Skip to main content
POST
Create

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Authorization
string
header
required

This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.

Body

application/json

The CredentialInventoryPolicyServiceCreateRequest message.

displayName
string
required

A human-readable name for the policy.

delegated
Delegated Constraints · object | null

DelegatedConstraints controls which third-party sign-in providers are accepted as proof of email ownership, and how they are scoped.

emailOtp
Email Otp Constraints · object | null

EmailOTPConstraints configures one-time codes delivered by email.

enabledTypes
enum<string>[] | null

The credential types users are permitted to enroll under this policy.

Available options:
CREDENTIAL_TYPE_UNSPECIFIED,
CREDENTIAL_TYPE_PASSKEY,
CREDENTIAL_TYPE_PASSWORD,
CREDENTIAL_TYPE_TOTP,
CREDENTIAL_TYPE_EMAIL_OTP,
CREDENTIAL_TYPE_RECOVERY_CODE,
CREDENTIAL_TYPE_DELEGATED_GOOGLE,
CREDENTIAL_TYPE_DELEGATED_MICROSOFT,
CREDENTIAL_TYPE_UPSTREAM_IDP
passkey
Passkey Constraints · object | null

PasskeyConstraints controls how users may enroll passkeys (FIDO2 / WebAuthn).

password
Password Constraints · object | null

PasswordConstraints sets the complexity rules a user's password must satisfy.

priority
integer<int32>

When a user matches more than one policy, the policy with the highest priority applies.

totp
Totp Constraints · object | null

TOTPConstraints configures authenticator-app one-time codes (RFC 6238).

Response

200 - application/json

Successful response

The CredentialInventoryPolicyServiceCreateResponse message.

credentialInventoryPolicy
Credential Inventory Policy · object | null

CredentialInventoryPolicy defines which credential types your users may enroll and the rules for each type.