# Create a policy rule

Adds an ordered rule over `*`, `<connector>/*`, `<connectionId>/*`, or `<connectionId>/<tool>`. Its position comes from the pattern’s specificity, so the more specific rule always wins.

## POST `/v1/connectors/policies`

### Authorization

- `Authorization` Bearer token · header required

```
  Authorization: Bearer <token>
  ```

with an API key (`sfa_` prefix), an OAuth access token, a session token, or a Space machine credential (`sfm_` prefix).

- `Authorization` OAuth2 access token · header required

OAuth 2.0 with Spacefast scopes. People use the authorization code flow; machines use client credentials.

### Scopes:
- `connectors:write`

### Query parameters

- `team` string
  - min length 1 · max length 255

### Request body

- required `application/json`

- `pattern` string required
    - `*`, `<connector>/*`, `<connectionId>/*`, or `<connectionId>/<tool>`.
    - min length 1 · max length 512

- `action` string required
    - What policy does with a call: run it, park it for a person, or refuse it.
    - Allowed: `approve`, `require_approval`, `block`

- `owner` string required
    - Team rules apply to everyone and are a floor personal rules cannot loosen.
    - Allowed: `team`, `personal`

### Responses

- `201` Response for status 201

```
  $schema string <uri>
  ```

Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.

- `data` object required
    - One ordered address-pattern rule. Most restrictive across owners wins.

#### Show properties

- `id` string required
      - Policy rule id. Opaque — minted by the policy engine, not a Spacefast resource prefix.
    
    - `pattern` string required
      - `*`, `<connector>/*`, `<connectionId>/*`, or `<connectionId>/<tool>`. First match in order wins.
    
    - `action` string required
      - What policy does with a call: run it, park it for a person, or refuse it.
      - Allowed: `approve`, `require_approval`, `block`
    
    - `owner` string required
      - Team rules are a floor: a personal rule may tighten one, never loosen it.
      - Allowed: `team`, `personal`
    
    - `position` string required
      - Fractional index the engine assigned from the pattern's specificity. Rules evaluate in this order.
    
    - `createdAt` string <date-time> required

Matches the date-time format.

### Request example

```bash
curl -X POST "https://api.spacefast.com/v1/connectors/policies" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "pattern": "string",
  "action": "approve",
  "owner": "team"
}'
```

```javascript
const response = await fetch("https://api.spacefast.com/v1/connectors/policies", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
  },
  body: "{\n  \"pattern\": \"string\",\n  \"action\": \"approve\",\n  \"owner\": \"team\"\n}"
});
```

```python
import requests

response = requests.post(
    "https://api.spacefast.com/v1/connectors/policies",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type": "application/json"
    },
    data="{\n  \"pattern\": \"string\",\n  \"action\": \"approve\",\n  \"owner\": \"team\"\n}",
)
```

### 201 default response

```json
{
  "$schema": "http://example.com",
  "data": {
    "id": "string",
    "pattern": "string",
    "action": "approve",
    "owner": "team",
    "position": "string",
    "createdAt": "2019-08-24T14:15:22Z"
  }
}
```

### Error response

```json
{
  "$schema": "http://example.com",
  "type": "string",
  "title": "string",
  "status": -9007199254740991,
  "detail": "string",
  "code": "string",
  "pointer": "string",
  "details": {
    "property1": null,
    "property2": null
  },
  "suggestions": [
    "string"
  ],
  "next": [
    "string"
  ],
  "requestId": "string"
}
```