Create a policy rule

Adds an ordered rule over *, <connector>/*, <connectionId>/*, or <connectionId>/<tool>. Its position comes from the pattern’s specificity, so the more specific rule always wins.

POST /v1/connectors/policies

Authorization

• Authorization Bearer token · header required

  Authorization: Bearer <token>

with an API key (sfa_ prefix), an OAuth access token, a session token, or a Space machine credential (sfm_ prefix).

• Authorization OAuth2 access token · header required

OAuth 2.0 with Spacefast scopes. People use the authorization code flow; machines use client credentials.

Scopes:

• connectors:write

Query parameters

• team string
  • min length 1 · max length 255

Request body

• required application/json

• pattern string required

  • *, <connector>/*, <connectionId>/*, or <connectionId>/<tool>.
  • min length 1 · max length 512

• action string required

  • What policy does with a call: run it, park it for a person, or refuse it.
  • Allowed: approve, require_approval, block

• owner string required

  • Team rules apply to everyone and are a floor personal rules cannot loosen.
  • Allowed: team, personal

Responses

• 201 Response for status 201

  $schema string <uri>

Canonical JSON Schema URL for this response body. The server also sends it in the Link: rel="describedby" response header.

• data object required
  • One ordered address-pattern rule. Most restrictive across owners wins.

Show properties

• id string required - Policy rule id. Opaque — minted by the policy engine, not a Spacefast resource prefix.

  • pattern string required

    • *, <connector>/*, <connectionId>/*, or <connectionId>/<tool>. First match in order wins.

  • action string required

    • What policy does with a call: run it, park it for a person, or refuse it.
    • Allowed: approve, require_approval, block

  • owner string required

    • Team rules are a floor: a personal rule may tighten one, never loosen it.
    • Allowed: team, personal

  • position string required

    • Fractional index the engine assigned from the pattern's specificity. Rules evaluate in this order.

  • createdAt string required

Matches the date-time format.

Request example

curl -X POST "https://api.spacefast.com/v1/connectors/policies" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "pattern": "string",
  "action": "approve",
  "owner": "team"
}'

const response = await fetch("https://api.spacefast.com/v1/connectors/policies", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
  },
  body: "{\n  \"pattern\": \"string\",\n  \"action\": \"approve\",\n  \"owner\": \"team\"\n}"
});

import requests

response = requests.post(
    "https://api.spacefast.com/v1/connectors/policies",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type": "application/json"
    },
    data="{\n  \"pattern\": \"string\",\n  \"action\": \"approve\",\n  \"owner\": \"team\"\n}",
)

201 default response

{
  "$schema": "http://example.com",
  "data": {
    "id": "string",
    "pattern": "string",
    "action": "approve",
    "owner": "team",
    "position": "string",
    "createdAt": "2019-08-24T14:15:22Z"
  }
}

Error response

{
  "$schema": "http://example.com",
  "type": "string",
  "title": "string",
  "status": -9007199254740991,
  "detail": "string",
  "code": "string",
  "pointer": "string",
  "details": {
    "property1": null,
    "property2": null
  },
  "suggestions": [
    "string"
  ],
  "next": [
    "string"
  ],
  "requestId": "string"
}