Create an organization rule
curl --request POST \
--url https://api.onecli.sh/v1/org/policy/rules \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"targets": [
{
"provider": "<string>",
"tools": [
"<string>"
],
"connectionId": "<string>",
"secretId": "<string>",
"hostPattern": "<string>",
"pathPattern": "<string>"
}
],
"description": "<string>",
"enabled": true,
"rateLimit": 500000,
"requireApproval": true,
"conditions": "<unknown>",
"identities": [
{
"id": "<string>"
}
]
}
'import requests
url = "https://api.onecli.sh/v1/org/policy/rules"
payload = {
"name": "<string>",
"targets": [
{
"provider": "<string>",
"tools": ["<string>"],
"connectionId": "<string>",
"secretId": "<string>",
"hostPattern": "<string>",
"pathPattern": "<string>"
}
],
"description": "<string>",
"enabled": True,
"rateLimit": 500000,
"requireApproval": True,
"conditions": "<unknown>",
"identities": [{ "id": "<string>" }]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
name: '<string>',
targets: [
{
provider: '<string>',
tools: ['<string>'],
connectionId: '<string>',
secretId: '<string>',
hostPattern: '<string>',
pathPattern: '<string>'
}
],
description: '<string>',
enabled: true,
rateLimit: 500000,
requireApproval: true,
conditions: '<unknown>',
identities: [{id: '<string>'}]
})
};
fetch('https://api.onecli.sh/v1/org/policy/rules', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.onecli.sh/v1/org/policy/rules",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'targets' => [
[
'provider' => '<string>',
'tools' => [
'<string>'
],
'connectionId' => '<string>',
'secretId' => '<string>',
'hostPattern' => '<string>',
'pathPattern' => '<string>'
]
],
'description' => '<string>',
'enabled' => true,
'rateLimit' => 500000,
'requireApproval' => true,
'conditions' => '<unknown>',
'identities' => [
[
'id' => '<string>'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.onecli.sh/v1/org/policy/rules"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"targets\": [\n {\n \"provider\": \"<string>\",\n \"tools\": [\n \"<string>\"\n ],\n \"connectionId\": \"<string>\",\n \"secretId\": \"<string>\",\n \"hostPattern\": \"<string>\",\n \"pathPattern\": \"<string>\"\n }\n ],\n \"description\": \"<string>\",\n \"enabled\": true,\n \"rateLimit\": 500000,\n \"requireApproval\": true,\n \"conditions\": \"<unknown>\",\n \"identities\": [\n {\n \"id\": \"<string>\"\n }\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.onecli.sh/v1/org/policy/rules")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"targets\": [\n {\n \"provider\": \"<string>\",\n \"tools\": [\n \"<string>\"\n ],\n \"connectionId\": \"<string>\",\n \"secretId\": \"<string>\",\n \"hostPattern\": \"<string>\",\n \"pathPattern\": \"<string>\"\n }\n ],\n \"description\": \"<string>\",\n \"enabled\": true,\n \"rateLimit\": 500000,\n \"requireApproval\": true,\n \"conditions\": \"<unknown>\",\n \"identities\": [\n {\n \"id\": \"<string>\"\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.onecli.sh/v1/org/policy/rules")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"targets\": [\n {\n \"provider\": \"<string>\",\n \"tools\": [\n \"<string>\"\n ],\n \"connectionId\": \"<string>\",\n \"secretId\": \"<string>\",\n \"hostPattern\": \"<string>\",\n \"pathPattern\": \"<string>\"\n }\n ],\n \"description\": \"<string>\",\n \"enabled\": true,\n \"rateLimit\": 500000,\n \"requireApproval\": true,\n \"conditions\": \"<unknown>\",\n \"identities\": [\n {\n \"id\": \"<string>\"\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"scope": "organization",
"status": "draft",
"generation": 123,
"priority": 123,
"enabled": true,
"isDefault": true,
"logicalId": "<string>",
"source": "<string>",
"name": "<string>",
"description": "<string>",
"action": "allow",
"rateLimit": 123,
"rateLimitWindow": "minute",
"requireApproval": true,
"conditions": "<unknown>",
"identities": [
{
"type": "agent",
"id": "<string>"
}
],
"targets": [
{
"kind": "app",
"provider": "<string>",
"tools": [
"<string>"
],
"connectionScope": "organization",
"connectionId": "<string>",
"secretId": "<string>",
"secretScope": "organization",
"hostPattern": "<string>",
"pathPattern": "<string>",
"method": "GET"
}
],
"createdAt": "2023-11-07T05:31:56Z"
}{
"error": "<string>"
}{
"error": "<string>"
}Policy
Create an organization policy rule
Adds a new organization policy rule just above the Default Rule. The rule is enforced immediately on agent requests across every workspace.
POST
/
org
/
policy
/
rules
Create an organization rule
curl --request POST \
--url https://api.onecli.sh/v1/org/policy/rules \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"targets": [
{
"provider": "<string>",
"tools": [
"<string>"
],
"connectionId": "<string>",
"secretId": "<string>",
"hostPattern": "<string>",
"pathPattern": "<string>"
}
],
"description": "<string>",
"enabled": true,
"rateLimit": 500000,
"requireApproval": true,
"conditions": "<unknown>",
"identities": [
{
"id": "<string>"
}
]
}
'import requests
url = "https://api.onecli.sh/v1/org/policy/rules"
payload = {
"name": "<string>",
"targets": [
{
"provider": "<string>",
"tools": ["<string>"],
"connectionId": "<string>",
"secretId": "<string>",
"hostPattern": "<string>",
"pathPattern": "<string>"
}
],
"description": "<string>",
"enabled": True,
"rateLimit": 500000,
"requireApproval": True,
"conditions": "<unknown>",
"identities": [{ "id": "<string>" }]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
name: '<string>',
targets: [
{
provider: '<string>',
tools: ['<string>'],
connectionId: '<string>',
secretId: '<string>',
hostPattern: '<string>',
pathPattern: '<string>'
}
],
description: '<string>',
enabled: true,
rateLimit: 500000,
requireApproval: true,
conditions: '<unknown>',
identities: [{id: '<string>'}]
})
};
fetch('https://api.onecli.sh/v1/org/policy/rules', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.onecli.sh/v1/org/policy/rules",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'targets' => [
[
'provider' => '<string>',
'tools' => [
'<string>'
],
'connectionId' => '<string>',
'secretId' => '<string>',
'hostPattern' => '<string>',
'pathPattern' => '<string>'
]
],
'description' => '<string>',
'enabled' => true,
'rateLimit' => 500000,
'requireApproval' => true,
'conditions' => '<unknown>',
'identities' => [
[
'id' => '<string>'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.onecli.sh/v1/org/policy/rules"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"targets\": [\n {\n \"provider\": \"<string>\",\n \"tools\": [\n \"<string>\"\n ],\n \"connectionId\": \"<string>\",\n \"secretId\": \"<string>\",\n \"hostPattern\": \"<string>\",\n \"pathPattern\": \"<string>\"\n }\n ],\n \"description\": \"<string>\",\n \"enabled\": true,\n \"rateLimit\": 500000,\n \"requireApproval\": true,\n \"conditions\": \"<unknown>\",\n \"identities\": [\n {\n \"id\": \"<string>\"\n }\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.onecli.sh/v1/org/policy/rules")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"targets\": [\n {\n \"provider\": \"<string>\",\n \"tools\": [\n \"<string>\"\n ],\n \"connectionId\": \"<string>\",\n \"secretId\": \"<string>\",\n \"hostPattern\": \"<string>\",\n \"pathPattern\": \"<string>\"\n }\n ],\n \"description\": \"<string>\",\n \"enabled\": true,\n \"rateLimit\": 500000,\n \"requireApproval\": true,\n \"conditions\": \"<unknown>\",\n \"identities\": [\n {\n \"id\": \"<string>\"\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.onecli.sh/v1/org/policy/rules")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"targets\": [\n {\n \"provider\": \"<string>\",\n \"tools\": [\n \"<string>\"\n ],\n \"connectionId\": \"<string>\",\n \"secretId\": \"<string>\",\n \"hostPattern\": \"<string>\",\n \"pathPattern\": \"<string>\"\n }\n ],\n \"description\": \"<string>\",\n \"enabled\": true,\n \"rateLimit\": 500000,\n \"requireApproval\": true,\n \"conditions\": \"<unknown>\",\n \"identities\": [\n {\n \"id\": \"<string>\"\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"scope": "organization",
"status": "draft",
"generation": 123,
"priority": 123,
"enabled": true,
"isDefault": true,
"logicalId": "<string>",
"source": "<string>",
"name": "<string>",
"description": "<string>",
"action": "allow",
"rateLimit": 123,
"rateLimitWindow": "minute",
"requireApproval": true,
"conditions": "<unknown>",
"identities": [
{
"type": "agent",
"id": "<string>"
}
],
"targets": [
{
"kind": "app",
"provider": "<string>",
"tools": [
"<string>"
],
"connectionScope": "organization",
"connectionId": "<string>",
"secretId": "<string>",
"secretScope": "organization",
"hostPattern": "<string>",
"pathPattern": "<string>",
"method": "GET"
}
],
"createdAt": "2023-11-07T05:31:56Z"
}{
"error": "<string>"
}{
"error": "<string>"
}Adds a rule just above the Default Rule. It takes effect immediately in every workspace. Use it to set guardrails no workspace can override. See Rules for the available actions.
Appended just above the Default Rule and enforced immediately.
Availability: Cloud · Community (self-hosted) · Enterprise (self-hosted)
Authorizations
A workspace API key (oc_…) or organization API key (oc_org_…). Workspace-scoped endpoints called with an organization key also need X-Workspace-Id.
Body
application/json
A rule must name at least one target (an empty or missing targets list is refused with 422). rateLimit/rateLimitWindow are paired and, like requireApproval, valid only with action: allow. On Cloud, rateLimit needs the Pro plan or above and group identities need the Enterprise plan; manual approval is available on every plan.
Maximum string length:
255Available options:
allow, block Required array length:
1 - 100 elementsShow child attributes
Show child attributes
Maximum string length:
1000Required range:
1 <= x <= 1000000Available options:
minute, hour, day A conditions array (max 10) or a session-policy object ({repositories: [...]} / {folders: [...]} / {driveFolders: [...]}; allow rules with a connection target only).
Maximum array length:
100Show child attributes
Show child attributes
Response
The rule
A policy-engine rule. Every write is enforced immediately; the draft/published split survives only for older clients. Published row ids regenerate on every publish; logicalId is the identity stable across statuses and generations.
Available options:
organization, workspace Available options:
draft, published 0 for the draft working copy; the snapshot number for published rows.
First-match order (lower evaluates first).
True on the scope's terminal Default Rule.
Generation-stable identity; compare rules across draft/published by this, never by id.
custom (user-owned, editable), default (the Default Rule), or system-managed rows: blocklist (compiled from app blocklists) and, at workspace scope, grant (compiled from agent grants; managed through the Grants endpoints, never edited as rules).
Available options:
allow, block Available options:
minute, hour, day, null A conditions array, a session-policy object ({repositories} / {folders} / {driveFolders}), or null.
Show child attributes
Show child attributes
Show child attributes
Show child attributes