---
title: "Create a session-scoped policy override (retired in v11)"
method: POST
path: "/api/v1/overrides"
tags: ["Decisions & Overrides"]
---

# Create a session-scoped policy override (retired in v11)

`POST /api/v1/overrides`

## Request

- Base URL: `https://orchestrator.getaxonflow.com`
- URL: `https://orchestrator.getaxonflow.com/api/v1/overrides`
- Auth: none declared. Required headers: `X-User-Email`, `X-Tenant-ID`
- TypeScript: <https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/docs/api/v1/overrides/post.ts> (a function with typed inputs; its response is checked against the schema)

Retired in v11 (PRD v11 §1.5, #4252). The workflow step gate no
longer reads an ADR-044 session override (the last deciding reader,
the agent's tier pass, goes with #4281), so this route writes nothing: a
policy is enabled, disabled or re-actioned in the organization's
typed document through `/api/v1/typed-policies`. The route stays
registered so a caller is told where the write went.

The guards that authenticate the request answer first (the agent's
proxy token, 403; the per-user identity, 401; the tenant, 400), then
every caller is answered `409 LEGACY_POLICY_WRITE_FROZEN`. The body
is not read. The override reads (`GET`) are unaffected.

## Headers

- `X-User-Email` string, required
- `X-Tenant-ID` string, required
- `X-Org-ID` string

## Request body

- CreateOverrideRequest
  - `policy_id` string, required: Policy UUID, or the human-readable slug (static) / name (dynamic)
  - `policy_type` 'static' | 'dynamic', required
  - `tool_signature` string: Optional tool scope for the override
  - `override_reason` string, required: Mandatory justification (ADR-044)
  - `ttl_seconds` integer: Override lifetime in seconds. Omitted/0 defaults to 3600. Clamped server-side to [60, 86400]; the response reports any clamp.

## Other responses

- `400`: Missing X-Tenant-ID
- `401`: Missing user identity (X-User-Email / X-User-ID)
- `403`: The request did not arrive through the agent gateway (proxy authentication)
- `409`: Policy overrides are retired in v11 (PRD v11 §1.5, #4252). The workflow step gate no longer reads a session override (the last deciding reader, the agent's tier pass, goes with #4281), so the session override writes answer this in every edition and on every database role, after the guards that authenticate the request. A policy is enabled, disabled or re-actioned in the organization's typed document through `/api/v1/typed-policies`. The body is the coded envelope with `code` the string `LEGACY_POLICY_WRITE_FROZEN`.

---

[API](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api.md) - [All operations](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/revisions/f408ef3ec9dd?raw)