> ## Documentation Index
> Fetch the complete documentation index at: https://onecli.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Organization Policy API: Rules That Bind Every Workspace

> Manage organization rules with the OneCLI API: blocks, allows, rate limits, approvals, and app permissions enforced across every workspace.

Organization policy is a first-match rule set that binds every workspace. Each rule blocks, allows, rate limits, or requires approval for agent requests, and a Default Rule decides anything no other rule matched.

Use these endpoints to manage organization rules as code. For rules scoped to one workspace, use the workspace rule endpoints. To learn how rules are evaluated, see [Rules](https://onecli.sh/docs/guides/rules.md).

## Related guides

* [Rules: control what agents can do](https://onecli.sh/docs/guides/rules.md)
* [How it works: the gateway enforces policy](https://onecli.sh/docs/how-it-works.md)

## Endpoints

| Endpoint | Method and path | What it does |
| - | - | - |
| [List organization rules](https://onecli.sh/docs/api-reference/organization-policy/list-organization-rules.md) | `GET /org/policy/rules` | List organization rules in first-match order, with the Default Rule last. |
| [Create an organization rule](https://onecli.sh/docs/api-reference/organization-policy/create-an-organization-rule.md) | `POST /org/policy/rules` | Create an organization rule that blocks, allows, rate limits, or requires approval for agent requests across every workspace, effective now. |
| [Reorder organization rules](https://onecli.sh/docs/api-reference/organization-policy/reorder-organization-rules.md) | `PUT /org/policy/rules/order` | Reorder organization rules to change which one matches first. |
| [Get an organization rule](https://onecli.sh/docs/api-reference/organization-policy/get-an-organization-rule.md) | `GET /org/policy/rules/{ruleId}` | Get one organization rule by ID, including its action, match conditions, and source. |
| [Update an organization rule](https://onecli.sh/docs/api-reference/organization-policy/update-an-organization-rule.md) | `PATCH /org/policy/rules/{ruleId}` | Update an organization rule with a partial change. |
| [Delete an organization rule](https://onecli.sh/docs/api-reference/organization-policy/delete-an-organization-rule.md) | `DELETE /org/policy/rules/{ruleId}` | Delete a custom organization rule. |
| [Get the organization's Default Rule](https://onecli.sh/docs/api-reference/organization-policy/get-the-organizations-default-rule.md) | `GET /org/policy/default` | Get the organization's Default Rule, the terminal rule that decides any agent request no other organization rule matched. |
| [Set the organization's default action](https://onecli.sh/docs/api-reference/organization-policy/set-the-organizations-default-action.md) | `PATCH /org/policy/default` | Set the organization's default action. |
| [Publish the organization's rules](https://onecli.sh/docs/api-reference/organization-policy/publish-the-organizations-rules.md) | `POST /org/policy/publish` | Publish the organization's rules for older clients. |
| [Get the most recent publish](https://onecli.sh/docs/api-reference/organization-policy/get-the-most-recent-publish.md) | `GET /org/policy/last-publish` | Get the most recent organization policy publish. |
| [Effective app permissions (organization)](https://onecli.sh/docs/api-reference/organization-policy/effective-app-permissions-organization.md) | `GET /org/policy/effective-app-permissions` | See what organization rules alone decide for every tool of one app. |

## Next steps

* [API overview](https://onecli.sh/docs/api-reference.md): base URLs, authentication, and pagination
* [Errors](https://onecli.sh/docs/api-reference/errors.md): status codes and the error format
* [Editions](https://onecli.sh/docs/api-reference/editions.md): which endpoints each edition serves


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.