> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cybedefend.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a new security policy



## OpenAPI

````yaml post /organization/{organizationId}/policies
openapi: 3.0.0
info:
  title: Cybedefend API
  description: >-
    CybeDefend is an advanced API for application security analysis. Key
    features include OAuth 2.0 authentication, user/organization/project
    management, and REBAC-based permissions. It excels in static, dynamic, and
    IaC security analyses (SAST, DAST, IaC, etc.).
  version: '1.0'
  contact: {}
servers:
  - url: https://api-eu.cybedefend.com
    description: EU
  - url: https://api-us.cybedefend.com
    description: US
security: []
tags: []
paths:
  /organization/{organizationId}/policies:
    post:
      tags:
        - Policy
      summary: Create a new security policy
      operationId: PolicyController_createPolicy
      parameters:
        - name: organizationId
          required: true
          in: path
          schema:
            format: uuid
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreatePolicyBodyDto'
      responses:
        '201':
          description: Policy created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyResponseDto'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorDto'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorDto'
      security:
        - bearer: []
components:
  schemas:
    CreatePolicyBodyDto:
      type: object
      properties:
        yamlContent:
          type: string
          description: |-
            Full YAML policy definition. Example:
            ```yaml
            version: '1.0'
            name: Production Security Policy
            description: Block critical vulnerabilities
            scope: PROJECT
            priority: 10
            enabled: true
            projectIds:
              - 550e8400-e29b-41d4-a716-446655440000
            rules:
              - name: Block Critical
                type: severity
                operator: eq
                value: CRITICAL
                action: block
            ```
          example: |-
            version: '1.0'
            name: Production Security Policy
            scope: PROJECT
            priority: 10
            enabled: true
            projectIds:
              - 550e8400-e29b-41d4-a716-446655440000
            rules:
              - name: Block Critical
                type: severity
                operator: eq
                value: CRITICAL
                action: block
      required:
        - yamlContent
    PolicyResponseDto:
      type: object
      properties:
        id:
          type: string
          description: Policy ID
          example: 550e8400-e29b-41d4-a716-446655440000
        scope:
          type: string
          description: Policy scope
          enum:
            - ORGANIZATION
            - TEAM
            - PROJECT
          example: PROJECT
        organizationId:
          type: string
          description: Organization ID the policy belongs to
          example: 550e8400-e29b-41d4-a716-446655440001
        projectIds:
          description: Project IDs targeted by this policy (for PROJECT scope)
          example:
            - 550e8400-e29b-41d4-a716-446655440002
          type: array
          items:
            type: string
        teamIds:
          description: Team IDs targeted by this policy (for TEAM scope)
          example:
            - 550e8400-e29b-41d4-a716-446655440003
          type: array
          items:
            type: string
        name:
          type: string
          description: Policy name
          example: Production Security Policy
        description:
          type: string
          description: Policy description
          example: Security policy for production environment
        priority:
          type: number
          description: Priority (lower = higher priority)
          example: 10
        config:
          type: object
          description: Policy configuration
          example:
            rules: []
            exclusions: []
        isEnabled:
          type: boolean
          description: Whether the policy is enabled
          example: true
        createdAt:
          type: string
          description: Creation timestamp
          example: '2024-01-15T10:30:00Z'
        updatedAt:
          type: string
          description: Last update timestamp
          example: '2024-01-15T10:30:00Z'
        createdBy:
          type: string
          description: User ID who created the policy
        updatedBy:
          type: string
          description: User ID who last updated the policy
      required:
        - id
        - scope
        - organizationId
        - name
        - priority
        - config
        - isEnabled
        - createdAt
        - updatedAt
    ErrorDto:
      type: object
      properties:
        timestamp:
          type: string
          example: '2025-02-18T12:31:18.491Z'
          description: Timestamp of the error
        service:
          type: string
          example: AiService
          description: Name of the service where the error occurred
        method:
          type: string
          example: startConversation
          description: Method name where the error occurred
        message:
          type: string
          example: Invalid parameters provided
          description: Error message
        code:
          type: number
          example: 400
          description: HTTP status code
          minimum: 100
          maximum: 599
      required:
        - timestamp
        - service
        - method
        - message
        - code
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: JWT access token.

````