> ## Documentation Index > Fetch the complete documentation index at: https://docs.igrisecurity.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a policy > Creates a policy. It applies at the gateway from the next request. See [Policies](/govern/policies) and [Guards](/govern/guards). The response is the stored row: it has `createdByUserId` and no `owner` or `lastEditedBy`. Those two fields appear on `GET` only. Send an `Idempotency-Key` header to make retries safe. Replays are cached in memory for 24 hours, so treat it as best effort. **Required permission:** `policies:write` ## OpenAPI ````yaml /api-reference/openapi.yaml post /api/v1/policies openapi: 3.1.0 info: title: Igris Management API version: '1' description: >- REST API for managing Igris connections, policies, sessions, audit events and alerts. servers: - url: https://api.igrisecurity.com security: - bearerAuth: [] tags: - name: Connections - name: Policies - name: Sessions - name: Audit Events - name: Incidents - name: Webhooks - name: API Keys - name: Members - name: LLM Providers - name: LLM Cost - name: Observe paths: /api/v1/policies: post: tags: - Policies summary: Create a policy description: > Creates a policy. It applies at the gateway from the next request. See [Policies](/govern/policies) and [Guards](/govern/guards). The response is the stored row: it has `createdByUserId` and no `owner` or `lastEditedBy`. Those two fields appear on `GET` only. Send an `Idempotency-Key` header to make retries safe. Replays are cached in memory for 24 hours, so treat it as best effort. **Required permission:** `policies:write` operationId: createPolicy parameters: - name: Idempotency-Key in: header description: >- Any unique string. A repeat with the same key returns the first response. schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PolicyCreate' example: name: Block delete tools connectionSlugs: - github-prod rules: - target: kind: mcp_tool tool: delete_* action: deny responses: '201': description: The stored policy. content: application/json: schema: type: object properties: data: $ref: '#/components/schemas/PolicyRow' example: data: id: 7b1d4c2e-0000-4000-8000-000000000002 name: Block delete tools description: null serverId: null connectionSlugs: - github-prod rules: - target: kind: mcp_tool tool: delete_* action: deny enabled: true createdByUserId: usr_123 updatedByUserId: usr_123 createdAt: '2026-01-01T00:00:00Z' updatedAt: '2026-01-01T00:00:00Z' '401': $ref: '#/components/responses/Unauthorized' '403': description: > Missing permission, or a plan limit: `PLAN_LIMIT_REACHED` with `limit` set to `maxPolicies` or `maxRulesPerPolicy`, or `plan_feature_unavailable` with a `detector` field when a `contentGuard` uses a detector your plan does not include. See [Plan errors](/reference/limits-and-errors#plan-errors). content: application/json: schema: oneOf: - $ref: '#/components/schemas/ForbiddenError' - $ref: '#/components/schemas/PlanError' example: error: Policy limit reached code: PLAN_LIMIT_REACHED limit: maxPolicies current: 5 max: 5 plan: free upgradeTo: growth '422': description: > Validation failed. Unsupported rule settings (a `limit` on an `mcp_tool` rule, a condition key other than `user` or `metadata.`) return `{ "error": "..." }`; schema errors return the Zod shape. content: application/json: schema: oneOf: - $ref: '#/components/schemas/Error' - $ref: '#/components/schemas/ZodValidationError' example: error: >- Rate limits apply to LLM rules only; remove "limit" from MCP tool rules. components: schemas: PolicyCreate: type: object required: - name - rules properties: name: type: string minLength: 1 maxLength: 200 description: type: - string - 'null' maxLength: 500 rules: type: array minItems: 1 items: $ref: '#/components/schemas/PolicyRule' enabled: type: boolean default: true connectionSlugs: type: - array - 'null' items: type: string minLength: 1 description: Connection slugs or `null` for org-wide.: null serverId: type: - string - 'null' minLength: 1 PolicyRow: type: object description: >- The stored policy row, as returned by `POST` and `PATCH`. It has `createdByUserId` and `updatedByUserId` instead of `owner` and `lastEditedBy`. properties: id: type: string format: uuid organizationId: type: string serverId: type: - string - 'null' connectionSlugs: type: - array - 'null' items: type: string name: type: string description: type: - string - 'null' rules: type: array items: $ref: '#/components/schemas/PolicyRule' enabled: type: boolean createdByUserId: type: - string - 'null' updatedByUserId: type: - string - 'null' createdAt: type: string format: date-time updatedAt: type: string format: date-time ForbiddenError: type: object properties: error: type: string example: Forbidden required: type: string description: The permission the caller lacks. example: policies:write PlanError: type: object description: Plan limit or plan feature errors. See Limits and errors. properties: error: type: string example: PLAN_LIMIT_REACHED code: type: string example: PLAN_LIMIT_REACHED feature: type: string detector: type: string description: The detector your plan does not include. limit: type: string current: type: integer max: type: integer plan: type: string currentPlan: type: string upgradeTo: type: string Error: type: object required: - error properties: error: type: string ZodValidationError: type: object properties: success: type: boolean const: false error: type: object properties: name: type: string example: ZodError message: type: string description: JSON string of the validation issues. PolicyRule: type: object required: - target - action properties: target: $ref: '#/components/schemas/PolicyRuleTarget' action: type: string enum: - allow - deny - alert - redact conditions: type: object description: > When the rule applies. Keys can only be `user` or `metadata.`; any other key returns `422`. A value is a string (exact match) or one of `{ eq }`, `{ neq }`, `{ in: [...] }`, `{ nin: [...] }`. additionalProperties: oneOf: - type: string - type: object properties: eq: type: string - type: object properties: neq: type: string - type: object properties: in: type: array items: type: string - type: object properties: nin: type: array items: type: string example: user: alice@company.com metadata.env: in: - prod - staging limit: type: object description: >- Rate limit. Applies to LLM rules only; on an `mcp_tool` rule it returns `422`. required: - per properties: requests: type: number exclusiveMinimum: 0 tokens: type: number exclusiveMinimum: 0 dollars: type: number exclusiveMinimum: 0 per: type: string enum: - minute - hour - day tokenGuard: type: object properties: maxInputTokens: type: number exclusiveMinimum: 0 maxOutputTokens: type: number exclusiveMinimum: 0 maxRequestMaxTokens: type: number exclusiveMinimum: 0 contentGuard: type: object description: Content detectors to run. See [Guards](/govern/guards). required: - detectors - action properties: detectors: type: array minItems: 1 maxItems: 50 items: type: string minLength: 1 maxLength: 80 action: type: string enum: - deny - redact - alert inspectResponse: type: boolean logContent: type: boolean PolicyRuleTarget: description: What the rule matches. oneOf: - type: object title: MCP tool required: - kind - tool properties: kind: type: string const: mcp_tool tool: type: string minLength: 1 description: Tool name. `*` wildcards are allowed. example: delete_* - type: object title: LLM model required: - kind - model properties: kind: type: string const: llm_model model: type: string minLength: 1 example: gpt-4o* - type: object title: LLM endpoint required: - kind - endpoint properties: kind: type: string const: llm_endpoint endpoint: type: string enum: - chat.completions - embeddings - images.generate - audio.transcriptions - audio.speech - passthrough responses: Unauthorized: description: No valid session or API key, or the key's creator is no longer a member. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Unauthorized securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: ig_... description: >- An Igris API key. It acts with the current role and permission overrides of the member who created it. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.