---
title: "Create a session-level policy rule (owner only) [write]"
method: POST
path: "/sessions/{id}/policies"
---

# Create a session-level policy rule (owner only) \[write\]

`POST /sessions/{id}/policies`

## Request

- Base URL: `https://api.agentsky.dev/v1`
- URL: `https://api.agentsky.dev/v1/sessions/{id}/policies`
- Auth: HTTP bearer

## Path parameters

- `id` string, required

## Request body

- union: One rule, chosen by `kind`. TOOL_CALL: {action: allow|ask|deny, matcher?: tool names joined by |, commandPatterns?: shell globs}. SPEND_CAP: {hardCapUsdMicros, warnUsdMicros?} per session, warn below the cap. CALL_COUNT: {limitPerSession}. CAPABILITY: {<capability id>: allow|ask|deny}; platform.* ids accept allow or deny.
  - object
    - `name` string, required
    - `enabled` boolean
    - `position` integer
    - `kind` 'TOOL_CALL', required
    - `config` object, required
      - `action` 'allow' | 'ask' | 'deny', required
      - `matcher` string
      - `commandPatterns` string[]
  - object
    - `name` string, required
    - `enabled` boolean
    - `position` integer
    - `kind` 'SPEND_CAP', required
    - `config` object, required
      - `warnUsdMicros` integer, nullable
      - `hardCapUsdMicros` integer, required
  - object
    - `name` string, required
    - `enabled` boolean
    - `position` integer
    - `kind` 'CALL_COUNT', required
    - `config` object, required
      - `limitPerSession` integer, required
  - object
    - `name` string, required
    - `enabled` boolean
    - `position` integer
    - `kind` 'CAPABILITY', required
    - `config` object, required

## Response `201`

Created

- object
  - `rule` PolicyRule
    - `id` string, required
    - `name` string, required
    - `kind` 'TOOL_CALL' | 'SPEND_CAP' | 'CALL_COUNT' | 'CAPABILITY', required
    - `enabled` boolean, required
    - `config` object, required
    - `layer` 'workspace' | 'agent' | 'session', required
    - `position` integer, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required

## Other responses

- `default`: Error — { error: { code, message, request_id } }

## Changes

- **2026-11-02** `e5e8f0229a99`: 1 breaking, 14 info
  - the request's body type changed from `object` to no type
  - added `subschema #1, subschema #2, subschema #3, subschema #4` to the request body `oneOf` list
  - added the optional property `error/request_id` to the response with the `default` status
  - the response property `error` became required for the status `default`
  - …11 more

[Operation history](https://skmtc.dev/agentsky/apis/agentsky-developer-api/changes/sessions/:id/policies/post.md)

---

[API](https://skmtc.dev/agentsky/apis/agentsky-developer-api.md) - [All operations](https://skmtc.dev/agentsky/apis/agentsky-developer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/agentsky/apis/agentsky-developer-api/revisions/8280a065ef6a?raw)