---
title: "SetPolicy enables authorization policy checks for the given resource and applies any provided request or approval settings. If the resource has existing policies settings, they will be replaced. Once the policy is set, authorization checks will be performed for the given resource."
method: POST
path: "/v2/organizations/{organization}/settings/{setting}/approvals"
tags: ["Approvals"]
---

# SetPolicy enables authorization policy checks for the given resource and applies any provided request or approval settings. If the resource has existing policies settings, they will be replaced. Once the policy is set, authorization checks will be performed for the given resource.

`POST /v2/organizations/{organization}/settings/{setting}/approvals`

## Request

- Base URL: `https://docs.tetrate.io` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.tetrate.io/v2/organizations/{organization}/settings/{setting}/approvals`
- Auth: none declared
- TypeScript: <https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api/docs/v2/organizations/:organization/settings/:setting/approvals/post.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `organization` string, required
- `setting` string, required

## Request body

- object: ApprovalPolicy is a set of authorization rules that define access to a resource. When applied to a resource, the rules enforce access to the resource based on the permission set. Example: ApprovalPolicy { Mode: ApprovalPolicy_REQUIRE_APPROVAL, Resource: "organizations/demo/tenants/demo/applications/target-app", Approved: []Access {{ Subject: "organizations/demo/tenants/demo/applications/calling-app", Permissions: []string{"GET", "POST"} }} }
  - `approved` V2Access[]: Approved is a list of subjects that are approved to access the resource.
    - `subject` string, required: Subject is the subject that is requested to access the resource.
    - `permissions` string[], required: Permissions is a list of permissions that the subject is allowed to use.
    - `metadata` V2Metadata: Metadata includes additional information about an ApprovalPolicy or Access entity and their respective resources that they apply to.
      - `details` MetadataDetails: Details is additional information about a resource.
        - `name` string: Name is the resources name.
        - `description` string: Description is the resources description.
      - `rules` RoleRule[]: Permissions includes permissions for which an authenticated user is allowed to perform. This applies to ApprovalPolicy or Access entities respectively.
        - `types` RoleResourceType[]: The set of API groups and the api Kinds within the group on which this rule is applicable. If omitted, the permissions will globally apply to all resource types.
          - `apiGroup` string, required: A specific API group such as traffic.tsb.tetrate.io/v2.
          - `kinds` string[]: Specific kinds of APIs under the API group. If omitted, the role will apply to all kinds under the group.
        - `permissions` V2Permission[], required: The set of actions allowed for these APIs. The current version supports requires the kind, but this constraint will be relaxed in upcoming releases so that rules can apply globally to an entire API group.
  - `etag` string
  - `metadata` V2Metadata: Metadata includes additional information about an ApprovalPolicy or Access entity and their respective resources that they apply to.
    - `details` MetadataDetails: Details is additional information about a resource.
      - `name` string: Name is the resources name.
      - `description` string: Description is the resources description.
    - `rules` RoleRule[]: Permissions includes permissions for which an authenticated user is allowed to perform. This applies to ApprovalPolicy or Access entities respectively.
      - `types` RoleResourceType[]: The set of API groups and the api Kinds within the group on which this rule is applicable. If omitted, the permissions will globally apply to all resource types.
        - `apiGroup` string, required: A specific API group such as traffic.tsb.tetrate.io/v2.
        - `kinds` string[]: Specific kinds of APIs under the API group. If omitted, the role will apply to all kinds under the group.
      - `permissions` V2Permission[], required: The set of actions allowed for these APIs. The current version supports requires the kind, but this constraint will be relaxed in upcoming releases so that rules can apply globally to an entire API group.
  - `mode` 'UNRESTRICTED' | 'ALLOW_REQUESTED' | 'REQUIRE_APPROVAL', required: - UNRESTRICTED: Allows all subjects in the same policy class to access the resource. - ALLOW_REQUESTED: Allows only the subjects in the request and approved list to access the resource. - REQUIRE_APPROVAL: Allows only the subjects in the approved list to access the resource.
  - `requested` V2Access[]: Requested is a list of subjects that are requested to access the resource but that have not yet been explicitly approved. The access mode of the policy will determine if the subjects in this list are given immediate access to the resource.
    - `subject` string, required: Subject is the subject that is requested to access the resource.
    - `permissions` string[], required: Permissions is a list of permissions that the subject is allowed to use.
    - `metadata` V2Metadata: Metadata includes additional information about an ApprovalPolicy or Access entity and their respective resources that they apply to.
      - `details` MetadataDetails: Details is additional information about a resource.
        - `name` string: Name is the resources name.
        - `description` string: Description is the resources description.
      - `rules` RoleRule[]: Permissions includes permissions for which an authenticated user is allowed to perform. This applies to ApprovalPolicy or Access entities respectively.
        - `types` RoleResourceType[]: The set of API groups and the api Kinds within the group on which this rule is applicable. If omitted, the permissions will globally apply to all resource types.
          - `apiGroup` string, required: A specific API group such as traffic.tsb.tetrate.io/v2.
          - `kinds` string[]: Specific kinds of APIs under the API group. If omitted, the role will apply to all kinds under the group.
        - `permissions` V2Permission[], required: The set of actions allowed for these APIs. The current version supports requires the kind, but this constraint will be relaxed in upcoming releases so that rules can apply globally to an entire API group.

## Response `200`

A successful response.

- object

## Other responses

- `default`: An unexpected error response.

---

[API](https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api.md) - [All operations](https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api/revisions/2f19c3a1ae57?raw)