Skip to main content
POST
Publish Policy
This endpoint creates a policy in the v2 policy service.

v2 request shape

The v2 API accepts a single policy object. It no longer uses the old policies[].resourcePolicy wrapper. Important fields:
  • name: unique policy name within the organization
  • mcp_server_id: target MCP server
  • application_ids: agents/applications this policy applies to
  • status: DRAFT, ACTIVE, INACTIVE, or ARCHIVED
  • rules: array of rule objects using authorized, actions, roles_groups, and optional condition

Tool-call actions

Each entry in actions names one MCP action. For tool calls there are two forms, and the choice between them is the tool’s permission state:
  • tools/call:<tool> — granted outright; the call runs without confirmation.
  • tools/call:<tool>:approve — granted subject to approval; the user confirms the specific call before it runs.
Use one form per tool per rule, not both. A tool omitted from every applicable rule is not granted. Where more than one rule applies to a principal the most permissive grant wins, so a plain grant elsewhere overrides an :approve grant here. The :approve suffix is reserved and may appear at most once, at the end of a tool-call action; a doubled suffix is rejected. Example:
For a comprehensive guide, see Manage Access Policies.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Response

200 - application/json

Successful Response