---
title: "Create compliance policy"
method: POST
path: "/v1/policies"
tags: ["Policies"]
---

# Create compliance policy

`POST /v1/policies`

Create a policy record that can be reviewed, versioned, published, linked to controls, and used as source evidence for questionnaires.

## Headers

- `X-Organization-Id` string

## Request body

- CreatePolicyDto
  - `name` string, required — Name of the policy
  - `description` string — Description of the policy
  - `status` 'draft' | 'published' | 'needs_review' — Status of the policy
  - `content` object[], required — Content of the policy as TipTap JSON (array of nodes)
  - `frequency` 'monthly' | 'quarterly' | 'yearly' — Review frequency of the policy
  - `department` string — Department this policy applies to. Built-in values: none, admin, gov, hr, it, itsm, qms. Custom department names are also accepted.
  - `isRequiredToSign` boolean — Whether this policy requires a signature
  - `reviewDate` string — Review date for the policy
  - `assigneeId` string — ID of the user assigned to this policy
  - `approverId` string — ID of the user who approved this policy
  - `policyTemplateId` string — ID of the policy template this policy is based on
  - `signedBy` string[] — List of user IDs who have signed this policy

## Response `201`

Policy created successfully

- PolicyResponseDto
  - `id` string, required — The policy ID
  - `name` string, required — Name of the policy
  - `description` string, nullable, required — Description of the policy
  - `status` 'draft' | 'published' | 'needs_review', required — Status of the policy
  - `content` object[], required — Content of the policy as TipTap JSON (array of nodes)
  - `frequency` 'monthly' | 'quarterly' | 'yearly', nullable, required — Review frequency of the policy
  - `department` string, nullable, required — Department this policy applies to. May be one of the built-in values (none, admin, gov, hr, it, itsm, qms) or a custom department name.
  - `isRequiredToSign` boolean, required — Whether this policy requires a signature
  - `signedBy` string[], required — List of user IDs who have signed this policy
  - `reviewDate` string, date-time, nullable, required — Review date for the policy
  - `isArchived` boolean, required — Whether this policy is archived
  - `archivedAt` string, date-time, nullable, required — When the policy was archived by framework sync
  - `createdAt` string, date-time, required — When the policy was created
  - `updatedAt` string, date-time, required — When the policy was last updated
  - `lastArchivedAt` string, date-time, nullable, required — When the policy was last archived
  - `lastPublishedAt` string, date-time, nullable, required — When the policy was last published
  - `organizationId` string, required — Organization ID this policy belongs to
  - `assigneeId` string, nullable, required — ID of the user assigned to this policy
  - `approverId` string, nullable, required — ID of the user who approved this policy
  - `policyTemplateId` string, nullable, required — ID of the policy template this policy is based on

## Other responses

- `400` — Bad Request - Invalid policy data
- `401` — Unauthorized - Invalid authentication or insufficient permissions

## Changes

- **2026-06-05** `33c685841b7a` — 7 breaking, 1 warning, 7 info
  - removed the enum value `admin` of the request property `department`
  - removed the enum value `gov` of the request property `department`
  - removed the enum value `hr` of the request property `department`
  - removed the enum value `it` of the request property `department`
  - …11 more
- **2026-06-05** `7ca7c363a732` — 1 breaking, 7 warning, 7 info
  - request property `department` was restricted to a list of enum values
  - added the new `admin` enum value to the `department` response property for the response status `201`
  - added the new `gov` enum value to the `department` response property for the response status `201`
  - added the new `hr` enum value to the `department` response property for the response status `201`
  - …11 more
- **2026-06-05** `d0f58f24175b` — 7 breaking, 1 warning, 7 info
  - removed the enum value `admin` of the request property `department`
  - removed the enum value `gov` of the request property `department`
  - removed the enum value `hr` of the request property `department`
  - removed the enum value `it` of the request property `department`
  - …11 more
- **2026-06-04** `d7d0199d846f` — 1 info
  - the endpoint scheme security `oauth2` was removed from the API
- **2026-05-30** `55a8e5ee94f5` — 1 info
  - added the required property `archivedAt` to the response with the `201` status

[Full history](https://skmtc.dev/trycompai/apis/comp-ai-api/changes/v1/policies/post.md)

---

[API](https://skmtc.dev/trycompai/apis/comp-ai-api.md) · [All operations](https://skmtc.dev/trycompai/apis/comp-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/trycompai/comp-ai-api/revisions/726b9523fb22/schema)