# Create an advanced API access policy (/docs/apis/management/resources/CreateApiAccessAdvancedPolicy)

`POST /resources/api_resources/{api_id}/policies/advanced`

Creates a new advanced API access policy for the specified API resource using raw Cedar policy source.

Base URL: `https://{tenant}.{region}.monocloud.com/api`, where `{tenant}`, `{region}` (one of us, eu, in) come from your tenant. Authentication: send your Management API key in the `X-API-KEY` header.

## Parameters

- `api_id` (path) (string, required) The unique identifier of the API resource.

## Request body

JSON, required. The request payload used to create the policy.

- `enabled` (boolean, default true) Indicates whether the policy is enabled.
- `name` (string, required) Human-readable name for the policy.
- `description` (string) Description that explains the purpose of the policy.
- `cedar` (string, required) The Cedar policy source used during evaluation for advanced policies.
- `actions` (CreateApiAccessPolicyActionsRequest) Action settings applied when the policy matches.
  - `access_token_type` (string) Overrides whether access tokens are issued as self-contained JWTs or opaque reference tokens. When unset, the API resource default is used. One of: `jwt`, `reference`.
  - `access_token_lifetime` (integer, int32) Overrides the access token lifetime (in seconds). When unset, the API resource default is used.
  - `allow_multi_audience` (boolean) Overrides whether access tokens issued for this resource may include additional audiences. When unset, the API resource default is used. ScaleX subscription required to allow multi-audience tokens.
  - `allow_user_info_access` (boolean) Overrides whether access tokens issued for this resource may include identity scopes and be used with identity endpoints such as UserInfo. When unset, the API resource default is used. ScaleX subscription required to allow UserInfo access.
  - `bind_tokens_to_session` (boolean) Overrides whether access tokens issued for this resource are bound to the user session and revoked when the session ends. When unset, the API resource default is used. ScaleX subscription required to use session binding.
- `error` (string) Optional denial message returned to the client when this policy rejects a token request. If unset, a generic denial message is returned.

## Response body

`201`, JSON. The policy was created successfully

Returns `AdvancedApiAccessPolicy`.

- `id` (string, required) The unique identifier of the policy.
- `enabled` (boolean, required) Indicates whether the policy is enabled.
- `name` (string, required) Human-readable name for the policy.
- `description` (string) Description that explains the purpose of the policy.
- `type` (string, required) The policy authoring mode. Basic policies are authored using structured conditions; advanced policies are authored using Cedar policy source. One of: `basic`, `advanced`.
- `is_permitted` (boolean, required) Indicates whether the policy grants access when matched.
- `cedar` (string, required) The Cedar policy source used during evaluation for advanced policies.
- `actions` (ApiAccessPolicyActions, required) Action settings applied when the policy matches.
  - `access_token_type` (string) Overrides whether access tokens are issued as self-contained JWTs or opaque reference tokens. When unset, the API resource default is used. One of: `jwt`, `reference`.
  - `access_token_lifetime` (integer, int32) Overrides the access token lifetime (in seconds). When unset, the API resource default is used.
  - `allow_multi_audience` (boolean) Overrides whether access tokens issued for this resource may include additional audiences. When unset, the API resource default is used. ScaleX subscription required to allow multi-audience tokens.
  - `allow_user_info_access` (boolean) Overrides whether access tokens issued for this resource may include identity scopes and be used with identity endpoints such as UserInfo. When unset, the API resource default is used. ScaleX subscription required to allow UserInfo access.
  - `bind_tokens_to_session` (boolean) Overrides whether access tokens issued for this resource are bound to the user session and revoked when the session ends. When unset, the API resource default is used. ScaleX subscription required to use session binding.
- `creation_time` (integer, required, date-time) Specifies the creation time of the policy (in Epoch).
- `last_updated` (integer, required, date-time) Specifies the last update time of the policy (in Epoch).
- `revision` (integer, required, int32) Specifies the current version of the policy. Incremented on every update.
- `error` (string) Optional denial message returned to the client when this policy rejects a token request. If unset, a generic denial message is returned.

## Errors

- `400` Bad Request
  - `type` (string, required) A URI reference that identifies the error type. When accessed, it may provide human-readable documentation.
  - `title` (string, required) A short, human-readable summary of the error.
  - `status` (integer, required, int32) The HTTP status code associated with this error response.
  - `trace_id` (string, required) A unique identifier for the request, used for tracing and diagnostics.
  - `detail` (string) A human-readable explanation specific to this occurrence of the error.
  - `instance` (string) A URI reference that identifies the specific occurrence of the error.
- `401` Unauthorized
- `402` Payment Required
  Same body as `400`.
- `403` Forbidden
- `422` Unprocessable Entity
  - `type` (string, required) A URI reference that identifies the error type. When accessed, it may provide human-readable documentation.
  - `title` (string, required) A short, human-readable summary of the error.
  - `status` (integer, required, int32) The HTTP status code associated with this error response.
  - `trace_id` (string, required) A unique identifier for the request, used for tracing and diagnostics.
  - `detail` (string) A human-readable explanation specific to this occurrence of the error.
  - `instance` (string) A URI reference that identifies the specific occurrence of the error.
  - `errors` (Record<string, string[]>, required) A key-value map of validation errors, where each key represents a request field and the value contains one or more messages describing why the request could not be processed.

## Example (MonoCloud .NET SDK)

```csharp
using MonoCloud.Management;
using MonoCloud.Management.Models;
using MonoCloud.Management.Core.Base;

var apiClient = new MonoCloudManagementClient(new MonoCloudConfig("<your-domain>", "[[API-Key]]"));


var apiId = "EF12vwe266fUHM6dh5Gup";

var requestBody = new CreateApiAccessAdvancedPolicyRequest
  {
    Enabled = true,
    Name = "Billing access policy",
    Description = "Restricts billing API access to admins during business hours",
    Cedar = "permit (principal, action, resource == Api::"https://api.example.com/billing");",
    Actions = new CreateApiAccessPolicyActionsRequest
    {
      AccessTokenType = AccessTokenTypes.Jwt,
      AccessTokenLifetime = 3600,
      AllowMultiAudience = false,
      AllowUserInfoAccess = true,
      BindTokensToSession = true,
    },
    Error = "Access to the billing API requires admin approval.",
  };


var result = await apiClient.Resources.CreateApiAccessAdvancedPolicyAsync(apiId, requestBody);
```

## Example (MonoCloud Javascript SDK)

```javascript
import { MonoCloudManagementClient } from '@monocloud/management';

const apiClient = MonoCloudManagementClient.init({ domain: '<your-domain>', apiKey: '[[API-Key]]' });

const apiId = 'EF12vwe266fUHM6dh5Gup';

const requestBody = {
  enabled: true,
  name: 'Billing access policy',
  description: 'Restricts billing API access to admins during business hours',
  cedar: 'permit (principal, action, resource == Api::"https://api.example.com/billing");',
  actions: {
    access_token_type: 'jwt',
    access_token_lifetime: 3600,
    allow_multi_audience: false,
    allow_user_info_access: true,
    bind_tokens_to_session: true
  },
  error: 'Access to the billing API requires admin approval.'
};

const result = apiClient.resources.createApiAccessAdvancedPolicy(apiId, requestBody);
```