---
title: "Create wallet spend policy"
method: POST
path: "/v1/platform/apps/{appId}/spend-policies"
tags: ["Platform"]
---

# Create wallet spend policy

`POST /v1/platform/apps/{appId}/spend-policies`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/platform/apps/{appId}/spend-policies`
- Auth: HTTP bearer

Create an app-wide spend policy that governs what embedded wallet users
can do with their wallets. Policies apply to all connected users by default
and can be overridden per-user via connection-level policies.

## Path parameters

- `appId` string, uuid, required

## Request body

- CreateSpendPolicyRequest
  - `user_id` string, uuid: Scope to a specific user (app-level policies only)
  - `to_allowlist` string[]: Permitted destination addresses (empty = unrestricted)
  - `to_denylist` string[]: Blocked destination addresses
  - `max_value_per_tx_eth` string: Maximum value per transaction in ETH (decimal string)
  - `daily_limit_eth` string: Rolling 24h spend cap in ETH (decimal string)
  - `allowed_chains` string[]: Chains the user may transact on (empty = all enabled)
  - `allowed_tokens` string[]: Permitted ERC-20 token contract addresses
  - `max_transactions_per_day` integer: Maximum number of transactions per 24h window
  - `inference_allowance_usd` string: Monthly LLM inference allowance in USD (decimal string)
  - `inference_reserved_pct` integer: Percent of allowance held in reserve (not spendable)
  - `inference_hard_stop` boolean: When true, block inference when allowance is exhausted
  - `inference_allowance_mode` 'policy' | 'credits'
  - `max_request_cost_usd` string: Maximum estimated cost per LLM request in USD
  - `human_factor_auth` object: Human factor auth requirements for send/swap/export. Fields: send, swap, export (password_or_passkey | passkey_only | passkey_required | password_only | reauth_token_only), conditional.require_passkey_above_usd, conditional.require_passkey_for_new_recipient.

## Response `201`

Spend policy created

- SpendPolicyResponse
  - `id` string, uuid, required
  - `org_id` string, uuid, required
  - `platform_app_id` string, uuid, nullable
  - `user_id` string, uuid, nullable
  - `to_allowlist` string[]
  - `to_denylist` string[]
  - `max_value_per_tx_eth` string, nullable
  - `daily_limit_eth` string, nullable
  - `allowed_chains` string[]
  - `allowed_tokens` string[]
  - `max_transactions_per_day` integer, nullable
  - `inference_allowance_usd` string, nullable
  - `inference_reserved_pct` integer, nullable
  - `inference_hard_stop` boolean, nullable
  - `inference_allowance_mode` string, nullable
  - `max_request_cost_usd` string, nullable
  - `human_factor_auth` object, nullable
  - `is_active` boolean, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `400`: Invalid request
- `403`: Insufficient permissions

## Changes

- **2026-10-20** `5fa0918f3b41`: 2 breaking, 3 info
  - the response property `platform_app_id` became nullable for the status `201`
  - the response property `platform_app_id` became optional for the status `201`
  - added the required property `is_active` to the response with the `201` status
  - added the required property `org_id` to the response with the `201` status
  - …1 more

[Operation history](https://skmtc.dev/1claw/apis/1claw-api/changes/v1/platform/apps/:appId/spend-policies/post.md)

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)