Skip to main content
Use this endpoint to define a new policy rule for your tenant. Policy rules act as guardrails for agent-originated transactions — you can restrict the maximum transaction amount, limit which tokens or chains an agent may interact with, or lock an agent to specific debit and credit accounts. Rules can be scoped to a subset of agents using a key prefix, giving you fine-grained control over each agent’s permissions.

​
Endpoint

​
Authorization

Requires an API key with ADMIN scope.

​
Request Body

​
string
required
The rule type that determines how this policy is evaluated. One of: MAX_DEBIT_PER_SESSION, MAX_DEBIT_PER_HOUR, REQUIRE_HUMAN_APPROVAL_ABOVE, FORBIDDEN_ACCOUNT_PAIR, ALLOWED_TOKENS, ALLOWED_CHAINS. Each type requires a different subset of the fields below — see the table in Policy Rules.
​
string
An optional string prefix used to scope this rule to a specific agent or group of agents. Only API keys whose identifier starts with this prefix will be subject to the rule. If omitted, the rule applies to all agents.
​
string
Required by MAX_DEBIT_PER_SESSION, MAX_DEBIT_PER_HOUR, and REQUIRE_HUMAN_APPROVAL_ABOVE. Provide as a decimal string (for example, "5000.00").
​
string
Required by FORBIDDEN_ACCOUNT_PAIR. The account’s UUID.
​
string
Required by FORBIDDEN_ACCOUNT_PAIR. The account’s UUID.
​
string[]
Required (non-empty) by ALLOWED_TOKENS. Valid values: USDC, USDT, BRZ, PYUSD.
​
string[]
Required (non-empty) by ALLOWED_CHAINS. Valid values: EVM, SOLANA, TRON.

​
Request Example

The following example creates a MAX_DEBIT_PER_SESSION rule that limits any agent with the agent_payments_ key prefix to session debits no greater than 5000.00.

​
Response

​
string
required
Unique identifier (UUID) for the newly created policy rule.
​
string
required
The rule type as provided in the request.
​
string
The agent key prefix the rule is scoped to, if provided.
​
object
required
The resolved parameters object constructed from the fields you supplied (for example, amount, tokens, chains).
​
string (datetime)
required
ISO 8601 timestamp of when the rule was created.

​
Response Example

Start with a narrow agentKeyPrefix and a conservative amount limit when onboarding a new agent. You can delete and recreate rules as your agent’s requirements become clearer.

​
Error Codes