Sign in
PolicySets

Create a new policy set

Creates an unbound policy set. Use updatePolicySet to bind after creating a version.

post/zones/{zone_id}/policy-sets

Path parameters

zone_idstring required

The zone identifier

Headers

X-API-Versionstring

API version header (date-based, e.g. 2026-02-01)

X-Client-Request-IDstring uuid

Unique request identifier specified by the originating caller and passed along by proxies.

Request body

namestring required
scope_type'zone'

Deprecated. Use target_type instead. Only zone is accepted; use target_type for user targets.

target_type'zone' | 'user'

What this policy set targets:

  • "zone" — applies to all requests in the zone.
  • "user" — can be bound to a specific user.

Response

The newly created policy set

idstring required
zone_idstring required
namestring required
scope_type'zone' | 'resource' | 'user' | 'session' required

Deprecated. Use target_type instead. Carries the same value.

target_type'zone' | 'user' required

What this policy set targets:

  • "zone" — applies to all requests in the zone.
  • "user" — scoped to a specific user.

resource and session are reserved; legacy sets with those scopes carry them in the deprecated scope_type field.

latest_version_idstring nullable
latest_versioninteger nullable

Human-readable version number of the latest version (e.g., 1, 2, 3)

archived_atstring date-time nullable
created_atstring date-time required
updated_atstring date-time required
created_bystring required
updated_bystring nullable
owner_type'platform' | 'customer' required

Who manages this policy set:

  • "platform" — managed by the Keycard platform (system policies).
  • "customer" — managed by the tenant (custom policies).
scope_target_idstring nullable

Deprecated. Use target_id instead. Carries the active binding's target; null when unbound.

target_idstring nullable

Target entity ID. Equals zone_id for zone-targeted sets; the principal identifier for principal-scoped sets. Null only for legacy non-zone sets that predate target tracking.

mode'active' | 'shadow' nullable
activeboolean

Whether this policy set is currently bound to a scope

active_version_idstring nullable

Public ID of the currently active (bound) version

active_versioninteger nullable

Human-readable version number of the active version (e.g., 1, 2, 3)

shadow_version_idstring nullable

Public ID of the shadow (observed) version, if any

shadow_versioninteger nullable

Human-readable version number of the shadow version

Changes

Changed in 4 of the 23 revisions of this API.310

  • 1a0dd4d857ee36See the full diff
    • ▲

      removed the enum value resource of the request property

      request-property-enum-value-removed

    • ▲

      removed the enum value session of the request property

      request-property-enum-value-removed

    • ▲

      removed the enum value user of the request property

      request-property-enum-value-removed

    • ○

      added the new optional request property

      new-optional-request-property

    • ○

      request property deprecated

      request-property-deprecated

    • ○

      added the optional property / to the response with the status

      response-optional-property-added

    • ○

      response property allOf[pdp_PolicySet]/scope_type deprecated

      response-property-deprecated

    • ○

      response property allOf[subschema #2]/scope_target_id deprecated

      response-property-deprecated

    • ○

      added the required property //// to the response with the status

      response-required-property-added

  • 932699a5ea162See the full diff
    • ○

      added the optional property / to the response with the status

      response-optional-property-added

    • ○

      added the optional property / to the response with the status

      response-optional-property-added

  • aee6e66de0d31See the full diff
    • ○

      the endpoint scheme security OAuth2 was added to the API

      api-security-added

  • d3d69f45bfed1See the full diff
    • ○

      endpoint added

      endpoint-added

    This revision also has 8 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog