---
title: "Create an authorization policy"
method: POST
path: "/policies"
tags: ["Authorization"]
---

# Create an authorization policy

`POST /policies`

## Request

- Base URL: `https://api.smokeball.com`
- URL: `https://api.smokeball.com/policies`
- Auth: API key in header `x-api-key` and API key in header `Authorization`

Creates an authorization policy.

## Request body

- PolicyDto
  - `principalId` string, nullable: Principal id associated to this policy if it is a principal based policy. This can be either a user id or a group id. This is null if the policy is a resource based policy.
  - `resourceId` string, nullable: Resource id associated to this policy if it is a resource based policy. This is null if the policy is a principal based policy.
  - `rules` RuleDto[], nullable: The rules associated to this policy.
    - `principalId` string, nullable: Principal id associated to this rule if the rule is associated to a resource based policy. This can be either a user id or a group id. This is null if the policy is a principal based policy.
    - `resourceId` string, nullable: Resource id associated to this rule if it is a principal based policy. For matter based policies, use `matters/{matterId}` for a single matter or `matters` for all matters. This is null if the associated policy is a resource based policy.
    - `operation` string: The operation associated to this rule. Possible values: 'Access','Execute'.
    - `type` 0 | 1

## Response `202`

When request is accepted. Returns a hypermedia 'Link' object of the authorization policy to be created.

- Link
  - `id` string, nullable
  - `href` string, nullable
  - `relation` string, nullable
  - `method` string, nullable

## Other responses

- `400`: When request is invalid.
- `404`: Not Found

---

[API](https://skmtc.dev/smokeball/apis/smokeball-api.md) - [All operations](https://skmtc.dev/smokeball/apis/smokeball-api/llms.txt) - [OpenAPI document](https://skmtc.dev/smokeball/apis/smokeball-api/revisions/6e350cf667d4?raw)