bytes. Keys starting with `c1/` are reserved for server-managed use and rejected on write. Well-known keys: `managed_by`, `iac_workspace`, `iac_resource_address`, `iac_tool_version`.
  - `description` string — The description of the new policy.
  - `displayName` string, required — The display name of the new policy.
  - `policySteps` object — Step sequences for this policy. The map must include a baseline entry keyed by the lowercased policy type (e.g., "grant"). Additional entries with opaque keys can be added for conditional routing via the rules array.
  - `policyType` 'POLICY_TYPE_UNSPECIFIED' | 'POLICY_TYPE_GRANT' | 'POLICY_TYPE_REVOKE' | 'POLICY_TYPE_CERTIFY' | 'POLICY_TYPE_ACCESS_REQUEST' | 'POLICY_TYPE_PROVISION' — The type of policy to create (grant, revoke, or certify).
  - `postActions` C1ApiPolicyV1PolicyPostActions[], nullable — Ordered actions to execute after the policy completes processing.
    - `certifyRemediateImmediately` boolean, nullable — Only valid on certify policies. When true, any revocations resulting from the certification are applied immediately when the campaign task closes. This field is part of the `action` oneof. See the documentation for `c1.api.policy.v1.PolicyPostActions` for more details.
  - `reassignTasksToDelegates` boolean — This field is no longer used. Configure delegate reassignment in the policy step instead.
  - `rules` C1ApiPolicyV1Rule[], nullable — Conditional routing rules. See the Policy message for details on evaluation order.
    - `condition` string — A CEL expression that is evaluated against the request context. If it returns true, the step sequence identified by policy_key is used.
    - `policyKey` string — A key into the policy's policy_steps map identifying which step sequence to execute when this rule's condition matches.

## Response `200`

The CreatePolicyResponse message contains the created policy object.

- C1ApiPolicyV1CreatePolicyResponse — The CreatePolicyResponse message contains the created policy object.
  - `policy` C1ApiPolicyV1Policy — A policy defines a workflow (sequence of steps) that runs when processing access requests, reviews, or revocations. Policies support conditional routing: different conditions can trigger different step sequences, with a baseline fallback.
    - `annotations` object — Key/value metadata. Up to 16 entries; keys 1-128 chars; values 0-256 chars; URL-safe ASCII. Keys starting with `c1/` are reserved. Updates have PATCH semantics: keys absent from the request are preserved; an empty value deletes the key. Well-known keys: `managed_by`, `iac_workspace`, `iac_resource_address`, `iac_tool_version`.
    - `createdAt` string, date-time
    - `deletedAt` string, date-time
    - `description` string — The description of the Policy.
    - `displayName` string — The display name of the Policy.
    - `id` string — The ID of the Policy.
    - `policySteps` object — A map from string keys to step sequences. One entry is always the baseline, keyed by the lowercased policy_type (e.g., "grant", "revoke", "certify"). Additional entries have opaque keys (UUIDs) and are referenced by the rules array for conditional routing. If no conditional rules are configured, only the baseline entry exists.
    - `policyType` 'POLICY_TYPE_UNSPECIFIED' | 'POLICY_TYPE_GRANT' | 'POLICY_TYPE_REVOKE' | 'POLICY_TYPE_CERTIFY' | 'POLICY_TYPE_ACCESS_REQUEST' | 'POLICY_TYPE_PROVISION' — The type of this policy (grant, revoke, or certify). The lowercased type name (e.g., "grant") is also the key for the baseline entry in policy_steps.
    - `postActions` C1ApiPolicyV1PolicyPostActions[], nullable — Ordered actions to execute after the policy completes processing.
      - `certifyRemediateImmediately` boolean, nullable — Only valid on certify policies. When true, any revocations resulting from the certification are applied immediately when the campaign task closes. This field is part of the `action` oneof. See the documentation for `c1.api.policy.v1.PolicyPostActions` for more details.
    - `reassignTasksToDelegates` boolean — This field is no longer used. Configure delegate reassignment in the policy step instead.
    - `rules` C1ApiPolicyV1Rule[], nullable — Ordered conditional routing rules. Evaluated top-to-bottom; the first matching rule selects a step sequence from policy_steps. If no rule matches (or if this array is empty), the baseline entry in policy_steps is used.
      - `condition` string — A CEL expression that is evaluated against the request context. If it returns true, the step sequence identified by policy_key is used.
      - `policyKey` string — A key into the policy's policy_steps map identifying which step sequence to execute when this rule's condition matches.
    - `systemBuiltin` boolean — Whether this policy is a builtin system policy. Builtin system policies cannot be edited.
    - `updatedAt` string, date-time

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/versions/d391405a35d3/schema)