> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stateset.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Approval Policy V1

> Create an approval policy. The policy fires when a worker tool-call's name matches any of tool_patterns…

Create an approval policy.

The policy fires when a worker tool-call's name matches any of
`tool_patterns`. Without `auto_approve_rules`, every match
pauses the job and creates an `ApprovalRequest` for human
review. With auto-approve rules, matches are silently approved
based on the rule (rate-limit windows, allow-listed input
subsets, etc. — see operator docs).

Admin scope only — these gates are security-sensitive.

### Request body

`ApprovalPolicyRequest`

<ParamField body="name" type="string" required>
  Human-readable policy name (≤128 chars). Used in audit logs.
</ParamField>

<ParamField body="tool_patterns" type="string[]">
  Tool-name patterns that trigger this policy. Glob-style: `computer:*` matches every computer-tool action, `bash:rm *` matches `bash` with `rm`-prefixed input. Each pattern ≤256 chars.
</ParamField>

<ParamField body="auto_approve_rules" type="object">
  Optional rules that auto-approve a matching tool call without human review. Free-form dict — see operator docs for the supported keys (`max_per_hour`, `allow_safe_subset`, etc.).
</ParamField>

### Response

`ApprovalPolicySummary`

<ResponseField name="id" type="string" required />

<ResponseField name="name" type="string" required />

<ResponseField name="tool_patterns" type="string[]" required />

<ResponseField name="auto_approve_rules" type="object" required />

<ResponseField name="is_active" type="boolean" required />

<ResponseField name="created_at" type="string" required />

<ResponseField name="updated_at" type="string" required />

### Status codes

| Code  | Meaning             |
| ----- | ------------------- |
| `201` | Successful Response |
| `422` | Validation Error    |

<RequestExample>
  ```bash cURL theme={null}
  curl --request POST \
    --url 'https://api.computer.stateset.app/api/v1/approval-policies' \
    --header 'X-API-Key: YOUR_API_KEY' \
    --header 'Content-Type: application/json' \
    --data '{
    "name": "Two-Person Tent",
    "tool_patterns": [
      "string"
    ],
    "auto_approve_rules": {}
  }'
  ```
</RequestExample>

<ResponseExample>
  ```json 201 theme={null}
  {
    "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "name": "Two-Person Tent",
    "tool_patterns": [
      "string"
    ],
    "auto_approve_rules": {},
    "is_active": true,
    "created_at": "2026-08-31T14:22:05Z",
    "updated_at": "2026-08-31T14:22:05Z"
  }
  ```
</ResponseExample>