> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opper.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a control rule

> Creates a rule and enforces it from the next request. The client picks the id. A comply rule that turns its scope zero-day while files are stored there is refused with a 409 until `confirm_file_deletion` is sent. Requires the `controls:write` scope.



## OpenAPI

````yaml post /management/v1/controls/rules
openapi: 3.1.0
info:
  description: Schema-driven generative API that orchestrates LLM-powered workflows.
  title: Task API
  version: 3.0.0
servers:
  - description: Production
    url: https://api.opper.ai
  - description: Local development
    url: http://localhost:8080
security:
  - BearerAuth: []
tags:
  - description: Schema-driven function management and execution
    name: Functions
  - description: OpenAI-compatible chat completions
    name: Chat
  - description: OpenAI Responses API compatible endpoint
    name: Responses
  - description: Google-compatible interactions endpoint
    name: Interactions
  - description: Model registry and capabilities
    name: Models
  - description: Synchronous image generation
    name: Images
  - description: Text-to-speech and speech-to-text
    name: Audio
  - description: Asynchronous video generation
    name: Videos
  - description: Reusable file storage for media inputs and generated outputs
    name: Files
  - description: Async generation status and downloads
    name: Artifacts
  - description: OpenAI-compatible embeddings
    name: Embeddings
  - description: Recorded HTTP request/response generations
    name: Generations
  - description: System health and status
    name: System
  - description: Roundtable endpoint — fan out a query to multiple LLMs and combine results
    name: Roundtable
  - description: Web search, fetch, and other utility tools
    name: Tools
  - description: Caller identity, credits, and usage
    name: Account
  - description: >-
      Programmatic project and API-key management. Authenticates with an
      `op-mak-…` management token; available on the control_plane and enterprise
      plans.
    name: Management
paths:
  /management/v1/controls/rules:
    post:
      tags:
        - Management
      summary: Create a control rule
      description: >-
        Creates a rule and enforces it from the next request. The client picks
        the id. A comply rule that turns its scope zero-day while files are
        stored there is refused with a 409 until `confirm_file_deletion` is
        sent. Requires the `controls:write` scope.
      operationId: createManagementControlRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ManagementControlRuleCreateRequest'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                properties:
                  data:
                    $ref: '#/components/schemas/ManagementControlRule'
                  meta:
                    description: >-
                      Empty for a single resource. Endpoint-specific context
                      appears here rather than as a sibling of `data`.
                    type: object
                type: object
          description: Successful response
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Bad request
        '401':
          description: Unauthorized - missing or invalid API key
        '403':
          content:
            application/json:
              schema:
                properties:
                  allowed_plans:
                    description: Present on the plan-gate refusal.
                    items:
                      type: string
                    type: array
                  current_plan:
                    description: Present on the plan-gate refusal.
                    type: string
                  error:
                    type: string
                  required_scope:
                    description: Present on the scope refusal.
                    type: string
                type: object
          description: >-
            Either the organization's plan does not include the Management API
            (`current_plan` / `allowed_plans` are returned), or the token lacks
            the scope this endpoint requires (`required_scope` is returned).
            Presenting a runtime `op-…` key instead of a management `op-mak-…`
            token also lands here.
        '409':
          content:
            application/json:
              schema:
                properties:
                  code:
                    description: Present on the file-deletion refusal.
                    type: string
                  error:
                    type: string
                  file_count:
                    description: Present on the file-deletion refusal.
                    type: integer
                type: object
          description: >-
            Either a rule with this id already exists, a concurrent update
            changed the rule (re-read and retry), or the write would make the
            scope zero-day while it still holds stored files: `code` is
            `zdr_file_deletion_confirmation_required` and `file_count` says how
            many; resend with `confirm_file_deletion: true` to proceed.
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Internal server error
      security:
        - ManagementBearer: []
components:
  schemas:
    ManagementControlRuleCreateRequest:
      properties:
        config:
          description: >-
            The rule's configuration; shape depends on kind (see
            ManagementControlRule.config).
          type: object
        confirm_file_deletion:
          description: >-
            Acknowledges that a zero-day retention rule (comply.zdr or
            comply.retention with retention_days 0) permanently deletes every
            stored file in scope. Required when the scope holds files; the
            refusal is a 409 carrying file_count.
          type: boolean
        enabled:
          description: Whether the rule is enforced.
          type: boolean
        id:
          description: Client-chosen rule id (a UUID). Must be unique in the organization.
          type: string
        kind:
          description: >-
            What the rule does: guard (input/output checks); observe (LLM-judge
            scoring); route (default model; cache; pool order); comply (model
            allowlist; retention; budget; zero data retention).
          enum:
            - guard
            - observe
            - route
            - comply
          type: string
        name:
          description: Display name.
          type: string
        schema_version:
          description: >-
            How the runtime reads config. Omit for the current default; a
            version this deployment cannot decode is refused.
          type: integer
        scope:
          description: >-
            Where the rule applies: the whole organization (type org); a set of
            projects (type projects + project_uuids); a set of functions (type
            functions + function_uuids).
          properties:
            function_uuids:
              items:
                type: string
              type: array
            project_uuids:
              items:
                type: string
              type: array
            type:
              type: string
          required:
            - type
          type: object
      required:
        - id
        - kind
        - enabled
        - scope
        - config
      type: object
    ManagementControlRule:
      properties:
        allowed_model_ids:
          items:
            type: string
          type: array
        config:
          description: >-
            The rule's configuration; its shape depends on kind. comply and
            route rules carry a type discriminator (comply: allowlist |
            retention | budget | zdr; route: cache | pool_order | absent for a
            default-model rule); guard and observe rules carry their
            configuration inline.
          type: object
        confirm_file_deletion:
          type: boolean
        created_at:
          format: date-time
          type: string
        effective_count:
          type: integer
        enabled:
          type: boolean
        id:
          type: string
        kind:
          type: string
        name:
          type: string
        parent_allowlist:
          properties:
            countries:
              items:
                type: string
              type: array
            deny_all:
              type: boolean
            exclude_providers:
              items:
                type: string
              type: array
            exclude_service_routes:
              items:
                type: string
              type: array
            handling:
              properties:
                cache_scopes:
                  items:
                    type: string
                  type: array
                caching:
                  items:
                    type: string
                  type: array
                human_review:
                  items:
                    type: string
                  type: array
                logging:
                  items:
                    type: string
                  type: array
                max_retention_days:
                  type: integer
                moderation:
                  items:
                    type: string
                  type: array
                subprocessors_read_content:
                  type: boolean
                training:
                  items:
                    type: string
                  type: array
              type: object
            maker:
              properties:
                jurisdiction:
                  items:
                    type: string
                  type: array
                name:
                  items:
                    type: string
                  type: array
              type: object
            models:
              items:
                type: string
              type: array
            provider:
              properties:
                locations:
                  properties:
                    inference:
                      properties:
                        exclude:
                          items:
                            type: string
                          type: array
                        include:
                          items:
                            type: string
                          type: array
                      type: object
                    jurisdiction:
                      properties:
                        exclude:
                          items:
                            type: string
                          type: array
                        include:
                          items:
                            type: string
                          type: array
                      type: object
                    storage:
                      properties:
                        exclude:
                          items:
                            type: string
                          type: array
                        include:
                          items:
                            type: string
                          type: array
                      type: object
                  required:
                    - inference
                    - storage
                    - jurisdiction
                  type: object
                name:
                  properties:
                    exclude:
                      items:
                        type: string
                      type: array
                    include:
                      items:
                        type: string
                      type: array
                  type: object
                route:
                  properties:
                    exclude:
                      items:
                        type: string
                      type: array
                    include:
                      items:
                        type: string
                      type: array
                  type: object
              required:
                - name
                - route
                - locations
              type: object
            providers:
              items:
                type: string
              type: array
            regions:
              items:
                type: string
              type: array
            service_routes:
              items:
                type: string
              type: array
          required:
            - providers
            - regions
            - countries
            - models
            - provider
            - maker
            - handling
          type: object
        schema_version:
          type: integer
        scope:
          properties:
            function_uuids:
              items:
                type: string
              type: array
            project_uuids:
              items:
                type: string
              type: array
            type:
              type: string
          required:
            - type
          type: object
        updated_at:
          format: date-time
          type: string
      required:
        - id
        - kind
        - enabled
        - scope
        - schema_version
        - config
        - created_at
        - updated_at
      type: object
    ErrorResponse:
      properties:
        error:
          properties:
            code:
              type: string
            details:
              description: Any value
            message:
              type: string
          required:
            - code
            - message
          type: object
        meta:
          type: object
      required:
        - error
      type: object
  securitySchemes:
    BearerAuth:
      bearerFormat: API Key
      description: API key authentication. Pass your API key as a Bearer token.
      scheme: bearer
      type: http
    ManagementBearer:
      bearerFormat: Management API Key
      description: >-
        Management API authentication. Pass an `op-mak-…` management token as a
        Bearer token. Runtime `op-…` API keys are rejected with 403 — they
        belong on the data-plane endpoints. Mint a management key from the
        platform UI under Settings → API keys.
      scheme: bearer
      type: http

````