---
title: "Create static policy"
method: POST
path: "/api/v1/static-policies"
tags: ["Static Policies"]
deprecated: true
---

# Create static policy

`POST /api/v1/static-policies`

## Request

- Base URL: `https://agent.getaxonflow.com`
- URL: `https://agent.getaxonflow.com/api/v1/static-policies`
- Auth: none declared
- TypeScript: <https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/docs/api/v1/static-policies/post.ts> (a function with typed inputs; its response is checked against the schema)

> **Deprecated.**

Creates a new static policy for the tenant.

**Tier restrictions:**
- `system` tier: Cannot be created via API (managed by AxonFlow)
- `organization` tier: Requires Enterprise license
- `tenant` tier: Default, limited to 20 policies in Community mode

Part of ADR-019: Unified Policy Management System.

**v11:** on a deployment whose database connection cannot write
`static_policies` (`migrations/core/172`), this route answers
`409 LEGACY_POLICY_WRITE_FROZEN` before the request body is read,
whatever it contains, naming the typed authoring route. An
owner-role deployment still creates.

## Headers

- `Authorization` string
- `X-User-ID` string

## Request body

- CreateStaticPolicyRequest: Request body for creating a static policy
  - `name` string, required: Display name of the policy
  - `description` string: Detailed policy description
  - `category` 'security-sqli' | 'security-admin' | 'pii-global' | 'pii-us' | 'pii-eu' | 'pii-india' | 'custom', required: Policy category
  - `tier` 'organization' | 'tenant': Policy tier (system not allowed via API). Default is tenant.
  - `pattern` string, required: Regex pattern for detection
  - `action` 'block' | 'require_approval' | 'redact' | 'warn' | 'log', required: Action to take when pattern matches
  - `severity` 'critical' | 'high' | 'medium' | 'low': Severity level
  - `priority` integer: Priority order (lower = higher priority)
  - `enabled` boolean: Whether the policy is active
  - `tags` string[]: Tags for categorization

## Response `201`

Policy created successfully

- StaticPolicy: A static policy with three-tier hierarchy support (v2.0.0). System policies are immutable; Organization/Tenant policies can be customized.
  - `id` string, uuid, required: Unique policy UUID
  - `policy_id` string, required: Human-readable policy identifier (e.g., sys_sqli_union_select)
  - `name` string, required: Display name of the policy
  - `description` string: Detailed policy description
  - `category` 'security-sqli' | 'security-admin' | 'pii-global' | 'pii-us' | 'pii-eu' | 'pii-india' | 'custom', required: Policy category (v2.0.0 semantic naming)
  - `tier` 'system' | 'organization' | 'tenant': Policy tier in the hierarchy
  - `pattern` string, required: Regex pattern for detection
  - `severity` 'critical' | 'high' | 'medium' | 'low', required: Policy severity level
  - `action` 'block' | 'require_approval' | 'redact' | 'warn' | 'log', required: Action to take when pattern matches. require_approval triggers HITL queue for human oversight.
  - `enabled` boolean, required: Whether policy is active
  - `priority` integer: Evaluation priority (higher = evaluated first)
  - `version` integer: Policy version number
  - `has_override` boolean: Whether this policy has an override (Enterprise only)
  - `override` PolicyOverride: Override configuration for system policies (Enterprise only)
    - `id` string: Override identifier
    - `policy_id` string: ID of the policy being overridden
    - `policy_type` 'static' | 'dynamic': Type of policy being overridden
    - `tenant_id` string: Tenant ID for tenant-level overrides
    - `enabled_override` boolean: Override enabled status (null = no override)
    - `action_override` 'block' | 'require_approval' | 'redact' | 'warn' | 'log': Override action (must be more restrictive). require_approval triggers HITL queue.
    - `override_reason` string: Reason for the override (required for audit)
    - `expires_at` string, date-time: When the override automatically expires
    - `created_by` string: User who created the override
    - `created_at` string, date-time
    - `updated_by` string: User who last updated the override
    - `updated_at` string, date-time
  - `tenant_id` string, required: Tenant ID (for tenant-tier policies)
  - `created_at` string, date-time, required: When policy was created
  - `updated_at` string, date-time, required: When policy was last modified

## Other responses

- `400`: Invalid request body or missing required fields
- `403`: Operation forbidden (e.g., system tier creation, license required)
- `409`: The legacy policy tables are read-only. `migrations/core/172` revoked INSERT, UPDATE, DELETE and TRUNCATE on `static_policies` from the application roles, and this endpoint writes it, so the write is refused permanently rather than transiently. It is not an entitlement fact: no licence, edition or upgrade changes it. Author policies through the typed authoring route (`/api/v1/typed-policies`, in `orchestrator-api.yaml`) instead. Reads are unaffected. A deployment whose connection may still write the table (the database owner; a property of the connection, not of `AXONFLOW_DB_USE_APP_ROLE` alone) is not bound by the revoke and does not receive this response. The body is the `JSONError` envelope with `code` as the string `LEGACY_POLICY_WRITE_FROZEN` rather than the numeric status.

---

[API](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api.md) - [All operations](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/revisions/34d30fcb7fa1?raw)