Skip to main content
POST
Create Access Policy

Authentication and permissions

Token requirements: User-based token (OAuth) or Organization-scoped API key or Team-scoped API key. Send a bearer access token for one of these identities. The permissions and resource restrictions below also apply.
Permissions joined by + are all required; or separates alternatives. Full-access keys still cannot call endpoints marked unsupported. Team keys must allow every team checked by the request. OAuth access depends on the user’s roles and resource access.
  • Attach an approval procedure: With a non-empty approval_procedure_id, the procedure must be a named approval procedure in the requested team.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
teamId
string
required

The ID of the team.

name
string
required

The name of the access policy.

description
string

A description of the access policy.

maxAccessMinutes
integer<int32> | null

The maximum number of minutes that access can be granted for (optional).

requireBusinessJustification
boolean | null

Whether a business justification is required when requesting access (optional).

The recommended duration in minutes for access requests (optional).

requireOnBehalfOfConfirmation
boolean | null

Whether requests made on behalf of others require the target user's confirmation (optional).

scopedId
string | null

Stable, team-scoped identity for the policy (apo_ + 22 base62 chars). Omit to have one minted. Must be unique within the team; reserved sentinel values (the team-default policy) are rejected.

approvalProcedureId
string | null

The ID of a named approval procedure that must approve requests for roles governed by the policy. Omit it, or send an empty string, to create the policy without approval. Attaching requires permission to view approval procedures.

Response

200 - application/json

Success

data
data · object

The created access policy.