Sign in

v22

latestOpenAPI 3.0.0raw.githubusercontent.com2026-07-01140308542.4 KB
PolicySets

Create a new policy set

Creates an unbound policy set. Use updatePolicySet to bind after creating a version.

post/zones/{zone_id}/policy-sets

Path parameters

zone_idstring required

The zone identifier

Headers

X-API-Versionstring

API version header (date-based, e.g. 2026-02-01)

X-Client-Request-IDstring uuid

Unique request identifier specified by the originating caller and passed along by proxies.

Request body

namestring required
scope_type'zone'

Deprecated. Use target_type instead. Only zone is accepted; use target_type for user targets.

target_type'zone' | 'user'

What this policy set targets:

  • "zone" — applies to all requests in the zone.
  • "user" — can be bound to a specific user.

Response

The newly created policy set

idstring required
zone_idstring required
namestring required
scope_type'zone' | 'resource' | 'user' | 'session' required

Deprecated. Use target_type instead. Carries the same value.

target_type'zone' | 'user' required

What this policy set targets:

  • "zone" — applies to all requests in the zone.
  • "user" — scoped to a specific user.

resource and session are reserved; legacy sets with those scopes carry them in the deprecated scope_type field.

latest_version_idstring nullable
latest_versioninteger nullable

Human-readable version number of the latest version (e.g., 1, 2, 3)

archived_atstring date-time nullable
created_atstring date-time required
updated_atstring date-time required
created_bystring required
updated_bystring nullable
owner_type'platform' | 'customer' required

Who manages this policy set:

  • "platform" — managed by the Keycard platform (system policies).
  • "customer" — managed by the tenant (custom policies).
scope_target_idstring nullable

Deprecated. Use target_id instead. Carries the active binding's target; null when unbound.

target_idstring nullable

Target entity ID. Equals zone_id for zone-targeted sets; the principal identifier for principal-scoped sets. Null only for legacy non-zone sets that predate target tracking.

mode'active' | 'shadow' nullable
activeboolean

Whether this policy set is currently bound to a scope

active_version_idstring nullable

Public ID of the currently active (bound) version

active_versioninteger nullable

Human-readable version number of the active version (e.g., 1, 2, 3)

shadow_version_idstring nullable

Public ID of the shadow (observed) version, if any

shadow_versioninteger nullable

Human-readable version number of the shadow version