---
title: "Create policy"
method: POST
path: "/api/policy-engine/policies/{id}"
tags: ["Policy"]
---

# Create policy

`POST /api/policy-engine/policies/{id}`

Creates a new policy from scratch.

## Permissions

Any user or [API key](https://developers.vtex.com/docs/guides/api-authentication-using-api-keys) must have at least one of the appropriate [License Manager resources](https://help.vtex.com/en/tutorial/license-manager-resources--3q6ztrC8YynQf6rdc6euk3) to be able to successfully run this request. Otherwise they will receive a status code `403` error. These are the applicable resources for this endpoint:

| **Product** | **Category** | **Resource** |
| --------------- | ----------------- | ----------------- |
| Promotions Policy Engine | Policies | **Create or Update Policy** |

There are no applicable [predefined roles](https://help.vtex.com/en/tutorial/predefined-roles--jGDurZKJHvHJS13LnO7Dy) for this resource list. You must [create a custom role](https://help.vtex.com/en/tutorial/roles--7HKK5Uau2H6wxE1rH5oRbc#creating-a-role) and add at least one of the resources above in order to use this endpoint.To learn more about machine authentication at VTEX, see [Authentication overview](https://developers.vtex.com/docs/guides/authentication).

>❗ To prevent integrations from having excessive permissions, consider the [best practices for managing API keys](https://help.vtex.com/en/tutorial/best-practices-api-keys--7b6nD1VMHa49aI5brlOvJm) when assigning License Manager roles to integrations.

## Path parameters

- `id` string, required

## Headers

- `Content-Type` string, required
- `Accept` string, required

## Request body

- PolicySaveRequest — Object with policy save information.
  - `name` string, required — Policy name.
  - `description` string, required — Policy description, only for internal use.
  - `status` string — The status field defines if the policy is `active` or `inactive`. An `active` policy is enforced, while an `inactive` policy is stored but not applied.
  - `statements` StatementGet[], required — Requirements for the the policy to be applied.
    - `effect` string, required — This field is not functional at the moment. To create a correct request, fill the field with `Allow`.
    - `actions` object[] — Actions that the policy will execute.
      - `id` 'SendSlackMessage' | 'SendEmail' | 'DeactivatePromotions' — Action ID.
      - `metadata` object — Data inside of the actions.
    - `resource` string — Scope on which this policy must be evaluated.
    - `condition` object — Condition to activate this policy. This object can have a maximum of ten recursive conditions.
      - `operation` 'None' | 'stringEquals' | 'stringEqualsIgnoreCase' | 'numericEquals' | 'numericLessThan' | 'numericLessThanEquals' | 'numericGreaterThan' | 'numericGreaterThanEquals' | 'bool' | 'not' | 'or' | 'and' | 'dateTimeUtcGreaterThan' | 'dateTimeUtcLessThan' | 'between' — This operation will determine if all the conditions need to be valid or at least one of them, if the conditions array is not empty.
      - `conditions` object[] — List of conditions that will activate the policy.
        - `conditions`  | stringEquals | numericGreaterThan — List of conditions the actions can have. It can be an empty array `[]`.
        - `operation` 'None' | 'stringEquals' | 'stringEqualsIgnoreCase' | 'numericEquals' | 'numericLessThan' | 'numericLessThanEquals' | 'numericGreaterThan' | 'numericGreaterThanEquals' | 'bool' | 'not' | 'or' | 'and' | 'dateTimeUtcGreaterThan' | 'dateTimeUtcLessThan' | 'between' — The action of the condition.
        - `key` 'skuId' | 'brandId' | 'discountPercentage' — The element that will define what the policy will influence.
        - `values` string[] — Array with values of the key.

## Response `200`

OK

## Changes

- **2024-09-24** `f819dda515f1` — 2 warning, 3 info
  - removed the request property `statements/items/operation`
  - removed the optional property `items/statements/items/operation` from the response with the `200` status
  - added the new optional request property `statements/items/condition/operation`
  - added the new optional request property `status`
  - …1 more
- **2024-06-20** `1a9c401a96f5` — 1 breaking
  - the `statements/items/condition/conditions/items/` request property type/format changed from ``/`` to `object`/``
- **2023-11-29** `831c5a70e514` — 2 info
  - the `effect` request property default value `Allow` was removed
  - the `effect` response's property default value `Allow` was removed for the status `200`
- **2023-11-14** `c459ea5a8918` — 2 breaking, 2 warning, 4 info
  - removed the enum value `numericGreaterThan` of the request property `statements/items/condition/conditions/items/conditions`
  - removed the enum value `stringEquals` of the request property `statements/items/condition/conditions/items/conditions`
  - added the new `numericGreaterThan` enum value to the `items/statements/items/condition/conditions/items/conditions` response property for the response status `200`
  - added the new `stringEquals` enum value to the `items/statements/items/condition/conditions/items/conditions` response property for the response status `200`
  - …4 more
- …earlier changes not shown

[Full history](https://skmtc.dev/vtex/apis/policies-system-api/changes/api/policy-engine/policies/:id/post.md)

---

[API](https://skmtc.dev/vtex/apis/policies-system-api.md) · [All operations](https://skmtc.dev/vtex/apis/policies-system-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/vtex/policies-system-api/revisions/72627866ebf7/schema)