---
title: "Create Policy"
method: POST
path: "/governance/guardrails/{tenant_id}/policies"
tags: ["Guardrails"]
---

# Create Policy

`POST /governance/guardrails/{tenant_id}/policies`

Creates a new policy under the tenant which will generate a unique policy id in the response this is can be used to describe details about the policy, update policy, execute or delete policy. However the policy will be accessible based on its scope  Account scope - All users under that account will have access to describe and execute. Only Account admins can update/delete. Tenant - Users with access to the specific tenant will have access scripts to describe and execute. Tenant admins can update/delete. Private - User who created will only have access.

## Path parameters

- `tenant_id` string, required

## Request body

- CreatePolicyRequest
  - `name` string, required — policy name which is unique and does not allow special character or space
  - `display_name` string — Display name of policy which allow space this is to mostly show on the ui
  - `description` string, required — A brief explanation of the policy.
  - `type` string[] — Indicates the type of policy
  - `category` string, required — The category will be either service or resource
  - `content` string, required — The policy content
  - `is_system_policy` boolean — Flag to identify system policies
  - `engine_type` 'corestack_policy' | 'aws_organization_policy' | 'azure_policy' | 'aws_config' | 'gcp_organization_policy' | 'gcp_policy' | 'kubernetes_policy' | 'oracle_cloud_guard', required — Engine type of the policy
  - `cloud` string[] — Displays the cloud associated with the policy
  - `classification` string, required — Policies are classified based on the basis of the activity they perform, for example provisioning, Account Management, Utilization, etc. This value is displayed in this field
  - `sub_classification` string, required — Sub classification for policy
  - `scope` 'private' | 'account' | 'tenant', required — The scope of the policy: Account scope - All users under that account will have access to view and execute Only Account admins can update/delete the policies, Tenant Scope - Users with access to the specific tenant will have access to policies who can describe or execute policies. Tenant admins can only update/delete. Private Scope - User who created will only have access
  - `content_type` 'git' | 'file', required — Policy content source
  - `content_password_or_key` string — Password or private key to access of Git repo if repo is authenticated required only in case of content type git
  - `content_username` string — Username of Git repo if repo is authenticated required only in case of content type git
  - `content_url` string — Git project URL when the content type is git required only in case of content type git
  - `content_path` string — Root path of the policy in git repo required only in case of content type git
  - `severity` 'high' | 'low' | 'medium', required — Severity of policy.

## Response `201`

Success

- PolicyData
  - `policy_id` string, required — unique policy Id returned

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `500` — Internal Server Error

---

[API](https://skmtc.dev/corestack/apis/corestack-external-api.md) · [All operations](https://skmtc.dev/corestack/apis/corestack-external-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/corestack/corestack-external-api/revisions/bf2cdf20826d/schema)