Skip to main content
POST
Create policy

Authorizations

Authorization
string
header
required

MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).

X-MeshQu-Tenant-Id
string
header
required

Tenant UUID for multi-tenant isolation. Required on authenticated routes. A missing or non-UUID value returns 400 MISSING_TENANT_ID or INVALID_TENANT_ID before API-key authentication.

Body

application/json
code
string
required

Unique code within tenant (e.g., "UCP600-14A")

Required string length: 1 - 50
name
string
required

Human-readable name

Required string length: 1 - 200
decision_type
string
required

Decision type this policy applies to (e.g., "lc_approval")

Required string length: 1 - 100
description
string

Detailed description

Maximum string length: 2000
rules
object[]

Policy rules for initial version (can be empty, add rules via version endpoint)

shadow_mode
boolean
default:false

When true, violations are logged but DENY becomes ALERT. Enables A/B testing.

policy_group_id
string<uuid>

Optional policy group to assign this policy to

regulatory_refs
string[]

Regulatory references this policy implements

Maximum array length: 50
Maximum string length: 200
codification
object

Optional. When provided, MeshQu stores the rules produced from the codification input. Their source_ref is derived from the declared clause rather than taken from the caller.

Response

Default Response

id
string<uuid>
required
tenant_id
string<uuid>
required
code
string
required
name
string
required
description
string | null
required
decision_type
string
required
current_version
integer
required
is_active
boolean
required
shadow_mode
boolean
required

When true, violations are logged but DENY becomes ALERT

policy_group_id
string<uuid> | null
required

Policy group this policy belongs to

created_at
string<date-time>
required
created_by
string | null
required
updated_at
string<date-time>
required
regulatory_refs
string[] | null

Regulatory references this policy implements

regulatory_refs_warnings
object[]

Warnings for regulatory_refs entries not found in the clause registry. Informational only — the save proceeded.

version
object
versionState

Lifecycle state of the selected version. discarded never governed a decision and cannot be restored. reopened, set_aside and replaced are pending versions closed without governing; they remain available for comparison.

Available options:
active
selectedVersion
integer
permissions
object

Convenience permission flags. Clients MUST use actions[] as the source of truth for availability; permissions are for disable-state/tooltip hints only.

actions
object[]