---
title: "Create an access policy"
method: POST
path: "/api/v1/platform/orgs/current/access-policies"
tags: ["access_policies"]
---

# Create an access policy

`POST /api/v1/platform/orgs/current/access-policies`

## Request

- Base URL: `https://api.smith.langchain.com`
- URL: `https://api.smith.langchain.com/api/v1/platform/orgs/current/access-policies`
- Auth: one of:
  - API key in header `X-API-Key`
  - API key in header `X-Organization-Id`
  - HTTP bearer

Creates a new access policy.

## Request body

- AuthzInternalCreateAccessPolicyPayload
  - `condition_groups` AuthzInternalConditionGroup[]
    - `conditions` AuthzInternalCondition[]
      - `attribute_key` string
      - `attribute_name` 'resource_tag_key' | 'root_run_metadata'
      - `attribute_value` string
      - `operator` 'equals' | 'not_equals' | 'equals_ignore_case' | 'not_equals_ignore_case' | 'matches' | 'not_matches' | 'equals_if_exists' | 'not_equals_if_exists' | 'equals_ignore_case_if_exists' | 'not_equals_ignore_case_if_exists' | 'matches_if_exists' | 'not_matches_if_exists'
    - `permission` 'annotation-queues:create' | 'annotation-queues:delete' | 'annotation-queues:read' | 'annotation-queues:update' | 'charts:create' | 'charts:delete' | 'charts:read' | 'charts:update' | 'custom-apps:create' | 'custom-apps:delete' | 'custom-apps:download' | 'custom-apps:read' | 'custom-apps:update' | 'datasets:clone' | 'datasets:create' | 'datasets:delete' | 'datasets:download' | 'datasets:read' | 'datasets:share' | 'datasets:tag-on-create' | 'datasets:update' | 'deployments:create' | 'deployments:delete' | 'deployments:read' | 'deployments:update' | 'deployments:cancel-runs' | 'feedback:create' | 'feedback:delete' | 'feedback:read' | 'feedback:update' | 'feedback-configs:create' | 'feedback-configs:update' | 'feedback-configs:delete' | 'feedback-configs:manage-enforced' | 'experiments:run' | 'issues:create' | 'issues:delete' | 'issues:read' | 'issues:update' | 'projects:create' | 'projects:delete' | 'projects:read' | 'projects:tag-on-create' | 'projects:update' | 'projects:increase-trace-tier' | 'projects:decrease-trace-tier' | 'prompts:create' | 'prompts:delete' | 'prompts:read' | 'prompts:tag-on-create' | 'prompts:update' | 'prompts:share' | 'rules:create' | 'rules:delete' | 'rules:read' | 'rules:update' | 'rules:configure-retention' | 'runs:create' | 'runs:read' | 'runs:read-inputs' | 'runs:read-outputs' | 'runs:read-stats' | 'runs:share' | 'runs:delete' | 'model-price-map:create' | 'model-price-map:read' | 'model-price-map:update' | 'model-price-map:delete' | 'sandboxes:create' | 'sandboxes:delete' | 'sandboxes:read' | 'sandboxes:tag-on-create' | 'sandboxes:update' | 'sandboxes:exec' | 'snapshots:create' | 'snapshots:delete' | 'snapshots:update' | 'functions:create' | 'functions:delete' | 'functions:update' | 'workspaces:settings:manage' | 'workspaces:retention:manage' | 'workspaces:usage-controls:manage' | 'workspaces:security-policy:manage' | 'workspaces:resource-tags:manage' | 'workspaces:integrations:manage' | 'workspaces:sandbox-proxy-profiles:manage' | 'workspaces:credentials:manage' | 'workspaces:access-control:assign-restricted' | 'workspaces:credentials:read-metadata' | 'workspaces:integrations:read' | 'workspaces:fleet-feedback:read-all' | 'workspaces:delete' | 'workspaces:credentials:use' | 'workspaces:manage-members' | 'workspaces:manage-secrets' | 'workspaces:manage' | 'workspaces:manage-model-configs' | 'workspaces:manage-keys' | 'workspaces:tracing-keys:create' | 'workspaces:read' | 'alerts:create' | 'alerts:update' | 'alerts:delete' | 'alerts:read' | 'agent-auth-connections:read' | 'agent-auth-connections:create' | 'agent-auth-connections:update' | 'agent-auth-connections:delete' | 'agent-auth-connections:revoke' | 'agent-auth-credentials:use' | 'bulk-exports:read' | 'bulk-exports:manage' | 'mcp-servers:create' | 'mcp-servers:create-personal' | 'mcp-servers:delete' | 'mcp-servers:invoke' | 'mcp-servers:read' | 'mcp-servers:update' | 'gateway:invoke' | 'fleet:read-admin-config' | 'fleet:write-admin-config' | 'fleet-agents:create' | 'fleet-agents:read' | 'fleet-agents:invoke' | 'fleet-agents:update' | 'fleet-agents:delete' | 'fleet-skills:create' | 'fleet-skills:read' | 'fleet-skills:update' | 'fleet-skills:delete' | 'organization:access-control:manage' | 'organization:audit-logs:read' | 'organization:authentication:manage' | 'organization:billing:manage' | 'organization:billing:read' | 'organization:engine:manage' | 'organization:engine:read' | 'organization:gateway:manage' | 'organization:infrastructure:manage' | 'organization:infrastructure:read' | 'organization:installation-operations:manage' | 'organization:installation-operations:read' | 'organization:installation-usage:manage' | 'organization:integrations:manage' | 'organization:integrations:read' | 'organization:members:manage' | 'organization:retention:manage' | 'organization:security-policy:manage' | 'organization:service-key:manage' | 'organization:settings:manage' | 'organization:usage-controls:manage' | 'organization:workspaces:manage' | 'organization:pats:create' | 'organization:read' | 'organization:read-metadata' | 'organization:manage' | 'organization:manage-model-configs' | 'organization:manage-model-secrets'
    - `resource_type` string
  - `description` string
  - `effect` string
  - `name` string
  - `role_ids` string[]: if present, attach to the specified roles

## Response `201`

Access policy created

- AuthzInternalAccessPolicyCreateResponse
  - `id` string

## Other responses

- `400`: Bad request
- `403`: Forbidden
- `404`: Role or access policy not found
- `422`: Semantic validation failed
- `500`: Internal server error
- `503`: Service unavailable

## Changes

- **2026-10-23** `5dfd05c0b870`: 3 info
  - added the new `functions:create` enum value to the request property `condition_groups/items/permission`
  - added the new `functions:delete` enum value to the request property `condition_groups/items/permission`
  - added the new `functions:update` enum value to the request property `condition_groups/items/permission`
- **2026-10-23** `1e5d6efef31c`: 14 info
  - added the new `workspaces:access-control:assign-restricted` enum value to the request property `condition_groups/items/permission`
  - added the new `workspaces:credentials:manage` enum value to the request property `condition_groups/items/permission`
  - added the new `workspaces:credentials:read-metadata` enum value to the request property `condition_groups/items/permission`
  - added the new `workspaces:credentials:use` enum value to the request property `condition_groups/items/permission`
  - …10 more
- **2026-10-21** `016683c2a6e3`: 1 info
  - added the new `mcp-servers:create-personal` enum value to the request property `condition_groups/items/permission`
- **2026-10-20** `258a4e4e05fc`: 1 info
  - added the new `deployments:cancel-runs` enum value to the request property `condition_groups/items/permission`
- **2026-10-20** `b49e699ef6f7`: 1 info
  - added the new `root_run_metadata` enum value to the request property `condition_groups/items/conditions/items/attribute_name`

[Operation history](https://skmtc.dev/langchain-ai/apis/langsmith/changes/api/v1/platform/orgs/current/access-policies/post.md)

---

[API](https://skmtc.dev/langchain-ai/apis/langsmith.md) - [All operations](https://skmtc.dev/langchain-ai/apis/langsmith/llms.txt) - [OpenAPI document](https://skmtc.dev/langchain-ai/apis/langsmith/revisions/7a01c01f75e8?raw)