---
title: "POST /v1/{+parent}/accessLevels"
method: POST
path: "/v1/{+parent}/accessLevels"
tags: ["accessPolicies"]
---

# POST /v1/{+parent}/accessLevels

`POST /v1/{+parent}/accessLevels`

Creates an access level. The long-running operation from this RPC has a successful status after the access level propagates to long-lasting storage. If access levels contain errors, an error response is returned for the first error encountered.

## Path parameters

- `parent` string, required

## Request body

- AccessLevel — An `AccessLevel` is a label that can be applied to requests to Google Cloud services, along with a list of requirements necessary for the label to be applied.
  - `name` string — Identifier. Resource name for the `AccessLevel`. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The `access_level` component must begin with a letter, followed by alphanumeric characters or `_`. Its maximum length is 50 characters. After you create an `AccessLevel`, you cannot change its `name`.
  - `title` string — Human readable title. Must be unique within the Policy.
  - `custom` CustomLevel — `CustomLevel` is an `AccessLevel` using the Cloud Common Expression Language to represent the necessary conditions for the level to apply to a request. See CEL spec at: https://github.com/google/cel-spec
    - `expr` Expr — Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
      - `expression` string — Textual representation of an expression in Common Expression Language syntax.
      - `description` string — Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
      - `location` string — Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
      - `title` string — Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
  - `basic` BasicLevel — `BasicLevel` is an `AccessLevel` using a set of recommended features.
    - `combiningFunction` 'AND' | 'OR' — How the `conditions` list should be combined to determine if a request is granted this `AccessLevel`. If AND is used, each `Condition` in `conditions` must be satisfied for the `AccessLevel` to be applied. If OR is used, at least one `Condition` in `conditions` must be satisfied for the `AccessLevel` to be applied. Default behavior is AND.
    - `conditions` Condition[] — Required. A list of requirements for the `AccessLevel` to be granted.
      - `devicePolicy` DevicePolicy — `DevicePolicy` specifies device specific restrictions necessary to acquire a given access level. A `DevicePolicy` specifies requirements for requests from devices to be granted access levels, it does not do any enforcement on the device. `DevicePolicy` acts as an AND over all specified fields, and each repeated field is an OR over its elements. Any unset fields are ignored. For example, if the proto is { os_type : DESKTOP_WINDOWS, os_type : DESKTOP_LINUX, encryption_status: ENCRYPTED}, then the DevicePolicy will be true for requests originating from encrypted Linux desktops and encrypted Windows desktops.
        - `osConstraints` OsConstraint[] — Allowed OS versions, an empty list allows all types and all versions.
          - `minimumVersion` string — The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: `"major.minor.patch"`. Examples: `"10.5.301"`, `"9.2.1"`.
          - `osType` 'OS_UNSPECIFIED' | 'DESKTOP_MAC' | 'DESKTOP_WINDOWS' | 'DESKTOP_LINUX' | 'DESKTOP_CHROME_OS' | 'ANDROID' | 'IOS' — Required. The allowed OS type.
          - `requireVerifiedChromeOs` boolean — Only allows requests from devices with a verified Chrome OS. Verifications includes requirements that the device is enterprise-managed, conformant to domain policies, and the caller has permission to call the API targeted by the request.
        - `allowedEncryptionStatuses` string[] — Allowed encryptions statuses, an empty list allows all statuses.
        - `requireAdminApproval` boolean — Whether the device needs to be approved by the customer admin.
        - `allowedDeviceManagementLevels` string[] — Allowed device management levels, an empty list allows all management levels.
        - `requireScreenlock` boolean — Whether or not screenlock is required for the DevicePolicy to be true. Defaults to `false`.
        - `requireCorpOwned` boolean — Whether the device needs to be corp owned.
      - `requiredAccessLevels` string[] — A list of other access levels defined in the same `Policy`, referenced by resource name. Referencing an `AccessLevel` which does not exist is an error. All access levels listed must be granted for the Condition to be true. Example: "`accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME"`
      - `ipSubnetworks` string[] — CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
      - `negate` boolean — Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields. Any non-empty field criteria evaluating to false will result in the Condition to be satisfied. Defaults to false.
      - `regions` string[] — The request must originate from one of the provided countries/regions. Must be valid ISO 3166-1 alpha-2 codes.
      - `members` string[] — The request must be made by one of the provided user or service accounts. Groups are not supported. Syntax: `user:{emailid}` `serviceAccount:{emailid}` If not specified, a request may come from any user.
      - `vpcNetworkSources` VpcNetworkSource[] — The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with `ip_subnetworks`.
        - `vpcSubnetwork` VpcSubNetwork — Sub-segment ranges inside of a VPC Network.
          - `vpcIpSubnetworks` string[] — CIDR block IP subnetwork specification. The IP address must be an IPv4 address and can be a public or private IP address. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. If empty, all IP addresses are allowed.
          - `network` string — Required. Network name. If the network is not part of the organization, the `compute.network.get` permission must be granted to the caller. Format: `//compute.googleapis.com/projects/{PROJECT_ID}/global/networks/{NETWORK_NAME}` Example: `//compute.googleapis.com/projects/my-project/global/networks/network-1`
  - `description` string — Description of the `AccessLevel` and its use. Does not affect behavior.

## Response `200`

Successful response

---

[API](https://skmtc.dev/google/apis/accesscontextmanager.md) · [All operations](https://skmtc.dev/google/apis/accesscontextmanager/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/google/accesscontextmanager/revisions/af581187d9ba/schema)