---
title: "Create a policy (owner or admin only)"
method: POST
path: "/api/policies"
tags: ["policies"]
---

# Create a policy (owner or admin only)

`POST /api/policies`

## Request

- Base URL: `https://www.spendline.ai`
- URL: `https://www.spendline.ai/api/policies`
- Auth: API key in header `x-spendline-key`

## Request body

- Policy
  - `id` string, uuid
  - `name` string, required
  - `type` 'model_block' | 'model_allow' | 'max_input_tokens' | 'max_output_tokens', required: model_block refuses the named model. model_allow is one ENTRY in an allow-list: every enabled model_allow row sharing one exact scope is one list, and a call must match some entry of every list that applies to it. Both judge the requested and the served model.
  - `model` string, required: Model name to match. Stored lowercased.
  - `match_mode` 'exact' | 'prefix' | 'contains'
  - `value` number, nullable: Required positive number for token-limit types. Null for model_block and model_allow.
  - `enforcement` 'block' | 'warn': Ignored for model_block and model_allow, which always block.
  - `enabled` boolean
  - `scope` object, nullable: Optional; the same object a reroute rule carries. Omit for an account-wide policy. A scoped policy applies to calls attributed to that agent / customer AND to calls carrying no attribution, so leaving x-agent-id off is never a way around it. A call attributed to a different agent or customer is not affected. Unknown keys are a 400.
    - `agent_id` string
    - `customer_id` string
    - `agent_name` string

## Response `201`

Created.

## Other responses

- `400`: Invalid type, match_mode, enforcement, scope, or a missing token value.
- `403`: Insufficient authority.

---

[API](https://skmtc.dev/spendline/apis/spendline-api.md) · [All operations](https://skmtc.dev/spendline/apis/spendline-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spendline/apis/spendline-api/revisions/eb22b9415a28?raw)