Policies

Create a policy.

Create a policy in your Tyk Instance.

post/tyk/policies

Request body

_idstring

access_rightsobject nullable

activeboolean

enable_http_signature_validationboolean

graphql_access_rightsobject nullable

hmac_enabledboolean

idstring

is_inactiveboolean

key_expires_ininteger

last_updatedstring

max_query_depthinteger

meta_dataobject nullable

namestring

org_idstring

pernumber double

post_expiry_action'retain' | 'delete'

Defines the action to take on a Session in Redis after it expires. Valid values are "retain" and "delete".

post_expiry_grace_periodinteger

Duration in seconds to retain a Session in Redis after it expires. Used with post_expiry_action "retain". Set to -1 to retain indefinitely.

quota_maxinteger

quota_renewal_rateinteger

ratenumber double

tagsstring[] nullable

throttle_intervalnumber double

throttle_retry_limitinteger

Example request

{
  "_id": "5ead7120575961000181867e",
  "active": true,
  "id": "5ead7120575961000181867e",
  "last_updated": "1655965189",
  "max_query_depth": -1,
  "name": "Swagger Petstore Policy",
  "org_id": "5e9d9544a1dcd60001d0ed20",
  "partitions": {
    "acl": true,
    "quota": true,
    "rate_limit": true
  },
  "per": 60,
  "post_expiry_action": "delete",
  "quota_max": -1,
  "quota_renewal_rate": 3600,
  "rate": 1000,
  "throttle_interval": -1,
  "throttle_retry_limit": -1
}

Response

Policy created.

actionstring

keystring

key_hashstring

statusstring

Example response

{
  "action": "modified",
  "key": "b13d928b9972bd18",
  "status": "ok"
}

Changes

Changed in 7 of the 52 revisions of this API.91050

Apr 8, 2026dd3336b650812See the full diff
- ○
  added the new optional request property post_expiry_action
  new-optional-request-property
- ○
  added the new optional request property post_expiry_grace_period
  new-optional-request-property
Feb 7, 20253d8e4f5b3dab3See the full diff
- ○
  the request property access_rights/additionalProperties/endpoints/items/methods/items/limit/smoothing became nullable
  request-property-became-nullable
- ○
  the request property access_rights/additionalProperties/limit/smoothing became nullable
  request-property-became-nullable
- ○
  the request property smoothing became nullable
  request-property-became-nullable
Sep 18, 2024111affa17abe4133See the full diff
- ▲
  the _id request property type/format changed from object/ to string/
  request-property-type-changed
- ▲
  the key_expires_in request property type/format changed from number/int64 to integer/int64
  request-property-type-changed
- ▲
  the max_query_depth request property type/format changed from number/ to integer/
  request-property-type-changed
- ▲
  the throttle_retry_limit request property type/format changed from number/ to integer/
  request-property-type-changed
- ●
  removed the request property access_rights/additionalProperties/limit/set_by_policy
  request-property-removed
- ○
  added the new optional request property access_rights/additionalProperties/allowance_scope
  new-optional-request-property
- ○
  added the new optional request property access_rights/additionalProperties/allowed_types
  new-optional-request-property
- ○
  added the new optional request property access_rights/additionalProperties/disable_introspection
  new-optional-request-property
- ○
  added the new optional request property access_rights/additionalProperties/field_access_rights
  new-optional-request-property
- ○
  added the new optional request property access_rights/additionalProperties/limit/max_query_depth
  new-optional-request-property
- ○
  added the new optional request property access_rights/additionalProperties/limit/smoothing
  new-optional-request-property
- ○
  added the new optional request property access_rights/additionalProperties/restricted_types
  new-optional-request-property
- ○
  the request property access_rights became nullable
  request-property-became-nullable
- ○
  the request property access_rights/additionalProperties/allowed_urls became nullable
  request-property-became-nullable
- ○
  the request property access_rights/additionalProperties/allowed_urls/items/methods became nullable
  request-property-became-nullable
- ○
  the request property access_rights/additionalProperties/versions became nullable
  request-property-became-nullable
- ○
  the request property graphql_access_rights became nullable
  request-property-became-nullable
- ○
  the request property meta_data became nullable
  request-property-became-nullable
- ○
  the request property tags became nullable
  request-property-became-nullable
- ○
  the access_rights/additionalProperties/endpoints/items/methods/items/limit/per request property type/format was generalized from number/double to number/
  request-property-type-generalized
- ○
  the access_rights/additionalProperties/endpoints/items/methods/items/limit/rate request property type/format was generalized from number/double to number/
  request-property-type-generalized
- ○
  the access_rights/additionalProperties/endpoints/items/methods/items/limit/smoothing/delay request property type/format was generalized from integer/int64 to integer/
  request-property-type-generalized
- ○
  the access_rights/additionalProperties/endpoints/items/methods/items/limit/smoothing/step request property type/format was generalized from integer/int64 to integer/
  request-property-type-generalized
- ○
  the access_rights/additionalProperties/endpoints/items/methods/items/limit/smoothing/threshold request property type/format was generalized from integer/int64 to integer/
  request-property-type-generalized
- ○
  the access_rights/additionalProperties/endpoints/items/methods/items/limit/smoothing/trigger request property type/format was generalized from number/double to number/
  request-property-type-generalized
- ○
  the access_rights/additionalProperties/limit/per request property type/format was generalized from number/double to number/
  request-property-type-generalized
- ○
  the access_rights/additionalProperties/limit/quota_max request property type/format was generalized from integer/int64 to integer/
  request-property-type-generalized
- ○
  the access_rights/additionalProperties/limit/quota_remaining request property type/format was generalized from integer/int64 to integer/
  request-property-type-generalized
- ○
  the access_rights/additionalProperties/limit/quota_renewal_rate request property type/format was generalized from integer/int64 to integer/
  request-property-type-generalized
- ○
  the access_rights/additionalProperties/limit/quota_renews request property type/format was generalized from integer/int64 to integer/
  request-property-type-generalized
- ○
  the access_rights/additionalProperties/limit/rate request property type/format was generalized from number/double to number/
  request-property-type-generalized
- ○
  the access_rights/additionalProperties/limit/throttle_interval request property type/format was generalized from number/double to number/
  request-property-type-generalized
- ○
  the access_rights/additionalProperties/limit/throttle_retry_limit request property type/format was generalized from integer/int64 to integer/
  request-property-type-generalized
- ○
  the smoothing/delay request property type/format was generalized from integer/int64 to integer/
  request-property-type-generalized
- ○
  the smoothing/step request property type/format was generalized from integer/int64 to integer/
  request-property-type-generalized
- ○
  the smoothing/threshold request property type/format was generalized from integer/int64 to integer/
  request-property-type-generalized
- ○
  the smoothing/trigger request property type/format was generalized from number/double to number/
  request-property-type-generalized
- ○
  added the non-success response with the status 403
  response-non-success-status-added
This revision also has 28 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog
Aug 21, 202431989871353c11See the full diff
- ●
  removed the request property access_rights/additionalProperties/limit/smoothing
  request-property-removed
- ○
  added the new optional request property access_rights/additionalProperties/endpoints
  new-optional-request-property
Jun 17, 20241938d97cb6b52See the full diff
- ○
  added the new optional request property access_rights/additionalProperties/limit/smoothing
  new-optional-request-property
- ○
  added the new optional request property smoothing
  new-optional-request-property
This revision also has 1 change that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog
Mar 7, 202302e5d48c583d5See the full diff
- ●
  removed the request property access_rights/allowed_urls
  request-property-removed
- ●
  removed the request property access_rights/api_id
  request-property-removed
- ●
  removed the request property access_rights/api_name
  request-property-removed
- ●
  removed the request property access_rights/limit
  request-property-removed
- ●
  removed the request property access_rights/versions
  request-property-removed
May 24, 2022111d8ca21864539See the full diff
- ▲
  the request property access_rights became not nullable
  request-property-became-not-nullable
- ▲
  the request property graphql_access_rights became not nullable
  request-property-became-not-nullable
- ▲
  the request property meta_data became not nullable
  request-property-became-not-nullable
- ▲
  the request property tags became not nullable
  request-property-became-not-nullable
- ▲
  the _id request property type/format changed from string/ to object/
  request-property-type-changed
- ●
  removed the request property post_expiry_action
  request-property-removed
- ●
  removed the request property post_expiry_grace_period
  request-property-removed
- ●
  removed the request property smoothing
  request-property-removed
- ○
  added the new optional request property access_rights/allowed_urls
  new-optional-request-property
- ○
  added the new optional request property access_rights/api_id
  new-optional-request-property
- ○
  added the new optional request property access_rights/api_name
  new-optional-request-property
- ○
  added the new optional request property access_rights/limit
  new-optional-request-property
- ○
  added the new optional request property access_rights/versions
  new-optional-request-property
- ○
  the key_expires_in request property type/format was generalized from integer/int64 to number/int64
  request-property-type-generalized
- ○
  the max_query_depth request property type/format was generalized from integer/ to number/
  request-property-type-generalized
- ○
  the throttle_retry_limit request property type/format was generalized from integer/ to number/
  request-property-type-generalized
- ○
  removed the non-success response with the status 403
  response-non-success-status-removed
This revision also has 155 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

Full history