--- title: "POST /v1/{+parent}/postures" method: POST path: "/v1/{+parent}/postures" tags: ["organizations"] --- # POST /v1/{+parent}/postures `POST /v1/{+parent}/postures` Creates a new Posture. ## Path parameters - `parent` string, required ## Query parameters - `postureId` string ## Request body - Posture — The details of a posture. - `categories` string[] — Output only. The categories that the posture belongs to, as determined by the Security Posture API. - `updateTime` string, google-datetime — Output only. The time at which the posture was last updated. - `revisionId` string — Output only. Immutable. An opaque eight-character string that identifies the revision of the posture. A posture can have multiple revisions; when you deploy a posture, you deploy a specific revision of the posture. - `description` string — Optional. A description of the posture. - `annotations` object — Optional. The user-specified annotations for the posture. For details about the values you can use in an annotation, see [AIP-148: Standard fields](https://google.aip.dev/148#annotations). - `etag` string — Optional. An opaque identifier for the current version of the posture at the specified `revision_id`. To prevent concurrent updates from overwriting each other, always provide the `etag` when you update a posture. You can also provide the `etag` when you delete a posture, to help ensure that you're deleting the intended version of the posture. - `createTime` string, google-datetime — Output only. The time at which the posture was created. - `state` 'STATE_UNSPECIFIED' | 'DEPRECATED' | 'DRAFT' | 'ACTIVE' — Required. The state of the posture at the specified `revision_id`. - `reconciling` boolean — Output only. Whether the posture is in the process of being updated. - `policySets` PolicySet[] — Required. The PolicySet resources that the posture includes. - `policies` Policy[] — Required. The Policy resources in the policy set. Each policy must have a policy_id that's unique within the policy set. - `policyId` string — Required. A user-specified identifier for the policy. In a PolicySet, each policy must have a unique identifier. - `complianceStandards` ComplianceStandard[] — Optional. The compliance standards that the policy helps enforce. - `standard` string — Optional. The compliance standard that the policy helps enforce. For example, `NIST SP 800-53`. - `control` string — Optional. The control in the compliance standard that the policy helps enforce. For example, `AC-3`. - `constraint` Constraint — Metadata for a constraint in a Policy. - `orgPolicyConstraint` OrgPolicyConstraint — A predefined organization policy constraint. - `policyRules` GoogleCloudSecuritypostureV1PolicyRule[] — Required. The rules enforced by the constraint. - `values` GoogleCloudSecuritypostureV1PolicyRuleStringValues — The allowed and denied values for a list constraint. For all constraints, these fields can contain literal values. Optionally, you can add the `is:` prefix to these values. If the value contains a colon (`:`), then the `is:` prefix is required. Some constraints allow you to specify a portion of the resource hierarchy, known as a [_hierarchy subtree_](https://cloud.google.com/resource-manager/help/organization-policy/hierarchy-subtree), that the constraint applies to. To specify a hierarchy subtree, use the `under:` prefix, followed by a value with one of these formats: - `projects/{project_id}` (for example, `projects/tokyo-rain-123`) - `folders/{folder_id}` (for example, `folders/1234567890123`) - `organizations/{organization_id}` (for example, `organizations/123456789012`) A constraint's `supports_under` field indicates whether you can specify a hierarchy subtree. To learn which predefined constraints let you specify a hierarchy subtree, see the [constraints reference](https://cloud.google.com/resource-manager/help/organization-policy/constraints/reference). - … - `parameters` object — Optional. Required for managed constraints if parameters are defined. Passes parameter values when policy enforcement is enabled. Ensure that parameter value types match those defined in the constraint definition. For example: ``` { "allowedLocations": ["us-east1", "us-west1"], "allowAll": true } ``` - `resourceTypes` ResourceTypes — Set multiple resource types for one policy, for example: ``` resourceTypes: included: - compute.googleapis.com/Instance - compute.googleapis.com/Disk ``` Constraint definition contains an empty resource type in order to support multiple resource types in the policy. Only supports managed constraints. Method type is `GOVERN_TAGS`. - … - `denyAll` boolean — Whether to deny all values for a list constraint. Valid only for list constraints. - `enforce` boolean — Whether to enforce the constraint. Valid only for boolean constraints. - `allowAll` boolean — Whether to allow any value for a list constraint. Valid only for list constraints. - `condition` Expr — Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. - … - `cannedConstraintId` string — Required. A unique identifier for the constraint. - `orgPolicyConstraintCustom` OrgPolicyConstraintCustom — A custom organization policy constraint. - `policyRules` GoogleCloudSecuritypostureV1PolicyRule[] — Required. The rules enforced by the constraint. - `values` GoogleCloudSecuritypostureV1PolicyRuleStringValues — The allowed and denied values for a list constraint. For all constraints, these fields can contain literal values. Optionally, you can add the `is:` prefix to these values. If the value contains a colon (`:`), then the `is:` prefix is required. Some constraints allow you to specify a portion of the resource hierarchy, known as a [_hierarchy subtree_](https://cloud.google.com/resource-manager/help/organization-policy/hierarchy-subtree), that the constraint applies to. To specify a hierarchy subtree, use the `under:` prefix, followed by a value with one of these formats: - `projects/{project_id}` (for example, `projects/tokyo-rain-123`) - `folders/{folder_id}` (for example, `folders/1234567890123`) - `organizations/{organization_id}` (for example, `organizations/123456789012`) A constraint's `supports_under` field indicates whether you can specify a hierarchy subtree. To learn which predefined constraints let you specify a hierarchy subtree, see the [constraints reference](https://cloud.google.com/resource-manager/help/organization-policy/constraints/reference). - … - `parameters` object — Optional. Required for managed constraints if parameters are defined. Passes parameter values when policy enforcement is enabled. Ensure that parameter value types match those defined in the constraint definition. For example: ``` { "allowedLocations": ["us-east1", "us-west1"], "allowAll": true } ``` - `resourceTypes` ResourceTypes — Set multiple resource types for one policy, for example: ``` resourceTypes: included: - compute.googleapis.com/Instance - compute.googleapis.com/Disk ``` Constraint definition contains an empty resource type in order to support multiple resource types in the policy. Only supports managed constraints. Method type is `GOVERN_TAGS`. - … - `denyAll` boolean — Whether to deny all values for a list constraint. Valid only for list constraints. - `enforce` boolean — Whether to enforce the constraint. Valid only for boolean constraints. - `allowAll` boolean — Whether to allow any value for a list constraint. Valid only for list constraints. - `condition` Expr — Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. - … - `customConstraint` GoogleCloudSecuritypostureV1CustomConstraint — A custom, user-defined constraint. You can apply the constraint only to the resource types specified in the constraint, and only within the organization where the constraint is defined. _When you create a custom constraint, it is not enforced automatically._ You must use an organization policy to [enforce the constraint](https://cloud.google.com/resource-manager/help/organization-policy/constraints/enforce). - `description` string — A description of the constraint. The maximum length is 2000 characters. - `resourceTypes` string[] — Immutable. The resource type that the constraint applies to, in the format `{canonical_service_name}/{resource_type_name}`. For example, `compute.googleapis.com/Instance`. - `updateTime` string, google-datetime — Output only. The last time at which the constraint was updated or created. - `displayName` string — A display name for the constraint. The maximum length is 200 characters. - `methodTypes` string[] — The types of operations that the constraint applies to. - `condition` string — A Common Expression Language (CEL) condition expression that must evaluate to `true` for the constraint to be enforced. The maximum length is 1000 characters. For example: + `resource.instanceName.matches('(production|test)_(.+_)?[\d]+')`: Evaluates to `true` if the resource's `instanceName` attribute contains the following: + The prefix `production` or `test` + An underscore (`_`) + Optional: One or more characters, followed by an underscore (`_`) + One or more digits + `resource.management.auto_upgrade == true`: Evaluates to `true` if the resource's `management.auto_upgrade` attribute is `true`. - `name` string — Immutable. The name of the constraint, in the format `organizations/{organization_id}/customConstraints/custom.{custom_constraint_id}`. For example, `organizations/123456789012/customConstraints/custom.createOnlyE2TypeVms`. Must contain 1 to 62 characters, excluding the prefix `organizations/{organization_id}/customConstraints/custom.`. - `actionType` 'ACTION_TYPE_UNSPECIFIED' | 'ALLOW' | 'DENY' — Whether to allow or deny the action. - `securityHealthAnalyticsModule` SecurityHealthAnalyticsModule — A built-in detector for Security Health Analytics. - `moduleEnablementState` 'ENABLEMENT_STATE_UNSPECIFIED' | 'ENABLED' | 'DISABLED' — Whether the detector is enabled at a specified level of the resource hierarchy. - `moduleName` string — Required. The name of the detector. For example, `BIGQUERY_TABLE_CMEK_DISABLED`. This field is also used as the finding category for all the asset violation findings that the detector returns. - `securityHealthAnalyticsCustomModule` SecurityHealthAnalyticsCustomModule — A custom module for Security Health Analytics. - `id` string — Output only. Immutable. The unique identifier for the custom module. Contains 1 to 20 digits. - `moduleEnablementState` 'ENABLEMENT_STATE_UNSPECIFIED' | 'ENABLED' | 'DISABLED' — Whether the custom module is enabled at a specified level of the resource hierarchy. - `displayName` string — Optional. The display name of the custom module. This value is used as the finding category for all the asset violation findings that the custom module returns. The display name must contain between 1 and 128 alphanumeric characters or underscores, and it must start with a lowercase letter. - `config` CustomConfig — A custom module configuration for Security Health Analytics. Use `CustomConfig` to create custom detectors that generate custom findings for resources that you specify. - `recommendation` string — Required. An explanation of the steps that security teams can take to resolve the detected issue. The explanation appears in each finding. - `customOutput` CustomOutputSpec — Definitions of custom source properties that can appear in findings. - … - `description` string — Optional. A description of the vulnerability or misconfiguration that the custom module detects. The description appears in each finding. Provide enough information to help an investigator understand the finding. The value must be enclosed in quotation marks. - `predicate` Expr — Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. - … - `resourceSelector` ResourceSelector — A selector for the resource types to run the detector on. - … - `severity` 'SEVERITY_UNSPECIFIED' | 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' — Required. The severity of findings generated by the custom module. - `description` string — Optional. A description of the policy. - `policySetId` string — Required. An identifier for the policy set. - `description` string — Optional. A description of the policy set. - `name` string — Required. Identifier. The name of the posture, in the format `organizations/{organization}/locations/global/postures/{posture_id}`. ## Response `200` Successful response --- [API](https://skmtc.net/google/apis/securityposture.md) · [All operations](https://skmtc.net/google/apis/securityposture/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/securityposture/versions/e4faff8a3770/schema)