GEgetaxonflow
System Policies

Create static policy

Creates a new static policy for the tenant.

Tier restrictions:

  • system tier: Cannot be created via API (managed by AxonFlow)
  • organization tier: Requires Enterprise license
  • tenant tier: Default, limited to 20 policies in Community mode

Part of ADR-019: Unified Policy Management System.

v11: on a deployment whose database connection cannot write static_policies (migrations/core/172), this route answers 409 LEGACY_POLICY_WRITE_FROZEN before the request body is read, whatever it contains, naming the typed authoring route. An owner-role deployment still creates.

post/api/v1/system-policies

Request

Headers

Authorizationstring

Basic auth credentials: Basic base64(clientId:clientSecret). Required in evaluation/enterprise mode. Optional in community mode (defaults to community tenant).

X-User-IDstring

User ID for audit trail

Request body

namestring required

Display name of the policy

descriptionstring

Detailed policy description

category'security-sqli' | 'security-admin' | 'pii-global' | 'pii-us' | 'pii-eu' | 'pii-india' | 'custom' required

Policy category

tier'organization' | 'tenant'

Policy tier (system not allowed via API). Default is tenant.

patternstring required

Regex pattern for detection

action'block' | 'require_approval' | 'redact' | 'warn' | 'log' required

Action to take when pattern matches

severity'critical' | 'high' | 'medium' | 'low'

Severity level

priorityinteger

Priority order (lower = higher priority)

enabledboolean

Whether the policy is active

tagsstring[]

Tags for categorization

Example request

{
  "name": "Custom Employee ID Detection",
  "pattern": "EMP-[0-9]{6}"
}

Response

Policy created successfully

idstring uuid required

Unique policy UUID

policy_idstring required

Human-readable policy identifier (e.g., sys_sqli_union_select)

namestring required

Display name of the policy

descriptionstring

Detailed policy description

category'security-sqli' | 'security-admin' | 'pii-global' | 'pii-us' | 'pii-eu' | 'pii-india' | 'custom' required

Policy category (v2.0.0 semantic naming)

tier'system' | 'organization' | 'tenant'

Policy tier in the hierarchy

patternstring required

Regex pattern for detection

severity'critical' | 'high' | 'medium' | 'low' required

Policy severity level

action'block' | 'require_approval' | 'redact' | 'warn' | 'log' required

Action to take when pattern matches. require_approval triggers HITL queue for human oversight.

enabledboolean required

Whether policy is active

priorityinteger

Evaluation priority (higher = evaluated first)

versioninteger

Policy version number

has_overrideboolean

Whether this policy has an override (Enterprise only)

tenant_idstring required

Tenant ID (for tenant-tier policies)

created_atstring date-time required

When policy was created

updated_atstring date-time required

When policy was last modified

Example response

{
  "policy_id": "sys_sqli_union_select",
  "name": "UNION SELECT Detection",
  "description": "Detects SQL injection attempts using UNION SELECT",
  "tier": "system",
  "pattern": "(?i)\\bUNION\\s+(ALL\\s+)?SELECT\\b",
  "priority": 1000,
  "version": 1
}

Changes

No recorded changes to this operation across all 1 revision of this API.