Skip to main content
POST
Create Access Policy

Authentication and permissions

Token requirements: User-based token (OAuth) or Organization-scoped API key or Team-scoped API key. Send a bearer access token for one of these identities. The permissions and resource restrictions below also apply.
Permissions joined by + are all required; or separates alternatives. Full-access keys still cannot call endpoints marked unsupported. Team keys must allow every team checked by the request. OAuth access depends on the user’s roles and resource access.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
teamId
string
required

The ID of the team.

name
string
required

The name of the access policy.

description
string

A description of the access policy.

maxAccessMinutes
integer<int32> | null

The maximum number of minutes that access can be granted for (optional).

requireBusinessJustification
boolean | null

Whether a business justification is required when requesting access (optional).

The recommended duration in minutes for access requests (optional).

requireOnBehalfOfConfirmation
boolean | null

Whether requests made on behalf of others require the target user's confirmation (optional).

scopedId
string | null

Stable, team-scoped identity for the policy (apo_ + 22 base62 chars). Omit to have one minted. Must be unique within the team; reserved sentinel values (the team-default policy) are rejected.

Response

200 - application/json

Success

data
data · object

The created access policy.