---
title: "Create policy override"
method: POST
path: "/api/v1/static-policies/{id}/override"
tags: ["Static Policies"]
deprecated: true
---

# Create policy override

`POST /api/v1/static-policies/{id}/override`

## Request

- Base URL: `https://agent.getaxonflow.com`
- URL: `https://agent.getaxonflow.com/api/v1/static-policies/{id}/override`
- Auth: none declared
- TypeScript: <https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/docs/api/v1/static-policies/:id/override/post.ts> (a function with typed inputs; its response is checked against the schema)

> **Deprecated.**

Retired in v11 (PRD v11 §1.5): a system control is enabled, disabled
or re-actioned in the organization's typed document, in its
`system_controls` section, through `/api/v1/typed-policies`. This
route writes nothing and does not read a body: it answers `409
LEGACY_POLICY_WRITE_FROZEN` to every authenticated caller, in every
edition. The ADR-044 session override writes answer the same refusal
since v11.0.0 (#4252); the override reads are unaffected.

## Path parameters

- `id` string, uuid, required

## Headers

- `Authorization` string
- `X-User-ID` string

## Request body

- CreateOverrideRequest: Request body for creating a policy override
  - `action_override` 'block' | 'require_approval' | 'redact' | 'warn' | 'log': Override the policy action
  - `enabled_override` boolean: Override the enabled status
  - `override_reason` string, required: Required explanation for audit trail
  - `expires_at` string, date-time: Optional expiration for the override

## Other responses

- `401`: Missing or invalid authentication. Handler-written 401s use the `{success, error}` envelope; 401s written by the auth middleware use the `{"error": {"code", "message"}}` envelope (JSONError).
- `409`: Per-policy overrides of system controls are retired in v11 (PRD v11 §1.5). A system control is enabled, disabled or re-actioned in the organization's typed document, in its `system_controls` section, through the typed authoring route (`/api/v1/typed-policies`, in `orchestrator-api.yaml`). The route stays registered so a caller is told where the write went. It writes nothing, and it answers this in every edition and on every database role: `policy_overrides` is not revoked by core/172, and no route writes it in v11 (the session override writes answer the same refusal since #4252), so the refusal is the handler's. The body is the `LegacyPolicyWriteFrozen` envelope: `JSONError` with `code` the string `LEGACY_POLICY_WRITE_FROZEN`.

---

[API](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api.md) - [All operations](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/revisions/34d30fcb7fa1?raw)