Skip to main content
POST
Create a model access policy

Authorizations

Authorization
string
header
required

An access token from Barndoor's identity provider, sent as Authorization: Bearer <token>. Use a service-account token from the OAuth 2.0 client-credentials grant for scripts and CI, or a signed-in user's token. The caller needs the admin role in the organization. Gateway API keys (bd-...) are not accepted here.

Body

application/json
name
string
required
policy_type
string
required

allowlist (only the targets are permitted) or denylist (the targets are blocked).

scope_type
string
required

Who the policy applies to: org (everyone), or one of team, user, project, api_key, mcp_server, agent, role, group. Select the entity with scope_id (UUID-keyed types) or scope_value (name-keyed types such as role and group).

targets
object[]
required

What the policy allows or denies. A request matches if any target matches.

One thing a model access policy allows or denies, selected by kind.

change_note
string | null

Optional note explaining why this was created. Shown with the record and in the audit log.

scope_id
string<uuid> | null

UUID of the scoped entity, for UUID-keyed scope types such as user, team, or api_key.

scope_value
string | null

Name of the scoped entity, for name-keyed scope types, such as a role or IdP group name.

traffic_type
string

Traffic the policy applies to: all, llm (model traffic), or mcp (MCP tool traffic). Defaults to llm.

Response

Created

A model access policy.

enabled
boolean
required
id
string<uuid>
required
name
string
required
org_id
string<uuid>
required
policy_type
string
required
scope_type
string
required
targets
object[]
required

One thing a model access policy allows or denies, selected by kind.

traffic_type
string
required
scope_id
string<uuid> | null
scope_value
string | null
created_by_email
string | null
created_by_name
string | null
created_by_user_id
string<uuid> | null
last_change_note
string | null

Note explaining the last change.

last_modified_at
string<date-time> | null

When the last attributed change was made.

last_modified_by_email
string | null
last_modified_by_name
string | null
last_modified_by_user_id
string<uuid> | null