Create policy

POST

/api/v1/organizations/{orgId}/policies

curl --request POST \
  --url https://localhost:10001/api/v1/organizations/example/policies \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "controls": [ { "citations": [ { "title": "example", "url": "example" } ], "controlCode": "example", "description": "example", "title": "example" } ], "description": "example", "iconUrl": "example", "name": "example", "type": "Risk Management", "version": "example" }'

Create a new policy within an organization and return the persisted record

Authorizations

• BearerAuth

Parameters

Path Parameters

orgId

required

string

Organization ID or UUID (urn:uuid optional)

Request Body

Policy object

Media type application/json

object

controls

required

At least one control is required

Array<object>

>= 1 items

object

citations

Array<object>

object

title

string

url

string

controlCode

required

Alphanumeric, . and -; upper-cased

string

description

required

string

title

required

string

description

required

string

iconUrl

string

name

required

string

type

required

string

Allowed values: Risk Management Internal Regulatory Custom

version

required

SemVer with no leading “v”, e.g. 1.2.3

string

Responses

201

Created policy

Media type application/json

A reusable template of controls in the organization’s library, applied to projects rather than used directly

object

cid

Assigned by the integrity service at creation

string

controls

Present on read, ignored on update

Array<object>

A single requirement within a policy template, identified by its control code

object

cid

Assigned by the integrity service at creation

string

citations

Array<object>

object

title

string

url

string

controlCode

Alphanumeric, . and -; upper-cased

string

createdAt

string format: date-time

description

string

id

integer

policyId

Assigned from the parent policy

integer

title

string

updatedAt

string format: date-time

createdAt

string format: date-time

description

string

iconUrl

string

id

integer

name

string

organizationId

Taken from the path on create

integer

slug

Derived from name

string

type

See PolicyType for values

string

Allowed values: Risk Management Internal Regulatory Custom

updatedAt

string format: date-time

version

string

Example

{
  "type": "Risk Management"
}

400

Bad request - Invalid organization ID or request body

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}

401

Unauthorized - Authentication required

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}

403

Forbidden - No organization access or insufficient permissions

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}

404

Organization not found

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}

409

Name, version, URL, or content already taken in this organization

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}

500

Internal server error

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}