---
title: "Import policies"
method: POST
path: "/api/v1/policies/import"
tags: ["Dynamic Policies"]
deprecated: true
---

# Import policies

`POST /api/v1/policies/import`

## Request

- Base URL: `https://orchestrator.getaxonflow.com`
- URL: `https://orchestrator.getaxonflow.com/api/v1/policies/import`
- Auth: none declared. Required headers: `X-Tenant-ID`
- TypeScript: <https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/docs/api/v1/policies/import/post.ts> (a function with typed inputs; its response is checked against the schema)

> **Deprecated.**

Bulk import policies from JSON or YAML format.
Supports create or update semantics based on policy_id.

On a deployment whose database connection cannot write the legacy
policy tables (migrations/core/172), the request is refused `409
LEGACY_POLICY_WRITE_FROZEN` before its body is read, whatever it
contains, and the refusal names the typed authoring route. An
owner-role deployment still imports.

## Headers

- `X-Tenant-ID` string, required
- `X-User-ID` string

## Request body

- object
  - `policies` CreatePolicyRequest[], required
    - `name` string, required
    - `description` string
    - `type` 'static' | 'dynamic', required
    - `category` string
    - `tier` 'organization' | 'tenant'
    - `pattern` string: Required for static policies
    - `action` 'block' | 'require_approval' | 'redact' | 'warn' | 'log'
    - `severity` 'critical' | 'high' | 'medium' | 'low'
    - `priority` integer
    - `enabled` boolean
    - `conditions` object[]: Required for dynamic policies
    - `actions` object[]: Required for dynamic policies
  - `mode` 'create' | 'upsert': Import mode - create only or upsert (create or update)

## Response `200`

Import result

- object
  - `created` integer
  - `updated` integer
  - `failed` integer
  - `errors` string[]

## Other responses

- `400`: Invalid request (coded envelope)
- `401`: Unauthorized - missing or invalid organization scope (coded envelope)
- `409`: The legacy policy tables are read-only. migrations/core/172 revoked INSERT/UPDATE/DELETE/TRUNCATE on static_policies and dynamic_policies from the application roles, and this endpoint writes them, so the write is refused permanently rather than transiently. It is not an entitlement fact: no licence, edition or upgrade changes it. Author policies through the typed authoring route instead. Reads on this endpoint are unaffected. A deployment whose connection may still write the tables (the database owner) does not receive this response. Where the connection cannot write them, the create, update and bulk-import routes answer this before reading the request body, whatever it contains.

---

[API](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api.md) - [All operations](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/revisions/f408ef3ec9dd?raw)