Create or Update Policy

This endpoint creates a policy in the v2 policy service.

v2 request shape

The v2 API accepts a single policy object. It no longer uses the old policies[].resourcePolicy wrapper.

Important fields:

• name: unique policy name within the organization
• mcp_server_id: target MCP server
• application_ids: agents/applications this policy applies to
• status: DRAFT, ACTIVE, INACTIVE, or ARCHIVED
• rules: array of rule objects using authorized, actions, roles_groups, and optional condition

Example:

{
  "name": "Slack outbound policy",
  "description": "Default outbound Slack controls for the support agent.",
  "support_contact": "platform@company.com",
  "tags": ["slack", "support"],
  "status": "DRAFT",
  "mcp_server_id": "server_123",
  "application_ids": ["agent_456"],
  "rules": [
    {
      "name": "allow_all",
      "authorized": true,
      "actions": ["*"],
      "roles_groups": ["*"]
    },
    {
      "name": "block_general_channel",
      "authorized": false,
      "actions": ["tools/call:chat_postMessage"],
      "roles_groups": ["*"],
      "condition": {
        "match": {
          "all": {
            "of": [
              {
                "expr": "request.resource.attr.channel == \"general\""
              }
            ]
          }
        }
      }
    }
  ]
}

OpenAPI

POST /api/policy
openapi: 3.1.0
info:
  title: Barndoor Platform API
  version: 1.0.0
  description: >
    REST API for the Barndoor Platform - manage MCP servers, OAuth connections,
    and proxy MCP requests.

## Authentication

All endpoints require a JWT Bearer token obtained through Barndoor's

OAuth 2.0 authorization-code flow with PKCE. The SDK handles the OAuth

flow automatically using interactive login.

## MCP Integration

The `/mcp/{mcp_server_name}` endpoints provide streaming proxy access to
    third-party MCP servers

(Salesforce, Notion, Slack, etc.) with automatic authentication and session
    management.
  contact:
    name: Barndoor Support
    url: https://barndoor.ai
servers:
  - url: https://{organization_id}.platform.barndoor.ai
    description: Trial (Production)
    variables:
      organization_id:
        description: Your organization identifier
        default: your-org
  - url: https://{organization_id}.platform.barndoor.ai
    description: Enterprise (Production)
    variables:
      organization_id:
        description: Your organization identifier
        default: your-org
  - url: https://{organization_id}.platform.barndooruat.com
    description: Enterprise (Production)
    variables:
      organization_id:
        description: Your organization identifier
        default: your-org
  - url: https://{organization_id}.platform.barndoordev.com
    description: Enterprise (Production)
    variables:
      organization_id:
        description: Your organization identifier
        default: your-org
security:
  - BearerAuth: []
tags:
  - name: Servers
    description: Manage MCP server instances
  - name: Connections
    description: Manage OAuth connections to MCP servers
  - name: Policies
    description: Manage access control policies for agents and servers
  - name: Agents
    description: Manage AI agent registrations
  - name: MCP Proxy
    description: Proxy requests to MCP servers
  - name: Identity
    description: Retrieve identity information for the authenticated user
paths:
  /api/policy:
    post:
      summary: Publish  Policy
      operationId: publish_cerbos_policy_admin_policy_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
components:
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >
        JWT token obtained through Barndoor's OAuth 2.0 authorization-code

flow with PKCE.

The token should be included in the Authorization header:

`Authorization: Bearer <your-jwt-token>`

Use the Barndoor SDK's `loginInteractive()` function to obtain tokens
        automatically.
    HTTPBearer:
      type: http
      scheme: bearer
```