PolicyService
Create API Key Policy
Create a new API key policy template for the caller account or workspace.
Request
curl --request POST \ \
--url 'https://api.testnet.polyester.com/v1/auth/policies/api-keys' \
--header 'Accept: */*' \
--header 'X-API-KEY-ID: YOUR_API_KEY_ID' \
--header 'X-API-TIMESTAMP: YOUR_API_TIMESTAMP' \
--header 'X-API-SIGNATURE: YOUR_API_SIGNATURE' \
--header 'Content-Type: application/json' \
--data '{
"assignToKeyId": "ak_1a3c6de8153d5a5b04cd2a6529779542",
"policy": {
"actions": [
"TRADE_SPOT"
],
"description": "Example configuration for the API playground.",
"isTemplate": false,
"name": "value",
"spotMarketScope": "ALL",
"spotMarkets": [
{
"symbolId": 1
}
]
}
}'Responses
{
"policy": {
"actions": [
"TRADE_SPOT"
],
"createdAt": "2025-01-01T00:00:00Z",
"description": "Allow market and account data reads.",
"id": "7gQY8okwBT",
"isTemplate": false,
"name": "Read-Only Analytics",
"revision": "1",
"sourceTemplateId": "8gnKtjkL5A",
"spotMarketScope": "ALL",
"spotMarkets": [
{
"symbolId": 1
}
],
"updatedAt": "2025-01-01T00:00:00Z"
}
}Optional API key identifier to bind this newly-created policy to atomically. When set, the caller must be allowed to manage the key and the create+assign operation consumes a single fresh step-up proof.
High-level actions enabled for the API key policy. An empty list grants no access. Up to 64 unique explicit actions are allowed.
Optional policy description for dashboards and audits. Maximum 256 characters.
Whether this policy should be treated as a reusable template.
Human-readable policy name. Create requires a non-empty value; update validates it after merging fields selected by update_mask.
Market-level scope for spot markets. When unspecified, defaults to ALL.
Allowed spot markets for this API key policy.
Policy identifier (opaque ID).
7gQY8okwBTHuman-readable policy name.
Read-Only AnalyticsOptional policy description for dashboards and audits.
Allow market and account data reads.Stable numeric pair ID.
1High-level actions enabled for this API key. Up to 64 unique explicit actions may be returned.
["TRADE_SPOT"]Market-level scope for spot markets. When ALL, spot_markets is returned for display only and is not enforced.
ALLWhen true, this policy is intended to be reused as a template across multiple API keys. When false, it represents a single-key instance.
falseOptional source template this policy was copied from (opaque ID). This is audit metadata only and does not imply live linkage.
8gnKtjkL5ACreation time in UTC.
2025-01-01T00:00:00ZLast update time in UTC.
2025-01-01T00:00:00ZMonotonic resource revision used for conditional updates.
1| Key | HTTP status | Connect code | Error | When |
|---|---|---|---|---|
| unauthenticated | 401 | unauthenticated | Unauthenticated | Authentication required. |
| permission-denied | 403 | permission_denied | Permission Denied | Permission denied. |
| invalid-argument | 400 | invalid_argument | Invalid Argument | Invalid argument. |
| not-found | 404 | not_found | Not Found | Not found. |
| unavailable | 503 | unavailable | Unavailable | Service unavailable. |