Create a policy
Requires policy:manage. Actions and resources are validated on write,
so a typo cannot silently create a statement that grants nothing;
duplicates within either list are collapsed.
Two further rules apply to what may be written. A caller writing an
allow may not grant an action or resource they do not themselves hold,
and only an administrator may write the * wildcard. A caller writing a
deny may not write one that would leave nobody able to manage policy.
Statements take effect across the cluster at once.
Authorizations
A machine credential, qk_ followed by its secret. Only a hash of the
secret is stored, so a key is displayed exactly once, when it is created
or rotated. A key reaches only the configurations it is linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Body
Trimmed, and may not be empty once trimmed.
1allow, deny The kinds of principal a policy statement or a clearance grant may name.
An audit record may additionally carry anonymous or system.
user, api_key, role Duplicates are collapsed.
1An exact action, a namespace wildcard such as kms:*, or * for
everything. A namespace wildcard must name a namespace that exists, and
only an administrator may write *.
encrypt, decrypt, kms:read, kms:create, kms:update, kms:import, kms:export, kms:rotate, kms:revoke, kms:restore, classification:read, classification:manage, configuration:read, configuration:manage, apikey:manage, user:manage, policy:manage, audit:read, audit:export, audit:purge, kms:*, classification:*, configuration:*, apikey:*, user:*, policy:*, audit:*, * Duplicates are collapsed.
1What the statement applies to. Either *, the bare words audit or
system, or one of the prefixed forms: configuration:<slug>,
key:<uuid>, classification:<slug>, audit:<name> or
system:<name>. Each prefix also takes * in place of the name, so
configuration:* covers every configuration.
Response
Created.
Deny always wins, and the default with no statement at all is to refuse.
allow, deny The kinds of principal a policy statement or a clearance grant may name.
An audit record may additionally carry anonymous or system.
user, api_key, role A user id, an API key id, or a role name, according to
principal_type.
1An exact action, a namespace wildcard such as kms:*, or * for
everything. A namespace wildcard must name a namespace that exists, and
only an administrator may write *.
encrypt, decrypt, kms:read, kms:create, kms:update, kms:import, kms:export, kms:rotate, kms:revoke, kms:restore, classification:read, classification:manage, configuration:read, configuration:manage, apikey:manage, user:manage, policy:manage, audit:read, audit:export, audit:purge, kms:*, classification:*, configuration:*, apikey:*, user:*, policy:*, audit:*, * 1What the statement applies to. Either *, the bare words audit or
system, or one of the prefixed forms: configuration:<slug>,
key:<uuid>, classification:<slug>, audit:<name> or
system:<name>. Each prefix also takes * in place of the name, so
configuration:* covers every configuration.