Create Policy
const url = 'https://example.com/iam/v1/workspaces/example/policies';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"name":"example","description":"example","conditions":[{"source_ip":{"operator":"SOURCE_IP_OPERATOR_UNSPECIFIED","cidrs":[{"address":"example","prefix":1}]},"time_window":{"operator":"TIME_WINDOW_OPERATOR_UNSPECIFIED","from":{"hours":1,"minutes":1,"seconds":1,"nanos":1},"to":{"hours":1,"minutes":1,"seconds":1,"nanos":1},"timezone":"example"},"role":{"operator":"ROLE_CONDITION_OPERATOR_UNSPECIFIED","services":["example"]},"location":{"operator":"LOCATION_CONDITION_OPERATOR_UNSPECIFIED","allowed_location_ids":["example"]}}]}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example.com/iam/v1/workspaces/example/policies \ --header 'Content-Type: application/json' \ --data '{ "name": "example", "description": "example", "conditions": [ { "source_ip": { "operator": "SOURCE_IP_OPERATOR_UNSPECIFIED", "cidrs": [ { "address": "example", "prefix": 1 } ] }, "time_window": { "operator": "TIME_WINDOW_OPERATOR_UNSPECIFIED", "from": { "hours": 1, "minutes": 1, "seconds": 1, "nanos": 1 }, "to": { "hours": 1, "minutes": 1, "seconds": 1, "nanos": 1 }, "timezone": "example" }, "role": { "operator": "ROLE_CONDITION_OPERATOR_UNSPECIFIED", "services": [ "example" ] }, "location": { "operator": "LOCATION_CONDITION_OPERATOR_UNSPECIFIED", "allowed_location_ids": [ "example" ] } } ] }'Creates a new policy within a workspace
Parameters
Section titled “ Parameters ”Path Parameters
Section titled “Path Parameters ”The workspace to create the policy in
Request Body required
Section titled “Request Body required ”Policy resource — a set of conditions that constrain when an IAM binding is effective
object
The unique identifier of the policy
The workspace this policy belongs to
The display name of the policy
An optional description of the policy
The conditions that must be satisfied for the policy to apply
Condition — a polymorphic condition within a policy
object
Source IP address condition
object
The comparison operator for the IP check
The CIDR ranges to match against
IpAddress — an IP address (IPv4 or IPv6) with its CIDR prefix length
object
The IP address (e.g. “10.0.0.0” or “2001:db8::1”)
The CIDR prefix length (e.g. 8 for /8, 24 for /24)
Time window condition
object
The comparison operator for the time check
Start time of the window
object
Hours of a day in 24 hour format. Must be greater than or equal to 0 and typically must be less than or equal to 23. An API may choose to allow the value “24:00:00” for scenarios like business closing time.
Minutes of an hour. Must be greater than or equal to 0 and less than or equal to 59.
Seconds of a minute. Must be greater than or equal to 0 and typically must be less than or equal to 59. An API may allow the value 60 if it allows leap-seconds.
Fractions of seconds, in nanoseconds. Must be greater than or equal to 0 and less than or equal to 999,999,999.
End time of the window
object
Hours of a day in 24 hour format. Must be greater than or equal to 0 and typically must be less than or equal to 23. An API may choose to allow the value “24:00:00” for scenarios like business closing time.
Minutes of an hour. Must be greater than or equal to 0 and less than or equal to 59.
Seconds of a minute. Must be greater than or equal to 0 and typically must be less than or equal to 59. An API may allow the value 60 if it allows leap-seconds.
Fractions of seconds, in nanoseconds. Must be greater than or equal to 0 and less than or equal to 999,999,999.
IANA timezone identifier (e.g. “America/New_York”)
Role delegation condition
object
The comparison operator for the role check
The service names that the delegated role’s permissions must belong to
Location condition
object
The comparison operator for the location check
The set of allowed location ids (weak references to topology Locations)
Created Timestamp
The timestamp when the policy was created
Updated Timestamp
Timestamp when the Policy was last updated
Responses
Section titled “ Responses ”OK
IAM Operation
An acknowledgment of a mutation request, carrying tracking metadata, errors, and warnings. Follows GCP’s Operations pattern (AIP-151).
object
Operation ID
Unique identifier for this operation.
Resource ID
The ID of the resource affected by this operation. May be empty for async operations where the resource does not yet exist.
Resource Type
The type of resource (e.g., “User”, “Role”, “IamBinding”).
Operation Type
The kind of mutation that was requested.
Status
Current lifecycle state of the operation.
Insert Time
When the operation was first created.
Start Time
When the operation started executing.
End Time
When the operation completed (either successfully or with errors).
Errors
Business rule errors encountered during the operation.
Operation Error
A structured error returned inside an operation when a business rule fails.
object
Error Code
Numeric identifier following the S_SSS_EEE convention.
Description
Human-readable explanation of the error.
Warnings
Non-fatal notices about the operation.
Operation Warning
A non-fatal notice attached to an operation.
object
Warning Code
Numeric identifier following the S_SSS_EEE convention.
Description
Human-readable explanation of the warning.
Progress
Percentage of completion (0-100).
Revocation Cause
Discriminator for REVOKE operations only (UNSPECIFIED for every other operation_type). See RevocationCause for the four flavours.
Example
{ "operation_type": "IAM_OPERATION_TYPE_UNSPECIFIED", "status": "IAM_OPERATION_STATUS_UNSPECIFIED", "cause": "REVOCATION_CAUSE_UNSPECIFIED"}default
Section titled “default ”Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
object
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
A list of messages that carry the error details. There is a common set of message types for APIs to use.
Contains an arbitrary serialized message along with a @type that describes the type of the serialized message.
object
The type of the serialized message.
Example generated
{ "code": 1, "message": "example", "details": [ { "@type": "example" } ]}