REST API Reference

Access Control Policies API

Create, list, inspect, and delete fine-grained access policies evaluated using the Deny-Overrides-Allow authorization model.

Create Policy

Defines a declarative allow/deny rule targeting specific actions (read, write, delete, export) across resources.

Create PolicyAuth

Create a fine-grained access policy.

Payload Example

{
  "name": "Block Production Writes from CI",
  "effect": "DENY",
  "actions": ["write", "delete"],
  "resources": ["envs/prod/*"],
  "principals": ["sa:github-actions-*"]
}

Status Codes

Name
201
Type
HTTP
Description
Access policy created and actively enforced.
Name
400
Type
HTTP
Description
Invalid policy effect (must be ALLOW or DENY).

Request Parameters

Name
name
Type
string
Required
Description
Policy name for audit trail identification.
Name
effect
Type
enum
Required
Description
Either ALLOW or DENY.
Name
actions
Type
string[]
Required
Description
List of actions: read, write, delete, export.
Name
resources
Type
string[]
Required
Description
Wildcard path expressions (e.g. envs/prod/*).

Request

POST/v1/secrets/projects/{id}/policies

Response 201