---
title: "Create a policy rule"
method: POST
path: "/v1/connectors/policies"
tags: ["Connectors"]
---

# Create a policy rule

`POST /v1/connectors/policies`

## Request

- Base URL: `https://api.spacefast.com`
- URL: `https://api.spacefast.com/v1/connectors/policies`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://api.spacefast.com/v1/auth/oauth2/authorize`, token URL `https://api.spacefast.com/v1/auth/oauth2/token`; client credentials, token URL `https://api.spacefast.com/v1/auth/oauth2/token`, scopes: `connectors:write`)

Adds an ordered rule over `*`, `<connector>/*`, `<connectionId>/*`, or `<connectionId>/<tool>`. Its position comes from the pattern's specificity, so the more specific rule always wins.

## Query parameters

- `team` string: Team id or slug to act for. Required only when the credential could act for more than one team.

## Request body

- object
  - `pattern` string, required: `*`, `<connector>/*`, `<connectionId>/*`, or `<connectionId>/<tool>`.
  - `action` 'approve' | 'require_approval' | 'block', required: What policy does with a call: run it, park it for a person, or refuse it.
  - `owner` 'team' | 'personal', required: Team rules apply to everyone and are a floor personal rules cannot loosen.

## Response `201`

Response for status 201

- object
  - `$schema` string, uri: Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.
  - `data` object, required: One ordered address-pattern rule. Most restrictive across owners wins.
    - `id` string, required: Policy rule id. Opaque — minted by the policy engine, not a Spacefast resource prefix.
    - `pattern` string, required: `*`, `<connector>/*`, `<connectionId>/*`, or `<connectionId>/<tool>`. First match in order wins.
    - `action` 'approve' | 'require_approval' | 'block', required: What policy does with a call: run it, park it for a person, or refuse it.
    - `owner` 'team' | 'personal', required: Team rules are a floor: a personal rule may tighten one, never loosen it.
    - `position` string, required: Fractional index the engine assigned from the pattern's specificity. Rules evaluate in this order.
    - `createdAt` string, date-time, required

## Other responses

- `default`: Problem details (RFC 9457). Any 4xx/5xx response is one `application/problem+json` document.

---

[API](https://skmtc.dev/spacefast/apis/spacefast-api.md) · [All operations](https://skmtc.dev/spacefast/apis/spacefast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spacefast/apis/spacefast-api/revisions/bd165bc7c983?raw)