> ## Documentation Index
> Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create or Update Policy

This endpoint creates a policy in the v2 policy service.

## v2 request shape

The v2 API accepts a single policy object. It no longer uses the old `policies[].resourcePolicy` wrapper.

Important fields:

* `name`: unique policy name within the organization
* `mcp_server_id`: target MCP server
* `application_ids`: agents/applications this policy applies to
* `status`: `DRAFT`, `ACTIVE`, `INACTIVE`, or `ARCHIVED`
* `rules`: array of rule objects using `authorized`, `actions`, `roles_groups`, and optional `condition`

Example:

```json theme={null}
{
  "name": "Slack outbound policy",
  "description": "Default outbound Slack controls for the support agent.",
  "support_contact": "platform@company.com",
  "tags": ["slack", "support"],
  "status": "DRAFT",
  "mcp_server_id": "server_123",
  "application_ids": ["agent_456"],
  "rules": [
    {
      "name": "allow_all",
      "authorized": true,
      "actions": ["*"],
      "roles_groups": ["*"]
    },
    {
      "name": "block_general_channel",
      "authorized": false,
      "actions": ["tools/call:chat_postMessage"],
      "roles_groups": ["*"],
      "condition": {
        "match": {
          "all": {
            "of": [
              {
                "expr": "request.resource.attr.channel == \"general\""
              }
            ]
          }
        }
      }
    }
  ]
}
```

<Note>
  For a comprehensive guide, see [Manage Access Policies](/how-tos/manage-policies).
</Note>


## OpenAPI

````yaml POST /api/policy
openapi: 3.1.0
info:
  title: Barndoor Platform API
  version: 1.0.0
  description: >
    REST API for the Barndoor Platform - manage MCP servers, OAuth connections,
    and proxy MCP requests.


    ## Authentication


    All endpoints require a JWT Bearer token obtained through Barndoor's

    OAuth 2.0 authorization-code flow with PKCE. The SDK handles the OAuth

    flow automatically using interactive login.


    ## MCP Integration


    The `/mcp/{mcp_server_name}` endpoints provide streaming proxy access to
    third-party MCP servers

    (Salesforce, Notion, Slack, etc.) with automatic authentication and session
    management.
  contact:
    name: Barndoor Support
    url: https://barndoor.ai
servers:
  - url: https://{organization_id}.platform.barndoor.ai
    description: Trial (Production)
    variables:
      organization_id:
        description: Your organization identifier
        default: your-org
  - url: https://{organization_id}.platform.barndoor.ai
    description: Enterprise (Production)
    variables:
      organization_id:
        description: Your organization identifier
        default: your-org
  - url: https://{organization_id}.platform.barndooruat.com
    description: Enterprise (Production)
    variables:
      organization_id:
        description: Your organization identifier
        default: your-org
  - url: https://{organization_id}.platform.barndoordev.com
    description: Enterprise (Production)
    variables:
      organization_id:
        description: Your organization identifier
        default: your-org
security:
  - BearerAuth: []
tags:
  - name: Servers
    description: Manage MCP server instances
  - name: Connections
    description: Manage OAuth connections to MCP servers
  - name: Policies
    description: Manage access control policies for agents and servers
  - name: Agents
    description: Manage AI agent registrations
  - name: MCP Proxy
    description: Proxy requests to MCP servers
  - name: Identity
    description: Retrieve identity information for the authenticated user
paths:
  /api/policy:
    post:
      summary: Publish  Policy
      operationId: publish_cerbos_policy_admin_policy_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
components:
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >
        JWT token obtained through Barndoor's OAuth 2.0 authorization-code

        flow with PKCE.


        The token should be included in the Authorization header:

        `Authorization: Bearer <your-jwt-token>`


        Use the Barndoor SDK's `loginInteractive()` function to obtain tokens
        automatically.
    HTTPBearer:
      type: http
      scheme: bearer

````