---
title: "create policy"
method: POST
path: "/policies"
tags: ["policy"]
---

# create policy

`POST /policies`

## Query parameters

- `run-tests-first` boolean — set this field to false to exclude running tests prior to saving
- `run-tests-only` boolean — set this field to true if you want to run tests without saving

## Request body

- PolicyAPIModifyPolicy
  - `body` string, required — The python body of the policy
  - `description` string — The description of the policy
  - `displayName` string — The display name of the policy
  - `enabled` boolean — Determines whether or not the policy is active
  - `id` string, required — The id of the policy
  - `managed` boolean — Determines if the policy is managed by panther
  - `outputIDs` string[] — Destination IDs that override default alert routing based on severity
  - `reference` string — A URL or note for additional reference material
  - `reports` object — Reports
  - `resourceTypes` string[] — Resource types
  - `severity` 'INFO' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL', required
  - `suppressions` string[] — Resources to ignore via a pattern that matches the resource id
  - `tags` string[] — The tags for the policy
  - `tests` PolicyAPIUnitTest[] — Unit tests for the Policy. Best practice is to include a positive and negative case
    - `expectedResult` boolean, required — The expected result
    - `log` unknown
    - `mocks` PolicyAPIUnitTestMock[] — mocks
    - `name` string, required — name
    - `resource` string — A test event object that your detection will receive as input, JSON-encoded. Prefer `log`.

## Response `200`

OK response.

- PolicyAPIPolicy
  - `body` string — The python body of the policy
  - `createdAt` string
  - `createdBy` object — The actor who created the rule
    - `id` 'user' | 'api-token' | 'system'
    - `type` string
  - `createdByExternal` string — The text of the user-provided CreatedBy field when uploaded via CI/CD
  - `description` string — The description of the policy
  - `displayName` string — The display name of the policy
  - `enabled` boolean — Determines whether or not the policy is active
  - `id` string — The id of the policy
  - `lastModified` string
  - `managed` boolean — Determines if the policy is managed by panther
  - `outputIDs` string[] — Destination IDs that override default alert routing based on severity
  - `reference` string — A URL or note for additional reference material
  - `reports` object — Reports
  - `resourceTypes` string[] — Resource types
  - `severity` 'INFO' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL'
  - `suppressions` string[] — Resources to ignore via a pattern that matches the resource id
  - `tags` string[] — The tags for the policy
  - `tests` PolicyAPIUnitTest[] — Unit tests for the Policy. Best practice is to include a positive and negative case
    - `expectedResult` boolean, required — The expected result
    - `log` unknown
    - `mocks` PolicyAPIUnitTestMock[] — mocks
    - `name` string, required — name
    - `resource` string — A test event object that your detection will receive as input, JSON-encoded. Prefer `log`.

## Other responses

- `204` — No Content response.
- `400` — bad_request: Bad Request response.
- `409` — exists: Conflict response.

---

[API](https://skmtc.dev/panther/apis/panther-rest-api.md) · [All operations](https://skmtc.dev/panther/apis/panther-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/panther/panther-rest-api/revisions/eb177cb9d6a1/schema)