Skip to main content
POST
Create a control rule

Authorizations

Authorization
string
header
required

Management API authentication. Pass an op-mak-… management token as a Bearer token. Runtime op-… API keys are rejected with 403 — they belong on the data-plane endpoints. Mint a management key from the platform UI under Settings → API keys.

Body

application/json
config
object
required

The rule's configuration; shape depends on kind (see ManagementControlRule.config).

enabled
boolean
required

Whether the rule is enforced.

id
string
required

Client-chosen rule id (a UUID). Must be unique in the organization.

kind
enum<string>
required

What the rule does: guard (input/output checks); observe (LLM-judge scoring); route (default model; cache; pool order); comply (model allowlist; retention; budget; zero data retention).

Available options:
guard,
observe,
route,
comply
scope
object
required

Where the rule applies: the whole organization (type org); a set of projects (type projects + project_uuids); a set of functions (type functions + function_uuids).

confirm_file_deletion
boolean

Acknowledges that a zero-day retention rule (comply.zdr or comply.retention with retention_days 0) permanently deletes every stored file in scope. Required when the scope holds files; the refusal is a 409 carrying file_count.

name
string

Display name.

schema_version
integer

How the runtime reads config. Omit for the current default; a version this deployment cannot decode is refused.

Response

Successful response

data
object
meta
object

Empty for a single resource. Endpoint-specific context appears here rather than as a sibling of data.