Create Access Policy

curl --request POST \
  --url https://api.lumos.com/v1/access-policies \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "apps": [
    {
      "id": "1a2b3c4d-5e6f-7890-abcd-ef1234567890",
      "is_preapproved": true
    }
  ],
  "business_justification": "Everyone at the company uses Slack.",
  "is_enabled": true,
  "is_everyone_condition": true,
  "name": "Company-wide Slack access",
  "status": "published"
}
'

import requests

url = "https://api.lumos.com/v1/access-policies"

payload = {
    "apps": [
        {
            "id": "1a2b3c4d-5e6f-7890-abcd-ef1234567890",
            "is_preapproved": True
        }
    ],
    "business_justification": "Everyone at the company uses Slack.",
    "is_enabled": True,
    "is_everyone_condition": True,
    "name": "Company-wide Slack access",
    "status": "published"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    apps: [{id: '1a2b3c4d-5e6f-7890-abcd-ef1234567890', is_preapproved: true}],
    business_justification: 'Everyone at the company uses Slack.',
    is_enabled: true,
    is_everyone_condition: true,
    name: 'Company-wide Slack access',
    status: 'published'
  })
};

fetch('https://api.lumos.com/v1/access-policies', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.lumos.com/v1/access-policies",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'apps' => [
        [
                'id' => '1a2b3c4d-5e6f-7890-abcd-ef1234567890',
                'is_preapproved' => true
        ]
    ],
    'business_justification' => 'Everyone at the company uses Slack.',
    'is_enabled' => true,
    'is_everyone_condition' => true,
    'name' => 'Company-wide Slack access',
    'status' => 'published'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.lumos.com/v1/access-policies"

	payload := strings.NewReader("{\n  \"apps\": [\n    {\n      \"id\": \"1a2b3c4d-5e6f-7890-abcd-ef1234567890\",\n      \"is_preapproved\": true\n    }\n  ],\n  \"business_justification\": \"Everyone at the company uses Slack.\",\n  \"is_enabled\": true,\n  \"is_everyone_condition\": true,\n  \"name\": \"Company-wide Slack access\",\n  \"status\": \"published\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.lumos.com/v1/access-policies")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"apps\": [\n    {\n      \"id\": \"1a2b3c4d-5e6f-7890-abcd-ef1234567890\",\n      \"is_preapproved\": true\n    }\n  ],\n  \"business_justification\": \"Everyone at the company uses Slack.\",\n  \"is_enabled\": true,\n  \"is_everyone_condition\": true,\n  \"name\": \"Company-wide Slack access\",\n  \"status\": \"published\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.lumos.com/v1/access-policies")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"apps\": [\n    {\n      \"id\": \"1a2b3c4d-5e6f-7890-abcd-ef1234567890\",\n      \"is_preapproved\": true\n    }\n  ],\n  \"business_justification\": \"Everyone at the company uses Slack.\",\n  \"is_enabled\": true,\n  \"is_everyone_condition\": true,\n  \"name\": \"Company-wide Slack access\",\n  \"status\": \"published\"\n}"

response = http.request(request)
puts response.read_body

{
  "name": "<string>",
  "business_justification": "<string>",
  "id": "<string>",
  "status": "draft",
  "is_enabled": true,
  "apps": [
    {
      "id": "<string>",
      "label": "<string>",
      "is_preapproved": true,
      "entitlements": [
        {
          "id": "<string>",
          "label": "<string>"
        }
      ]
    }
  ],
  "access_condition": {},
  "is_everyone_condition": true,
  "owners": {
    "users": [
      {
        "id": "<string>",
        "email": "<string>",
        "given_name": "<string>",
        "family_name": "<string>",
        "status": "staged"
      }
    ],
    "groups": [
      {
        "id": "<string>",
        "app_id": "<string>",
        "integration_specific_id": "<string>",
        "name": "<string>",
        "description": "<string>",
        "group_lifecycle": "synced",
        "source_app_id": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

Access Policies

Create Access Policy

Create an access policy. Returns 201 with the created policy. Grant entitlements by Entitlement UUID under apps[].entitlements, or leave them out to grant access to the app itself. Send is_everyone_condition: true for a policy that applies to everyone, or an access_condition for one that doesn’t; sending both returns 400. The everyone condition a read returns in access_condition counts as is_everyone_condition: true, so a body built from a read can be sent back as is.

An access_condition may use only the attributes and operators the Lumos condition builder offers, with one operator per attribute, and a date-time value needs a time zone offset (2026-01-01T00:00:00Z). Any other condition returns 400 naming each problem.

A policy is created as a draft unless status is published. A draft can’t be enabled, so sending is_enabled: true without status: published returns 400. Creating a published policy whose condition matches another published policy also returns 400. A draft with the same condition is allowed. When your organization requires approval before publishing, status: published returns 400.

Listing an app twice, or an entitlement twice under one app, returns 400. An app or entitlement that doesn’t resolve returns 404 without saying which.

POST

access-policies

Create Access Policy

curl --request POST \
  --url https://api.lumos.com/v1/access-policies \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "apps": [
    {
      "id": "1a2b3c4d-5e6f-7890-abcd-ef1234567890",
      "is_preapproved": true
    }
  ],
  "business_justification": "Everyone at the company uses Slack.",
  "is_enabled": true,
  "is_everyone_condition": true,
  "name": "Company-wide Slack access",
  "status": "published"
}
'

import requests

url = "https://api.lumos.com/v1/access-policies"

payload = {
    "apps": [
        {
            "id": "1a2b3c4d-5e6f-7890-abcd-ef1234567890",
            "is_preapproved": True
        }
    ],
    "business_justification": "Everyone at the company uses Slack.",
    "is_enabled": True,
    "is_everyone_condition": True,
    "name": "Company-wide Slack access",
    "status": "published"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    apps: [{id: '1a2b3c4d-5e6f-7890-abcd-ef1234567890', is_preapproved: true}],
    business_justification: 'Everyone at the company uses Slack.',
    is_enabled: true,
    is_everyone_condition: true,
    name: 'Company-wide Slack access',
    status: 'published'
  })
};

fetch('https://api.lumos.com/v1/access-policies', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.lumos.com/v1/access-policies",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'apps' => [
        [
                'id' => '1a2b3c4d-5e6f-7890-abcd-ef1234567890',
                'is_preapproved' => true
        ]
    ],
    'business_justification' => 'Everyone at the company uses Slack.',
    'is_enabled' => true,
    'is_everyone_condition' => true,
    'name' => 'Company-wide Slack access',
    'status' => 'published'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.lumos.com/v1/access-policies"

	payload := strings.NewReader("{\n  \"apps\": [\n    {\n      \"id\": \"1a2b3c4d-5e6f-7890-abcd-ef1234567890\",\n      \"is_preapproved\": true\n    }\n  ],\n  \"business_justification\": \"Everyone at the company uses Slack.\",\n  \"is_enabled\": true,\n  \"is_everyone_condition\": true,\n  \"name\": \"Company-wide Slack access\",\n  \"status\": \"published\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.lumos.com/v1/access-policies")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"apps\": [\n    {\n      \"id\": \"1a2b3c4d-5e6f-7890-abcd-ef1234567890\",\n      \"is_preapproved\": true\n    }\n  ],\n  \"business_justification\": \"Everyone at the company uses Slack.\",\n  \"is_enabled\": true,\n  \"is_everyone_condition\": true,\n  \"name\": \"Company-wide Slack access\",\n  \"status\": \"published\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.lumos.com/v1/access-policies")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"apps\": [\n    {\n      \"id\": \"1a2b3c4d-5e6f-7890-abcd-ef1234567890\",\n      \"is_preapproved\": true\n    }\n  ],\n  \"business_justification\": \"Everyone at the company uses Slack.\",\n  \"is_enabled\": true,\n  \"is_everyone_condition\": true,\n  \"name\": \"Company-wide Slack access\",\n  \"status\": \"published\"\n}"

response = http.request(request)
puts response.read_body

{
  "name": "<string>",
  "business_justification": "<string>",
  "id": "<string>",
  "status": "draft",
  "is_enabled": true,
  "apps": [
    {
      "id": "<string>",
      "label": "<string>",
      "is_preapproved": true,
      "entitlements": [
        {
          "id": "<string>",
          "label": "<string>"
        }
      ]
    }
  ],
  "access_condition": {},
  "is_everyone_condition": true,
  "owners": {
    "users": [
      {
        "id": "<string>",
        "email": "<string>",
        "given_name": "<string>",
        "family_name": "<string>",
        "status": "staged"
      }
    ],
    "groups": [
      {
        "id": "<string>",
        "app_id": "<string>",
        "integration_specific_id": "<string>",
        "name": "<string>",
        "description": "<string>",
        "group_lifecycle": "synced",
        "source_app_id": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json

name

string

required

The name of the access policy.

business_justification

string

required

Explanation for why this policy exists.

Maximum string length: 500

apps

AccessPolicyAppInput · object[]

required

The apps granted by this access policy.

Minimum array length: 1

Show child attributes

status

enum<string> | null

The status of the access policy, draft or published. Defaults to draft.

Available options:

draft,

published

is_enabled

boolean | null

Whether the access policy is enabled. Defaults to false when supported.

access_condition

object | null

The Lumos Condition object determining which identities qualify for this policy. Required unless is_everyone_condition is true. This is a recursive JSON structure that allows you to define complex rules for filtering and matching identities using operators like equals, in, and, or, and not. For more information, see the Lumos Conditions documentation.

is_everyone_condition

boolean

default:false

Whether the access policy applies to everyone. Send true without access_condition, or false (the default) with one; sending both returns 400, unless access_condition is the everyone condition a read returns.

Response

Successful Response

The full representation of an access policy returned by the V1 API.

name

string

required

The name of the access policy.

business_justification

string

required

Explanation for why this policy exists.

Maximum string length: 500

string

required

The unique ID of the access policy.

status

enum<string>

required

The status of the access policy.

Available options:

draft,

published

is_enabled

boolean

required

Whether the access policy is enabled.

apps

AccessPolicyAppOutput · object[]

required

The apps and entitlements granted by this access policy.

Show child attributes

access_condition

object

required

The Lumos Condition object determining which identities qualify for this policy. For more information, see the Lumos Conditions documentation.

is_everyone_condition

boolean

required

read-only

True when the policy applies to everyone in your organization. In that case, access_condition holds the condition Lumos uses to match everyone.

owners

OwnersOutput · object | null

The users and groups that own this access policy. Returned only with expand=owners, owners.users, or owners.groups.

Show child attributes

Quick Start

Lumos API

API Reference

Guides

Migrate from v0

Lumos Connectors

Webhooks

Tools

Create Access Policy

Authorizations

Body

Response