---
title: "Create Policy"
method: POST
path: "/policies"
tags: ["Policies"]
---

# Create Policy

`POST /policies`

## Request

- Base URL: `https://api.vibebrowser.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.vibebrowser.app/policies`
- Auth: one of:
  - API key in header `x-litellm-api-key`
  - API key in header `x-litellm-api-key`
  - API key in header `x-litellm-api-key`
  - API key in header `x-litellm-api-key`
  - API key in header `x-litellm-api-key`
  - API key in header `x-litellm-api-key`

Create a new policy.

Example Request:
```bash
curl -X POST "http://localhost:4000/policies" \
    -H "Authorization: Bearer <your_api_key>" \
    -H "Content-Type: application/json" \
    -d '{
        "policy_name": "global-baseline",
        "description": "Base guardrails for all requests",
        "guardrails_add": ["pii_masking", "prompt_injection"],
        "guardrails_remove": []
    }'
```

Example Response:
```json
{
    "policy_id": "123e4567-e89b-12d3-a456-426614174000",
    "policy_name": "global-baseline",
    "inherit": null,
    "description": "Base guardrails for all requests",
    "guardrails_add": ["pii_masking", "prompt_injection"],
    "guardrails_remove": [],
    "condition": null,
    "created_at": "2024-01-01T00:00:00Z",
    "updated_at": "2024-01-01T00:00:00Z"
}
```

## Request body

- PolicyCreateRequest: Request body for creating a new policy.
  - `policy_name` string, required: Unique name for the policy.
  - `inherit` string, nullable: Name of parent policy to inherit from.
  - `description` string, nullable: Human-readable description of the policy.
  - `guardrails_add` string[], nullable: List of guardrail names to add.
  - `guardrails_remove` string[], nullable: List of guardrail names to remove (from inherited).
  - `condition` PolicyConditionRequest: Condition for when a policy applies.
    - `model` string, nullable: Model name pattern (exact match or regex) for when policy applies.
  - `pipeline` object, nullable: Optional guardrail pipeline for ordered execution. Contains 'mode' and 'steps'.

## Response `200`

Successful Response

- PolicyDBResponse: Response for a policy from the database.
  - `policy_id` string, required: Unique ID of the policy.
  - `policy_name` string, required: Name of the policy.
  - `version_number` integer: Version number of this policy.
  - `version_status` string: One of: draft, published, production.
  - `parent_version_id` string, nullable: Policy ID this version was cloned from.
  - `is_latest` boolean: True if this is the latest version by version_number.
  - `published_at` string, date-time, nullable: When this version was published.
  - `production_at` string, date-time, nullable: When this version was promoted to production.
  - `inherit` string, nullable: Parent policy name.
  - `description` string, nullable: Policy description.
  - `guardrails_add` string[]: Guardrails to add.
  - `guardrails_remove` string[]: Guardrails to remove.
  - `condition` object, nullable: Policy condition.
  - `pipeline` object, nullable: Optional guardrail pipeline.
  - `created_at` string, date-time, nullable: When the policy was created.
  - `updated_at` string, date-time, nullable: When the policy was last updated.
  - `created_by` string, nullable: Who created the policy.
  - `updated_by` string, nullable: Who last updated the policy.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/vibebrowser/apis/litellm-api.md) · [All operations](https://skmtc.dev/vibebrowser/apis/litellm-api/llms.txt) · [OpenAPI document](https://skmtc.dev/vibebrowser/apis/litellm-api/revisions/eea0b7e7b167?raw)