> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mandate.md/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a new policy

> Creates a new active policy for the agent. The previous active policy is automatically deactivated. Fields not provided are carried forward from the previous policy.



## OpenAPI

````yaml /openapi.json post /api/agents/{agentId}/policies
openapi: 3.1.0
info:
  title: Mandate API
  version: 1.2.0
  description: >-
    Non-custodial agent wallet policy layer. Enforces spend limits, allowlists,
    and approval workflows for AI agent transactions without ever receiving
    private keys.
  contact:
    name: Mandate
    url: https://mandate.md
    email: support@mandate.md
  license:
    name: MIT
    url: https://opensource.org/licenses/MIT
servers:
  - url: https://app.mandate.md
    description: Production
security: []
tags:
  - name: Registration
    description: >-
      Agent registration and claiming. No auth required for register; Sanctum
      auth for claim.
  - name: Agent API
    description: >-
      Endpoints authenticated with a runtime key (Bearer mndt_live_... or
      mndt_test_...). Used by agents to validate transactions, post events, and
      poll status.
  - name: Intent Lifecycle
    description: >-
      Post transaction hashes after broadcast and poll intent status until
      confirmed.
  - name: Dashboard
    description: >-
      Dashboard endpoints for human operators. Authenticated via Sanctum
      (cookie-based session).
  - name: Policies
    description: >-
      Policy management for agents. List, create, and view policy
      configurations.
  - name: Approvals
    description: Approval queue for transactions that require human review.
paths:
  /api/agents/{agentId}/policies:
    post:
      tags:
        - Policies
      summary: Create a new policy
      description: >-
        Creates a new active policy for the agent. The previous active policy is
        automatically deactivated. Fields not provided are carried forward from
        the previous policy.
      operationId: createPolicy
      parameters:
        - name: agentId
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreatePolicyRequest'
            example:
              spendLimitPerTxUsd: 200
              spendLimitPerDayUsd: 2000
              spendLimitPerMonthUsd: 10000
              allowedAddresses:
                - '0x71C7656EC7ab88b098defB751B7401B5f6d8976F'
              requireApprovalAboveUsd: 500
              blockedActions:
                - bridge
      responses:
        '201':
          description: Policy created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Policy'
        '404':
          description: Agent not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '422':
          description: Validation error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'
      security:
        - SanctumAuth: []
components:
  schemas:
    CreatePolicyRequest:
      type: object
      properties:
        spendLimitPerTxUsd:
          type:
            - number
            - 'null'
          minimum: 0
          description: Max USD per transaction.
        spendLimitPerDayUsd:
          type:
            - number
            - 'null'
          minimum: 0
          description: Max USD per day.
        spendLimitPerMonthUsd:
          type:
            - number
            - 'null'
          minimum: 0
          description: Max USD per month.
        allowedAddresses:
          type:
            - array
            - 'null'
          items:
            type: string
          description: >-
            Allowlist of recipient addresses. If set, only these addresses are
            permitted.
        allowedContracts:
          type:
            - array
            - 'null'
          items:
            type: string
          description: Allowlist of contract addresses.
        blockedSelectors:
          type:
            - array
            - 'null'
          items:
            type: string
          description: Blocked EVM function selectors (e.g. "0xa9059cbb").
        blockedActions:
          type:
            - array
            - 'null'
          items:
            type: string
          description: Blocked action types (e.g. ["bridge", "bet"]).
        requireApprovalSelectors:
          type:
            - array
            - 'null'
          items:
            type: string
          description: EVM selectors that require human approval.
        requireApprovalActions:
          type:
            - array
            - 'null'
          items:
            type: string
          description: Action types that require human approval.
        requireApprovalAboveUsd:
          type:
            - number
            - 'null'
          minimum: 0
          description: USD threshold above which approval is required.
        maxSlippageBps:
          type:
            - integer
            - 'null'
          minimum: 0
          description: Max slippage in basis points.
        maxGasLimit:
          type:
            - string
            - 'null'
          description: Max gas limit per transaction.
        maxValueWei:
          type:
            - string
            - 'null'
          description: Max native token value in wei.
        schedule:
          type:
            - object
            - 'null'
          description: Time-based schedule restrictions (days/hours).
        guardRules:
          type:
            - string
            - 'null'
          maxLength: 10000
          description: Custom guard rules in natural language (mandate.md format).
    Policy:
      type: object
      properties:
        id:
          type: string
          format: uuid
        agent_id:
          type: string
          format: uuid
        spend_limit_per_tx_usd:
          type:
            - number
            - 'null'
        spend_limit_per_day_usd:
          type:
            - number
            - 'null'
        spend_limit_per_month_usd:
          type:
            - number
            - 'null'
        allowed_addresses:
          type:
            - array
            - 'null'
          items:
            type: string
        allowed_contracts:
          type:
            - array
            - 'null'
          items:
            type: string
        blocked_selectors:
          type:
            - array
            - 'null'
          items:
            type: string
        blocked_actions:
          type:
            - array
            - 'null'
          items:
            type: string
        require_approval_selectors:
          type:
            - array
            - 'null'
          items:
            type: string
        require_approval_actions:
          type:
            - array
            - 'null'
          items:
            type: string
        require_approval_above_usd:
          type:
            - number
            - 'null'
        max_slippage_bps:
          type:
            - integer
            - 'null'
        max_gas_limit:
          type:
            - string
            - 'null'
        max_value_wei:
          type:
            - string
            - 'null'
        schedule:
          type:
            - object
            - 'null'
        guard_rules:
          type:
            - string
            - 'null'
        is_active:
          type: boolean
        version:
          type: integer
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
    ErrorResponse:
      type: object
      required:
        - error
      properties:
        error:
          type: string
          description: Human-readable error message.
    ValidationError:
      type: object
      required:
        - message
        - errors
      properties:
        message:
          type: string
          description: Summary error message.
        errors:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
          description: Per-field validation errors.
  securitySchemes:
    SanctumAuth:
      type: apiKey
      in: cookie
      name: laravel_session
      description: >-
        Laravel Sanctum cookie-based session authentication. Obtained via GitHub
        OAuth login on the dashboard.

````