Skip to main content
POST
Create an AI Gateway Firewall policy

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json

A policy needs at least one rule.

name
string
required

User-defined label for this policy.

Maximum string length: 255
rules
object[]
required

Every rule of the policy, of every tier, before and after the model. A policy holds up to 48. A key enforces its account's all-keys policy and its configuration's policy together, so it can enforce up to 96, and a request can add up to 48 of its own.

Required array length: 1 - 48 elements
description
string

Human-readable description.

Maximum string length: 255
metadata
string

Arbitrary user-defined metadata.

Maximum string length: 4096
mode
enum<string>

enforce blocks a tool call or request the policy's rules flag. audit lets it through and reports the verdict. The mode applies to this policy's rules only: an audit policy only reports, even when the account's all-keys policy or a request enforces. Defaults to enforce.

Available options:
enforce,
audit
onError
enum<string>

What a tool call or request the decision model could not judge does. Defaults to block.

Available options:
block,
log
environment
string[]

Facts about the caller's setup that inform the decision model. They are not rules.

Maximum array length: 32
Maximum string length: 1000

Response

The created Firewall policy.

id
string
required

Unique identifier for this policy.

uri
string
required

URI of this AI Gateway Firewall policy API resource.

name
string
required

User-defined label for this policy.

createdAt
string<date-time>
required

Timestamp when the policy was created.

updatedAt
string<date-time>
required

Timestamp when the policy was last updated.

createdBy
object
required
lastUpdatedBy
object
required
accessKeyConfigurationCount
integer<int32>
required

Number of access key configurations that enforce this policy. 0 when unused.

appliesToAllKeys
boolean
required

True when the policy is the account's baseline, set as firewallPolicyId on the gateway config. It applies to every key, under each configuration's own policy.

mode
enum<string>
required

enforce blocks a tool call or request the policy's rules flag. audit lets it through and reports the verdict. The mode applies to this policy's rules only: an audit policy only reports, even when the account's all-keys policy or a request enforces. Defaults to enforce.

Available options:
enforce,
audit
onError
enum<string>
required

What a tool call or request the decision model could not judge does. Defaults to block.

Available options:
block,
log
environment
string[]
required

Facts about the caller's setup that inform the decision model. They are not rules.

Maximum array length: 32
Maximum string length: 1000
rules
object[]
required

Every rule of the policy, of every tier, before and after the model. A policy holds up to 48. A key enforces its account's all-keys policy and its configuration's policy together, so it can enforce up to 96, and a request can add up to 48 of its own.

Maximum array length: 48
description
string

Human-readable description.

metadata
string

Arbitrary user-defined metadata.