---
title: "Make a policy for the organization, a workspace, a project or a key. One per scope; the narrowest wins."
method: POST
path: "/v1/approvals/policies"
tags: ["approvals"]
---

# Make a policy for the organization, a workspace, a project or a key. One per scope; the narrowest wins.

`POST /v1/approvals/policies`

## Request

- Base URL: `https://api.50heads.com`
- URL: `https://api.50heads.com/v1/approvals/policies`
- Auth: HTTP bearer

Organization admins only (403 `organization_admin_required`), on a browser session with a fresh proof in the `x-50h-reauth` header (401 `reauth_required`). It needs a person: API keys, connected apps and service accounts get 403 `session_required`. Every change is written to the organization's audit. Approvers must be people in the organization (in the workspace, for a workspace, project or key policy).

## Request body

- ApprovalPolicyCreateRequest
  - `enabled` boolean
  - `always` boolean
  - `perAskPence` integer, nullable
  - `perDayPence` integer, nullable
  - `perMonthPence` integer, nullable
  - `requireForTiers` integer[]
  - `requireForImages` boolean
  - `approvers` object
    - `roles` string[]
    - `people` string[]
  - `quorum` union
    - 1
    - 2
  - `expiresInMinutes` integer
  - `onExpiry` 'deny'
  - `allowSelfApprovalUnderPence` integer, nullable
  - `notify` string[]
  - `scope` 'organization' | 'workspace' | 'project' | 'key', required
  - `scopeId` string, nullable

## Response `201`

OK

- ApprovalPolicyCreateResponse
  - `policy` object, required
    - `id` string, required
    - `organizationId` string, required
    - `scope` 'organization' | 'workspace' | 'project' | 'key', required
    - `scopeId` string, nullable, required
    - `scopeName` string, nullable, required
    - `enabled` boolean, required
    - `always` boolean, required
    - `perAskPence` integer, nullable, required
    - `perDayPence` integer, nullable, required
    - `perMonthPence` integer, nullable, required
    - `requireForTiers` integer[], required
    - `requireForImages` boolean, required
    - `approvers` object, required
      - `roles` string[], required
      - `people` object[], required
        - `userId` string, required
        - `name` string, nullable, required
        - `email` string, nullable, required
    - `quorum` union, required
      - 1
      - 2
    - `expiresInMinutes` integer, required
    - `onExpiry` 'deny', required
    - `allowSelfApprovalUnderPence` integer, nullable, required
    - `notify` string[], required
    - `createdAt` string, required
    - `updatedAt` string, nullable, required

## Other responses

- `400`: The request is not valid; `error.details.validation` lists the fixes.
- `401`: No key or token, or it expired or was revoked.
- `403`: The key or token lacks the scope (`insufficient_scope`), or the action is not allowed.
- `429`: Too many requests; wait for Retry-After.

---

[API](https://skmtc.dev/50heads/apis/50heads-api.md) · [All operations](https://skmtc.dev/50heads/apis/50heads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/50heads/apis/50heads-api/revisions/20175e8b00e3?raw)