---
title: "Create an issuer policy"
method: POST
path: "/v1/kms/issuers/{issuerId}/policies"
tags: ["kms"]
---

# Create an issuer policy

`POST /v1/kms/issuers/{issuerId}/policies`

## Request

- Base URL: `https://api.vercel.com`
- URL: `https://api.vercel.com/v1/kms/issuers/{issuerId}/policies`
- Auth: HTTP bearer

Attach a policy to a KMS issuer that grants a project's deployments permission to sign with it.

## Path parameters

- `issuerId` string, required: The ID of the issuer.

## Query parameters

- `teamId` string
- `slug` string

## Request body

- object
  - `kind` 'project-grant', required
  - `projectId` string, required: The project ID for the project grant policy.
  - `environments` string[], required: The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...).
  - `tokenClaims` object: The claims that KMS should include in signed JWTs for this policy.

## Response `201`

- union
  - object
    - `createdAt` string, required
    - `environments` string[], required: Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim.
    - `kind` 'project-grant', required
    - `projectId` string, required
    - `teamId` string, required
    - `tokenClaims` object
    - `updatedAt` string, required
  - object
    - `clientId` string, required
    - `createdAt` string, required
    - `kind` 'connex-grant', required
    - `tokenClaims` object
    - `updatedAt` string, required

## Other responses

- `400`: One of the provided values in the request body is invalid. One of the provided values in the request query is invalid.
- `401`: The request is not authorized.
- `403`: You do not have permission to access this resource.
- `404`
- `410`

## Changes

- **2026-08-19** `6b6e0450635c`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/vercel/apis/api/changes/v1/kms/issuers/:issuerId/policies/post.md)

---

[API](https://skmtc.dev/vercel/apis/api.md) - [All operations](https://skmtc.dev/vercel/apis/api/llms.txt) - [OpenAPI document](https://skmtc.dev/vercel/apis/api/revisions/4a06e85c2848?raw)