Create a brand-new draft policy version with no parent.

POST

/v1/policies

Creates a new policy version in the draft state for the scoped tenant and environment. Unlike PUT with create_new_draft, this does not require an existing source version. If body is omitted, a default-deny skeleton is seeded. The created version is validated on write; an invalid body lands in the rejected state, consistent with draft update. actor_id is derived from auth and rejected if supplied.

Authorizations

• oidc

Parameters

Query Parameters

tenant_id

string

>= 1 characters

environment_id

string

>= 1 characters

Request Body ^required

object

policy_version

required

string

>= 1 characters <= 200 characters

body

Optional manifest body; default-deny skeleton seeded when omitted.

object

owner

object

user_id

string

>= 1 characters

team

string

>= 1 characters

source

object

source_type

string

>= 1 characters

source_ref

string

>= 1 characters

description

string

<= 500 characters

reason_code

string

/^[a-z0-9_]+$/

reason

string

<= 500 characters

actor_id

Rejected if supplied; actor is derived from authentication context.

string

Responses

201

Draft policy created.

object

schema_version

required

policy_version

required

string

>= 1 characters

status

required

string

Allowed values: draft validating published archived rejected

manifest_hash

required

string

/^sha256:[a-f0-9]{64}$/

etag

required

string

>= 1 characters

audit_event_id

required

string | null

validation

required

object

valid

required

boolean

status

required

Allowed values: not_validated valid invalid

checked_at

required

string | null format: date-time

checked_by

required

string | null

rule_count

required

integer

errors

required

Array<object>

object

reason_code

required

string

/^[a-z0-9_]+$/

message

required

string

>= 1 characters

line

required

integer | null

>= 1

column

required

integer | null

>= 1

path

required

string

>= 1 characters

400

Invalid request

403

Missing policy.write.

409

Policy_version already exists in this environment.