v1

latestOpenAPI 3.0.3FortiCNAPP Use License2026-08-041754351.1 MB

Policies

Create Policies

Create a FortiCNAPP Query Language (LQL) policy by specifying parameters in the request body when invoking the following endpoint:

POST https://YourAccount.lacework.net/api/v2/Policies

This creates the LQL policy in your FortiCNAPP instance so you can view it in the FortiCNAPP Console. You can get the unique identifiers for the LQL policies (policyIdList) array by invoking the GET /api/v2/Policies endpoint.

post/api/v2/Policies

Headers

Authorizationstring required

Bearer Access Token. For example, "Bearer {YourAPIToken}"

Content-Typestring required

application/json

Request body

policyType'Violation'

The policy type such as Violation.

queryIdstring required

Identifier of the query that executes while running the policy.

titlestring required

The policy's title.

enabledboolean required

When sending a request, use this attribute to enable or disable a policy. When included in a response, returns True for enabled policies, or returns False for disabled policies.

descriptionstring required

Information about the new policy.

remediationstring required

Remediation strategy for the events triggered by the policy.

severity'info' | 'low' | 'medium' | 'high' | 'critical' required

The severity of an event triggered by the policy.

limitnumber

The maximum number of records that each policy will return. The default value is 1000.

evalFrequency'Hourly' | 'Daily'

Frequency at which the policy will be evaluated

alertEnabledboolean required

When sending a request, set to True if you want to send alerts to an alert profile when the policy is triggered. Set to False if you want to mute alerts when the policy is triggered.

alertProfilestring

The alert profile to use for sending alerts when the policy is triggered.

tagsstring[]

A list of policy tags.

policyIdstring

Policy ID. The convention for policy ID creation is accountName-remainder, for example, lws-special-100. When sending a request, you can simply provide $account-<remainder>, and FortiCNAPP will substitute the $account prefix with your actual account name. Note: The -remainder must use the regex pattern (^[a-z]{1,16}(-\d{1,8})?$), and cannot be default or start with default-.

Response

No Error