Ana içeriğe geç

Create Policy Group

Endpoint​

POST /apiops/projects/{projectName}/policyGroups/

Authentication​

Requires a Personal API Access Token.

Authorization: Bearer YOUR_TOKEN

Request​

Headers​

HeaderValueRequired
AuthorizationBearer {token}Yes
Content-Typeapplication/jsonYes

Path Parameters​

ParameterTypeRequiredDescription
projectNamestringYesProject name

Query Parameters​

None

Request Body​

The body is a PolicyGroup snapshot. The top-level "_class" field is required and must be "policy-group". The desired name is carried in the body's "name" field, not a URL path segment.

Full JSON Body Example​

{
  "_class": "policy-group",
  "name": "standard-security-bundle",
  "description": "IP allow-list applied before authentication",
  "active": true,
  "targetPipeline": "REQUEST",
  "order": 1,
  "makeDefault": false,
  "canBeDeleted": true,
  "policyList": [
    {
      "_class": "ip-white",
      "name": "office-network-allow-list",
      "active": true,
      "useApinizerDefault": false,
      "ipList": ["203.0.113.0/24", "198.51.100.10"]
    }
  ]
}

Request Body Fields​

FieldTypeRequiredDefaultDescription
_classstringYes-Must be "policy-group"
namestringYes-Policy group name — the value stored, not necessarily a URL segment
descriptionstringNo-Policy group description
activebooleanNofalseWhether the group is active
targetPipelinestringNo-Pipeline the group is bound to: REQUEST, RESPONSE or ERROR
orderintegerNo-Execution order among other policies/groups on the same pipeline
makeDefaultbooleanNo-Whether this group is applied by default
canBeDeletedbooleanNo-Deletion-eligibility flag used by the classic UI
policyListarrayNo[]Ordered list of embedded policies, each a polymorphic Policy snapshot (own _class)

id, projectId and global are always server-assigned and ignored if present in the body — global is unconditionally forced to false for every policy group, regardless of what is sent.

Secret Contract (POST vs PUT)​

This endpoint is shared with cross-instance API Promotion, which exports a policy group from a source instance and replays it here as-is. Because of that:

  • POST (this endpoint): any @SecretData field on an embedded policy in policyList (e.g. password on an embedded WS-Security Username Token policy) is expected to already be encrypted (as exported from the source instance) and is persisted unchanged.
  • PUT (Update Policy Group) is the opposite: embedded policy secrets must be plaintext and are encrypted before persist.

Sending a plaintext secret to POST, or an already-encrypted value to PUT, corrupts the secret.

Cross-Instance Global Policy Rebinding​

If an entry in policyList is itself a reference to a global policy (rather than an ad-hoc inline one), POST rebinds it to a same-type, same-name global policy that already exists on this instance, or creates it if this instance does not have one yet — the same logic cross-instance API Promotion uses when replaying a proxy's embedded policy group on a different instance. PUT does not perform this rebinding; it persists policyList as given.

Response​

Success Response (200 OK)​

{
  "status": "SUCCESS",
  "resultList": [
    {
      "id": "665f2a1c9b3e4a0012ab35aa",
      "name": "standard-security-bundle",
      "targetPipeline": "REQUEST"
    }
  ],
  "resultCount": 1
}

Response Fields​

FieldTypeDescription
statusstringResponse status: SUCCESS or FAILURE
resultListarraySingle-element list containing the created policy group's descriptor
resultCountintegerAlways 1 on success

The response does not echo the saved policy group body (including policyList) — use Get Policy Group to confirm it exists (it too only returns the lightweight descriptor, never the embedded policy list).

Error Response (400 Bad Request)​

{
  "status": "FAILURE",
  "resultMessage": "name value can not be empty!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "The supplied snapshot is not a policy group."
}

Error Response (401 Unauthorized)​

{
  "status": "FAILURE",
  "resultMessage": "Token is not valid!"
}

cURL Example​

curl -X POST \
  "https://demo.apinizer.com/apiops/projects/MyProject/policyGroups/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "_class": "policy-group",
    "name": "standard-security-bundle",
    "description": "IP allow-list applied before authentication",
    "active": true,
    "targetPipeline": "REQUEST",
    "order": 1,
    "policyList": [
      {
        "_class": "ip-white",
        "name": "office-network-allow-list",
        "active": true,
        "useApinizerDefault": false,
        "ipList": ["203.0.113.0/24", "198.51.100.10"]
      }
    ]
  }'

Notes and Warnings​

  • Always Creates: This is create-only — it does not upsert. Creating with a name that already exists in the project produces a second, separate record (name uniqueness is not enforced by this endpoint).
  • global Is Always False: Regardless of the body, a policy group is always persisted with global=false.
  • Cross-Instance Snapshot Semantics: Designed for cross-instance API Promotion; embedded policy @SecretData fields are persisted exactly as received (assumed already encrypted), and embedded global policy references are rebound to this instance's own definitions. See Secret Contract and Cross-Instance Global Policy Rebinding above.
  • Not Deployed on Create: This endpoint persists the group; it does not deploy it to gateway workers. A policy group only reaches a running environment once embedded in a proxy/proxy-group and that proxy is deployed, or when updated via Update Policy Group, which does redeploy.
  • Permission: Requires API_MANAGEMENT + MANAGE in the project.
En son tarihinde güncellendi