Create a plugin policy. POST /api/openapi/v1/expert-suite-policies, scope admin.v1.expert-suites.manage.
- Scope: admin.v1.expert-suites.manage
- Permission: Manage plugins (expert-suites)
- Permission type: Manage
- Endpoint: POST/api/openapi/v1/expert-suite-policies
Authentication and request headers
Call with an application API key. This endpoint checks only the scope above; read, manage and execute permissions do not imply one another.
| Name | Location | Type | Required | Description | Example |
|---|---|---|---|---|---|
| Authorization | header | string | Yes | Application API key, passed as a Bearer token. | Bearer qwk_*** |
| X-Request-Id | header | string | No | Optional request tracing identifier; generated by the server if omitted. | req-20260831-001 |
Request parameters
| Name | Location | Type | Required | Description | Example |
|---|---|---|---|---|---|
| Idempotency-Key | header | string | Required | Idempotency key used to prevent duplicate submissions | "<string>" |
| description | body | string | No | Description | "<string>" |
| display_order | body | integer · int64 | No | Display order | 0 |
| mode | body | string | Required | Policy mode | "allowlist" |
| name | body | string | Required | Policy name | "<string>" |
| resource_ids | body | array ｜ null | Required | Expert suite scope (resource IDs) | ["<string>"] |
| resource_scope | body | string | Required | Expert suite scope | "all" |
| status | body | string | No | Enabled | "enabled" |
| subject_scope | body | string | Required | Subject scope | "all_users" |
| subjects | body | array ｜ null | Required | Select scope | [{"include_descendants":false,"subject_id":"<string>","subject_type":"user"}] |
| surfaces | body | array ｜ null | Required | Target app | ["<string>"] |
| valid_from | body | string · date-time | No | Effective from | "2026-08-27T10:00:00Z" |
| valid_to | body | string · date-time | No | Effective until | "2026-08-27T10:00:00Z" |
Request example
cURL
Responses
201 Created
| Name | Type | Required | Description | Example |
|---|---|---|---|---|
| created_at | string · date-time | Yes | Created at | "2026-08-27T10:00:00Z" |
| default | boolean | Yes | Whether this is the default policy group | false |
| description | string | Yes | Description | "<string>" |
| id | string | Yes | Policy group ID | "<string>" |
| mode | string | Yes | Policy mode | "<string>" |
| name | string | Yes | Policy name | "<string>" |
| policy_type | string | Yes | Policy type | "<string>" |
| resource_count | integer · int64 | Yes | Resource count | 0 |
| resource_scope | string | Yes | Expert suite scope | "<string>" |
| status | string | Yes | Enabled | "<string>" |
| subject_count | integer · int64 | Yes | Subject count | 0 |
| subject_counts | object | Yes | Subject counts by type | {} |
| subject_scope | string | Yes | Subject scope | "<string>" |
| surfaces | array ｜ null | Yes | Target app | ["<string>"] |
| updated_at | string · date-time | Yes | Updated at | "2026-08-27T10:00:00Z" |
default Flat business error
| Name | Type | Required | Description | Example |
|---|---|---|---|---|
| code | string | No | Stable business error code | "<string>" |
| detail | string | Yes | Human-readable error description | "<string>" |
| details | OpenapiErrorDetails | No | Error details | {"field":"<string>","reason":"<string>","suggestion":"<string>"} |
| details.field | string | No | Request field that failed validation | "<string>" |
| details.reason | string | No | Stable validation failure reason | "<string>" |
| details.suggestion | string | No | Suggested normalized value | "<string>" |
| error | string | Yes | Stable HTTP error type | "<string>" |