---
title: "Create Access Policy"
url: "https://public-api-docs.cipherscale.com/apis/cipherscale-api-1/versions/fef69080-6094-4620-8bf0-16fd2de7b598/operations/PoliciesController_create"
---

> Full API specification: https://public-api-docs.cipherscale.com/apis/cipherscale-api-1/versions/fef69080-6094-4620-8bf0-16fd2de7b598.md

# Create Access Policy

`POST` `/tenants/policies`

Operation ID: `PoliciesController_create`

Creates a new access policy that defines which users, devices, and groups can access specific network resources. Policies are the core of the Zero Trust access control system and determine network access permissions. required: true content: application/json: schema: $ref: "#/components/schemas/CreatePolicyDto"

## Responses

- `201`
- `401` - Unauthorized - Invalid or missing authentication token
- `403` - Forbidden - Insufficient permissions to perform this operation.

## OpenAPI definition

```yaml
openapi: 3.0.0
info:
  title: Cipherscale API
  version: "1.0"
servers:
  - url: https://public-api.cipherscale.com/qa
    description: Cipherscale Public API Server
paths:
  /tenants/policies:
    post:
      operationId: PoliciesController_create
      summary: Create Access Policy
      description: >-
        Creates a new access policy that defines which users, devices, and
        groups can access specific network resources. Policies are the core of
        the Zero Trust access control system and determine network access
        permissions. required: true content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreatePolicyDto"
      responses:
        "201":
          description: ""
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PolicyDto"
        "401":
          description: Unauthorized - Invalid or missing authentication token
        "403":
          description: Forbidden - Insufficient permissions to perform this operation.
      tags:
        - Policies
      security:
        - ApiKeyAuth: []
security:
  - ApiKeyAuth: []
components:
  schemas:
    PolicyDto:
      type: object
      description: Access policy defining who can access what resources under what
        conditions
      properties:
        id:
          type: string
          format: uuid
          description: Unique identifier for the policy
        createdAt:
          format: date-time
          type: string
          description: Timestamp when the policy was created
        updatedAt:
          format: date-time
          type: string
          description: Timestamp when the policy was last modified
        name:
          type: string
          description: Human-readable name for the policy
        action:
          type: boolean
          description: Whether this policy allows (true) or denies (false) access
        order:
          type: number
          description: Priority order for policy evaluation (lower numbers are evaluated
            first)
        isDefault:
          type: boolean
          description: Whether this is a default policy that applies to all entities
        type:
          enum:
            - PRIVATE
            - SAAS
            - INTERNET
            - SITETOSITE
          type: string
          description: Type of resources this policy applies to
        mode:
          enum:
            - LOCAL
            - RESTRICTED
            - INTERNET_ACCESS_POINT
          type: string
          description: Access mode for this policy
        allGroups:
          type: object
          default: false
          description: Whether this policy applies to all groups
        allUsers:
          type: object
          default: false
          description: Whether this policy applies to all users
        allDevices:
          type: object
          default: false
          description: Whether this policy applies to all devices
        allResources:
          type: object
          default: false
          description: Whether this policy applies to all resources
        groups:
          type: array
          items:
            $ref: "#/components/schemas/PolicyGroupDto"
          description: Specific groups this policy applies to
        users:
          type: array
          items:
            $ref: "#/components/schemas/PolicyUserDto"
          description: Specific users this policy applies to
        devices:
          type: array
          items:
            $ref: "#/components/schemas/PolicyDeviceDto"
          description: Specific devices this policy applies to
        resources:
          type: array
          items:
            $ref: "#/components/schemas/PolicyResourceDto"
          description: Specific resources this policy applies to
        gateways:
          type: array
          items:
            $ref: "#/components/schemas/GatewayDto"
          description: Gateways that can be used to access the resources
        sourceIps:
          type: array
          items:
            type: string
          description: Source IP addresses or ranges this policy applies to
        rule:
          $ref: "#/components/schemas/AdmissionRuleDto"
          description: Additional admission rules and conditions for this policy
        description:
          type: string
          description: Detailed description of the policy's purpose and scope
      required:
        - id
        - createdAt
        - updatedAt
        - name
        - action
        - order
        - isDefault
        - type
        - allGroups
        - allUsers
        - allDevices
        - allResources
        - rule
    PolicyGroupDto:
      type: object
      properties:
        id:
          type: string
          format: uuid
        createdAt:
          format: date-time
          type: string
        updatedAt:
          format: date-time
          type: string
        name:
          type: string
        description:
          type: string
        maxDevices:
          type: number
        isSamlDefaultGroup:
          type: boolean
        idpMapping:
          type: array
          items:
            type: string
      required:
        - id
        - createdAt
        - updatedAt
        - name
        - maxDevices
        - isSamlDefaultGroup
        - idpMapping
    PolicyUserDto:
      type: object
      properties:
        id:
          type: string
          format: uuid
        createdAt:
          format: date-time
          type: string
        updatedAt:
          format: date-time
          type: string
        lastConnection:
          format: date-time
          type: string
        email:
          type: string
        status:
          type: string
        firstName:
          type: string
        lastName:
          type: string
        isOwner:
          type: boolean
        maxDevices:
          type: number
          nullable: true
        image:
          type: string
      required:
        - id
        - createdAt
        - updatedAt
        - status
        - isOwner
        - maxDevices
    PolicyDeviceDto:
      type: object
      properties:
        id:
          type: string
          format: uuid
        createdAt:
          format: date-time
          type: string
        updatedAt:
          format: date-time
          type: string
        name:
          type: string
        active:
          type: boolean
        lastConnection:
          format: date-time
          type: string
        status:
          type: string
          enum:
            - Online
            - Offline
            - Deactivated
        hardwareId:
          type: string
        posture:
          type: object
        appVersion:
          type: string
      required:
        - id
        - createdAt
        - updatedAt
        - name
        - active
        - status
        - hardwareId
    PolicyResourceDto:
      type: object
      properties:
        id:
          type: string
          format: uuid
        createdAt:
          format: date-time
          type: string
        updatedAt:
          format: date-time
          type: string
        name:
          type: string
        type:
          type: string
          enum:
            - PRIVATE
            - SAAS
            - INTERNET
        loadBalancingMode:
          type: string
          default: MANUAL
          enum:
            - MANUAL
            - AUTOMATIC
        description:
          type: string
      required:
        - id
        - createdAt
        - updatedAt
        - name
        - type
        - loadBalancingMode
    GatewayDto:
      type: object
      description: Network gateway configuration and status information
      properties:
        id:
          type: string
          format: uuid
          description: Unique identifier for the gateway
        createdAt:
          format: date-time
          type: string
          description: Timestamp when the gateway was created
        deployedOn:
          format: date-time
          type: string
          nullable: true
          description: Timestamp when the gateway was first successfully deployed
        updatedAt:
          format: date-time
          type: string
          description: Timestamp when the gateway was last updated
        name:
          type: string
          description: Human-readable name for the gateway
        description:
          type: string
          description: Detailed description of the gateway's purpose and location
        wireguardPort:
          type: string
          description: WireGuard VPN port number for this gateway
        status:
          enum:
            - PENDING
            - ONLINE
            - OFFLINE
            - MAINTENANCE
            - ERROR
          type: string
          description: Current operational status of the gateway
        error:
          type: string
          description: Error message if the gateway is in ERROR status
        token:
          type: string
          description: Authentication token for gateway communication
        lastOnline:
          format: date-time
          type: string
          description: Timestamp when the gateway was last online
        relayEnabled:
          type: boolean
          description: Whether the gateway can relay traffic between network segments
        endpoint:
          type: string
          description: Network endpoint address for the gateway
        autoDiscoverEndpoint:
          type: boolean
          description: Whether the gateway endpoint is automatically discovered
        resources:
          type: array
          items:
            $ref: "#/components/schemas/GatewayResourceDto"
          description: List of resources accessible through this gateway
      required:
        - id
        - createdAt
        - deployedOn
        - updatedAt
        - name
        - wireguardPort
        - status
        - token
        - autoDiscoverEndpoint
    AdmissionRuleDto:
      type: object
      properties:
        id:
          type: string
          format: uuid
        createdAt:
          format: date-time
          type: string
        updatedAt:
          format: date-time
          type: string
        name:
          type: string
        type:
          enum:
            - ALLOW
            - DENY
            - CUSTOM
          type: string
        hasTimeConstraint:
          type: boolean
        rule:
          type: string
      required:
        - id
        - createdAt
        - updatedAt
        - name
        - type
        - hasTimeConstraint
    GatewayResourceDto:
      type: object
      properties:
        id:
          type: string
          format: uuid
        name:
          type: string
      required:
        - id
        - name
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: apikey
```