---
title: "Submit a policy for your own account"
method: POST
path: "/me/policy"
tags: ["account-policies"]
---

# Submit a policy for your own account

`POST /me/policy`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/me/policy`
- Auth: API key in header `Authorization`

Stores a new version of the rules your account puts on itself, and validates it. The policy must declare `package account.a_<your account id, dashes as underscores>` and may only DENY: it is evaluated after platform and tenant policy, only for requests your account makes, and a `deny` there refuses what they allowed. `allow` and `declared_types` are refused, because an account cannot grant itself anything. Otherwise it is validated exactly like a tenant policy — restricted builtins, the enforcer.v1 stdlib, the policy's own test_ rules — and a refused submission is stored with its reason and still returns 200, with the verdict in `validation`. Nothing changes until a version is activated.

## Request body

- InternalDeliveryHttpHandlerSubmitTenantPolicyRequest
  - `source` string

## Response `200`

OK

- InternalDeliveryHttpHandlerTenantPolicyResponse
  - `data` EnforcerV3InternalDomainTenantpolicyPolicy
    - `accessor_version` integer
    - `activated_at` string
    - `created_at` string
    - `created_by` string
    - `declared_types` string[]: DeclaredTypes are the resource types this policy is authoritative for. Platform types are never here: on those a tenant policy may only DENY, never widen. On a declared type, no policy means no authority.
    - `id` string
    - `retired_at` string
    - `source` string: Source is the Rego verbatim as submitted.
    - `source_sha256` string: SourceSHA256 lets a re-submit of identical text be recognised as a no-op rather than minting a version that changes nothing.
    - `status` string
    - `subject_account_id` string: SubjectAccountID is set when the policy governs one account rather than the tenant. See Subject.
    - `tenant_id` string
    - `validation_error` string
    - `version` integer: Version is monotonic per subject and never reused, because it is what a decision log cites and what an evaluator's cache keys on.
  - `success` boolean
  - `validation` EnforcerV3InternalUsecaseTenantpoliciesResult
    - `declaredTypes` string[]: DeclaredTypes are the resource types the policy is authoritative for, read from its own `declared_types` rule. Platform types are rejected here rather than ignored later: a tenant claiming authority over `account` must be told no, not silently overruled at evaluation.
    - `error` string: Error is why not, phrased for the person who wrote the policy — they cannot see our logs and "compilation failed" tells them nothing.
    - `ok` boolean: OK is whether the policy may be activated.
    - `testsFailed` integer: TestsRun and TestsFailed report the policy's own test_ rules.
    - `testsRun` integer: TestsRun and TestsFailed report the policy's own test_ rules.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)