---
title: "Create Cluster Policy for Virtual Cluster"
method: POST
path: "/v1/event-gateways/{gatewayId}/virtual-clusters/{virtualClusterId}/cluster-policies"
tags: ["Event Gateway Virtual Cluster Policies"]
---

# Create Cluster Policy for Virtual Cluster

`POST /v1/event-gateways/{gatewayId}/virtual-clusters/{virtualClusterId}/cluster-policies`

Creates a new cluster-level policy associated with the specified Event Gateway virtual cluster.

## Query parameters

- `before` string, uuid
- `after` string, uuid

## Request body

- EventGatewayClusterPolicyModify — Apply Kafka ACLs to virtual cluster traffic.
  - `type` 'acls', required — The type name of the policy.
  - `name` string — A unique user-defined name of the policy.
  - `description` string — A human-readable description of the policy.
  - `enabled` boolean — Whether the policy is enabled.
  - `labels` Labels — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
  - `config` EventGatewayACLPolicyConfig, required — Apply ACLs to virtual cluster traffic.
    - `rules` EventGatewayACLRule[], required — Every ACL rule in this list applies independently.
      - `resource_type` 'topic' | 'group' | 'transactional_id' | 'cluster', required — This rule applies to access only for type of resource
      - `action` 'allow' | 'deny', required — How to handle the request if the rule matches
      - `operations` EventGatewayACLOperation[], required — Types of Kafka operations to match against. Note that not every operation can apply to every resource type.
        - `name` 'all' | 'alter' | 'alter_configs' | 'create' | 'delete' | 'describe' | 'describe_configs' | 'idempotent_write' | 'read' | 'write', required
      - `resource_names` union, required — If any of these entries match, the resource name matches for this rule. A maximum of 50 entries are allowed.
        - EventGatewayACLResourceName[] — A static list of resource name globs to match against resources when applying an ACL policy.
          - `match` string, glob, required — Currently supported are exact matches and globs. All `*` characters are interpreted as globs, i.e. they match zero or more of any character.
        - string — This expression should evaluate to an array of glob patterns, equivalent to the `match` values in the static array form of `resource_names`. **Requires a minimum runtime version of `1.1`**.
  - `condition` string — A string containing the boolean expression that determines whether the policy is applied.

## Response `201`

Created

- EventGatewayPolicy — A policy associated with an Event Gateway.
  - `type` string, required — The type name of the policy.
  - `name` string — A unique user-defined name of the policy.
  - `description` string — A human-readable description of the policy.
  - `enabled` boolean — Whether the policy is enabled.
  - `labels` Labels — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
  - `id` string, uuid, required — The unique identifier of the policy.
  - `config` object — The configuration of the policy.
  - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
  - `parent_policy_id` string, uuid, nullable — The unique identifier of the parent policy, if any.
  - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.
  - `condition` string — A string containing the boolean expression that determines whether the policy is applied.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden

---

[API](https://skmtc.net/kong/apis/konnect-api-go-sdk.md) · [All operations](https://skmtc.net/kong/apis/konnect-api-go-sdk/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api-go-sdk/versions/f920f418f552/schema)