---
title: "Create a policy"
method: POST
path: "/api/v1/tenants/{tenantId}/policies"
tags: ["Policies"]
---

# Create a policy

`POST /api/v1/tenants/{tenantId}/policies`

## Request

- Base URL: `http://dobby-ai.com`
- URL: `http://dobby-ai.com/api/v1/tenants/{tenantId}/policies`
- Auth: HTTP bearer

Create a user-authored policy. `scope_id` is auto-filled from context when omitted (layer 1 → null, layer 2 → org_id, layer 3 → tenant_id); layer 4 requires an explicit workflow_id. Layer-3 policies are validated stricter-wins against the parent org (422 `policy_looser_than_parent` when looser). Auth: NextAuth session OR an `sk_live_` API key (`Authorization: Bearer` or `X-API-Key`); requires the admin role.

## Path parameters

- `tenantId` string, required

## Request body

- object
  - `layer` integer, required: 1=Platform, 2=Org, 3=Tenant, 4=Process
  - `scope_id` string, nullable: Scope of the policy — auto-filled per layer when omitted; workflow_id for layer 4
  - `text` string, required: The policy text (natural language)
  - `severity` 'critical' | 'high' | 'medium' | 'low', required
  - `is_active` boolean

## Response `201`

Policy created

- object
  - `success` boolean
  - `data` Policy
    - `policy_id` string
    - `layer` 1 | 2 | 3 | 4: 1=Platform, 2=Org, 3=Tenant, 4=Process
    - `scope_id` string, nullable: null for layer 1; org_id for layer 2; tenant_id for layer 3; workflow_id for layer 4
    - `text` string
    - `source` string
    - `framework_ref` string, nullable
    - `severity` 'critical' | 'high' | 'medium' | 'low'
    - `is_active` boolean
    - `version` integer
    - `authored_by` string, nullable
    - `created_at` string, date-time
    - `updated_at` string, date-time
  - `inline_enforcement` object: Whether the policy compiled into a live inline-enforcement rule for /controls/check

## Other responses

- `400`: Bad Request - Invalid parameters
- `401`: Unauthorized - Missing or invalid authentication
- `403`: Forbidden - Missing required scope
- `404`: Not Found - Resource does not exist
- `422`: Stricter-wins violation — a parent Org policy on the same topic is stricter (`policy_looser_than_parent`)

---

[API](https://skmtc.dev/dobby-ai/apis/dobby-platform-api.md) · [All operations](https://skmtc.dev/dobby-ai/apis/dobby-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dobby-ai/apis/dobby-platform-api/revisions/398634f0306f?raw)