# Add a credential policy

`POST https://api.cademi.com.br/api/v3/credentials/{credential_id}/policies`

Operation ID: `credentials.policies.create` · API v3

Adds a policy to a credential. The change publishes a new policy revision containing the existing policies plus the new one.

Permissions listed in `capabilities` that the calling credential cannot delegate, including the non-delegable `credentials.*` and `administrators.*` permissions, are rejected with `delegation_limit_exceeded`, and no new revision is published.

A credential cannot modify its own policies.

Required permissions: `credentials.policies.manage`.

## Parameters

| Name | In | Type | Required | Description |
|---|---|---|---|---|
| `credential_id` | path | string | yes |  |
| `Idempotency-Key` | header | string | yes |  |

## Request body

Content type: `application/json`, required.

| Field | Type | Required | Description |
|---|---|---|---|
| `capabilities` | array of string | yes |  |
| `resources` | array of object | yes |  |

## Responses

### 201

Returns the newly created policy as part of the published revision.

Body: `data`: Policy.

Fields of Policy:

| Field | Type | Required | Description |
|---|---|---|---|
| `capabilities` | array of string | yes |  |
| `id` | string | yes |  |
| `object` | string, one of `policy` | yes |  |
| `published_at` | string or null (date-time) | yes |  |
| `published_by` | object | yes |  |
| `resources` | array of object | yes |  |
| `version` | integer | yes |  |

### 401

The credential is missing, malformed, expired, or revoked.

Body: Error.

### 403

The current credentials do not have the permission required by this operation.

Body: Error.

### 404

The credential was not found or is not accessible with the current credentials.

Body: Error.

### 422

The request body or query parameters failed validation.

Body: ValidationFailed.

Full schema: https://cademi.dev/openapi/v3.json