---
title: "POST /v1/{+parent}/authorizationPolicies"
method: POST
path: "/v1/{+parent}/authorizationPolicies"
tags: ["projects"]
---

# POST /v1/{+parent}/authorizationPolicies

`POST /v1/{+parent}/authorizationPolicies`

Creates a new AuthorizationPolicy in a given project and location.

## Path parameters

- `parent` string, required

## Query parameters

- `authorizationPolicyId` string

## Request body

- AuthorizationPolicy — AuthorizationPolicy is a resource that specifies how a server should authorize incoming connections. This resource in itself does not change the configuration unless it's attached to a target https proxy or endpoint config selector resource.
  - `labels` object — Optional. Set of label tags associated with the AuthorizationPolicy resource.
  - `createTime` string, google-datetime — Output only. The timestamp when the resource was created.
  - `description` string — Optional. Free-text description of the resource.
  - `rules` Rule[] — Optional. List of rules to match. Note that at least one of the rules must match in order for the action specified in the 'action' field to be taken. A rule is a match if there is a matching source and destination. If left blank, the action specified in the `action` field will be applied on every request.
    - `sources` Source[] — Optional. List of attributes for the traffic source. All of the sources must match. A source is a match if both principals and ip_blocks match. If not set, the action specified in the 'action' field will be applied without any rule checks for the source.
      - `principals` string[] — Optional. List of peer identities to match for authorization. At least one principal should match. Each peer can be an exact match, or a prefix match (example, "namespace/*") or a suffix match (example, "*/service-account") or a presence match "*". Authorization based on the principal name without certificate validation (configured by ServerTlsPolicy resource) is considered insecure.
      - `ipBlocks` string[] — Optional. List of CIDR ranges to match based on source IP address. At least one IP block should match. Single IP (e.g., "1.2.3.4") and CIDR (e.g., "1.2.3.0/24") are supported. Authorization based on source IP alone should be avoided. The IP addresses of any load balancers or proxies should be considered untrusted.
    - `destinations` Destination[] — Optional. List of attributes for the traffic destination. All of the destinations must match. A destination is a match if a request matches all the specified hosts, ports, methods and headers. If not set, the action specified in the 'action' field will be applied without any rule checks for the destination.
      - `httpHeaderMatch` HttpHeaderMatch — Specification of HTTP header match attributes.
        - `regexMatch` string — Required. The value of the header must match the regular expression specified in regexMatch. For regular expression grammar, please see: en.cppreference.com/w/cpp/regex/ecmascript For matching against a port specified in the HTTP request, use a headerMatch with headerName set to Host and a regular expression that satisfies the RFC2616 Host header's port specifier.
        - `headerName` string — Required. The name of the HTTP header to match. For matching against the HTTP request's authority, use a headerMatch with the header name ":authority". For matching a request's method, use the headerName ":method".
      - `hosts` string[] — Required. List of host names to match. Matched against the ":authority" header in http requests. At least one host should match. Each host can be an exact match, or a prefix match (example "mydomain.*") or a suffix match (example "*.myorg.com") or a presence (any) match "*".
      - `methods` string[] — Optional. A list of HTTP methods to match. At least one method should match. Should not be set for gRPC services.
      - `ports` integer[] — Required. List of destination ports to match. At least one port should match.
  - `name` string — Required. Name of the AuthorizationPolicy resource. It matches pattern `projects/{project}/locations/{location}/authorizationPolicies/`.
  - `action` 'ACTION_UNSPECIFIED' | 'ALLOW' | 'DENY' — Required. The action to take when a rule match is found. Possible values are "ALLOW" or "DENY".
  - `updateTime` string, google-datetime — Output only. The timestamp when the resource was updated.

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/networksecurity.md) · [All operations](https://skmtc.net/google/apis/networksecurity/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/networksecurity/versions/4afd54463fe6/schema)