Skip to main content
POST
Create Access Policy

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
name
string
required

The name of the access policy.

business_justification
string
required

Explanation for why this policy exists.

Maximum string length: 500
apps
AccessPolicyAppInput · object[]
required

List of apps granted by this access policy.

Minimum array length: 1
status
enum<string> | null

The status of the access policy. Defaults to DRAFT when supported.

Available options:
DRAFT,
PUBLISHED
is_enabled
boolean | null

Whether the access policy is enabled. Defaults to false when supported.

access_condition
object | null

The Lumos Condition object determining which identities qualify for this policy. Required unless is_everyone_condition is true. This is a recursive JSON structure that allows you to define complex rules for filtering and matching identities using operators like equals, in, and, or, and not. For more information, see the Lumos Conditions documentation.

is_everyone_condition
boolean
default:false

Whether the access policy applies to everyone. If true, access_condition is ignored. Otherwise, access_condition must be provided.

Response

Successful Response

The full representation of an access policy returned by the API.

name
string
required

The name of the access policy.

business_justification
string
required

Explanation for why this policy exists.

Maximum string length: 500
id
string
required

The unique ID of the access policy.

status
enum<string>
required

The status of the access policy.

Available options:
DRAFT,
PUBLISHED
is_enabled
boolean
required

Whether the access policy is enabled.

apps
AccessPolicyAppOutput · object[]
required

The list of apps and permissions granted by this access policy.

access_condition
object
required

The Lumos Condition object determining which identities qualify for this policy. For more information, see the Lumos Conditions documentation.

is_everyone_condition
boolean
required
read-only