Skip to main content
POST
Create

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Authorization
string
header
required

This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.

Body

application/json

The SessionPolicyServiceCreateRequest message.

displayName
string
required

The displayName field.

accessTokenTtlSeconds
integer<int32>

The accessTokenTtlSeconds field.

continuousDefaultOutcome
Policy Outcome · object | null

PolicyOutcome is the effect of a matched rule. Exactly one kind is set. For session continuous-evaluation, the meaningful kinds are Allow (continue), Deny (terminate), and StepUpRequired.

This message contains a oneof named kind. Only a single field of the following list may be set at a time:

  • allow
  • deny
  • stepUpRequired
  • challengeRequired
  • enrollmentRequired
continuousRules
Policy Rule · object[] | null

The continuousRules field.

credentialDurations
Per Credential Duration · object[] | null

The credentialDurations field.

idleTimeoutSeconds
integer<int32>

The idleTimeoutSeconds field.

maxSessionDurationSeconds
integer<int32>

The maxSessionDurationSeconds field.

persistence
enum<string>

The persistence field.

Available options:
PERSISTENCE_MODE_UNSPECIFIED,
PERSISTENCE_MODE_ALLOW_USER_CHOICE,
PERSISTENCE_MODE_ALWAYS_PERSIST,
PERSISTENCE_MODE_SESSION_ONLY
priority
integer<int32>

The priority field.

refreshRotationWindowSeconds
integer<int32>

The refreshRotationWindowSeconds field.

refreshTokenTtlSeconds
integer<int32>

The refreshTokenTtlSeconds field.

rotateRefreshOnUse
boolean

The rotateRefreshOnUse field.

ssfReceive
Ssf Receiver Config · object | null

SSFReceiverConfig selects which inbound shared-signals streams this session trusts. Each stream's issuer, keys, expected audience, and per-event actions are configured on the stream itself; this policy just lists the stream IDs.

ssfTransmit
Ssf Transmitter Config · object | null

SSFTransmitterConfig selects which outbound shared-signals streams this session emits security events to. Each stream's delivery endpoint, authentication, and per-event allowlist are configured on the stream itself; this policy just lists the stream IDs and the event types to emit.

Response

200 - application/json

Successful response

The SessionPolicyServiceCreateResponse message.

sessionPolicy
Session Policy · object | null

SessionPolicy defines session lifetime and continuous-evaluation behavior.