policies

Create policy

Compiles and stores a new custom Rego policy under the fixed enforcer.custom package, live immediately with no restart — every replica compiles and caches it by content hash on first evaluation, not at deploy time. The module is UNTRUSTED CODE by construction: network/host builtins (http.send, net.lookup_ip_addr, opa.runtime) are stripped, so a policy referencing them fails to compile rather than being allowed to exfiltrate accessor data or reach the cluster network. A policy with no tenant_id (global, consumable by every tenant) requires the admin role — 403 forbidden otherwise for a tenant_admin caller.

post/policies

Request

  • Base URL: https://api.instruxi.dev/api/v1/enforcer
  • URL: https://api.instruxi.dev/api/v1/enforcer/policies
  • Auth: one of:
    • API key in header Authorization
    • API key in header X-API-Key

Request body

activeboolean

Active defaults to true on create; on update it is applied as given.

descriptionstring
namestring
sourcestring
tenant_idstring

TenantID targets a tenant-scoped policy (admin may target any tenant; a tenant_admin is always pinned to their own). Empty = a global policy (admin only).

Response

Created

successboolean

Example response

{
  "success": true
}

Changes

No recorded changes to this operation across all 1 revision of this API.