> ## Documentation Index > Fetch the complete documentation index at: https://ona.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Create Security Policy > Creates a new security policy. `Unary` ยท [`Security`](/docs/api-reference/generated/security/overview) Creates a new security policy. Use this method to: * Define environment access controls * Configure audited or blocked operations * Manage organization security posture ### Examples * Create security policy: Creates an audit-first Veto Exec policy with one audited bare name and one blocked absolute path. Creation stores an inactive definition; assigning it as the organization default validates materializability. ```yaml theme={null} organizationId: "b0e12f6c-4c67-429d-a4a6-d9838b5da047" metadata: name: "Veto Exec audit-first" spec: executables: defaultEffect: EFFECT_ALLOW rules: - path: "npx" effect: EFFECT_AUDIT - path: "/usr/bin/curl" effect: EFFECT_BLOCK ``` ## Endpoint ```text theme={null} POST /api/gitpod.v1.SecurityService/CreateSecurityPolicy ``` Send a Bearer token as described in [Authentication](/docs/api-reference#authenticate-requests). If your organization uses a custom management-plane domain, replace `https://app.ona.com` with that domain. ## Request example ```bash cURL theme={null} export ONA_HOST=https://app.ona.com export ONA_API_KEY= curl --request POST \ --url "$ONA_HOST/api/gitpod.v1.SecurityService/CreateSecurityPolicy" \ --header "Authorization: Bearer $ONA_API_KEY" \ --header "Content-Type: application/json" \ --data '{ "metadata": { "name": "" }, "spec": { "ports": { "maxAdmissionLevel": "ADMISSION_LEVEL_OWNER_ONLY" } } }' ``` ```python Python theme={null} import gitpod.v1.environment_pb2 as environment_pb2 import gitpod.v1.security_pb2 as security_pb2 from ona_sdk import create_client_from_env ona = create_client_from_env() request = security_pb2.CreateSecurityPolicyRequest( metadata=security_pb2.SecurityPolicy.Metadata( name="", ), spec=security_pb2.SecurityPolicy.Spec( ports=security_pb2.SecurityPolicy.Spec.PortPolicy( max_admission_level=environment_pb2.ADMISSION_LEVEL_OWNER_ONLY, ), ), ) response = ona.services.security.create_security_policy(request) print(response) ``` ```typescript TypeScript theme={null} import { create } from "@bufbuild/protobuf"; import { createClientFromEnv } from "@gitpod/sdk"; import { AdmissionLevel } from "@gitpod/sdk/gitpod/v1/environment_pb"; import { CreateSecurityPolicyRequestSchema } from "@gitpod/sdk/gitpod/v1/security_pb"; async function main() { const ona = createClientFromEnv(); const request = create(CreateSecurityPolicyRequestSchema, { metadata: { name: "", }, spec: { ports: { maxAdmissionLevel: AdmissionLevel.OWNER_ONLY, }, }, }); const response = await ona.services.security.createSecurityPolicy(request); console.log(response); } main().catch(console.error); ``` ```go Go theme={null} package main import ( "context" "fmt" "log" "connectrpc.com/connect" "github.com/gitpod-io/gitpod-sdk-go/sdk" gitpodpb "github.com/gitpod-io/gitpod-sdk-go/v1" ) func main() { ona, err := sdk.NewFromEnv() if err != nil { log.Fatal(err) } request := connect.NewRequest(&gitpodpb.CreateSecurityPolicyRequest{ Metadata: &gitpodpb.SecurityPolicy_Metadata{ Name: "", }, Spec: &gitpodpb.SecurityPolicy_Spec{ Ports: &gitpodpb.SecurityPolicy_Spec_PortPolicy{ MaxAdmissionLevel: gitpodpb.AdmissionLevel_ADMISSION_LEVEL_OWNER_ONLY, }, }, }) response, err := ona.Services.Security.CreateSecurityPolicy(context.Background(), request) if err != nil { log.Fatal(err) } fmt.Println(response.Msg) } ``` ```json Request body theme={null} { "metadata": { "name": "" }, "spec": { "ports": { "maxAdmissionLevel": "ADMISSION_LEVEL_OWNER_ONLY" } } } ``` ## Request `gitpod.v1.CreateSecurityPolicyRequest` | Field | Type | Required | Description | | ---------------- | ---------------------------------------------------- | -------- | -------------------------------- | | `organizationId` | string | No | Constraints: `string.uuid=true`. | | `metadata` | [Metadata](#type-gitpod-v1-security-policy-metadata) | Yes | Constraints: `required=true`. | | `spec` | [Spec](#type-gitpod-v1-security-policy-spec) | Yes | Constraints: `required=true`. | ## Response `gitpod.v1.CreateSecurityPolicyResponse` | Field | Type | Required | Description | | ---------------- | ------------------------------------------------- | -------- | ----------------------------- | | `securityPolicy` | [SecurityPolicy](#type-gitpod-v1-security-policy) | Yes | Constraints: `required=true`. | ## Related types `gitpod.v1.SecurityPolicy` | Field | Type | Required | Description | | ---------------- | ---------------------------------------------------- | -------- | -------------------------------- | | `id` | string | No | Constraints: `string.uuid=true`. | | `metadata` | [Metadata](#type-gitpod-v1-security-policy-metadata) | Yes | Constraints: `required=true`. | | `spec` | [Spec](#type-gitpod-v1-security-policy-spec) | Yes | Constraints: `required=true`. | | `organizationId` | string | No | Constraints: `string.uuid=true`. | | `createdAt` | RFC 3339 timestamp | No | | | `updatedAt` | RFC 3339 timestamp | No | | `gitpod.v1.SecurityPolicy.Metadata` | Field | Type | Required | Description | | ------ | ------ | -------- | --------------------------------------------------- | | `name` | string | No | Constraints: `string.max_len=80, string.min_len=1`. | `gitpod.v1.SecurityPolicy.Spec` | Field | Type | Required | Description | | ------------- | -------------------------------------------------------------------------- | -------- | ------------------------------------------------------ | | `ports` | [PortPolicy](#type-gitpod-v1-security-policy-spec-port-policy) | No | | | `executables` | [ExecutablePolicy](#type-gitpod-v1-security-policy-spec-executable-policy) | No | executables is the public Veto Exec GA policy surface. | `gitpod.v1.SecurityPolicy.Spec.ExecutablePolicy` | Field | Type | Required | Description | | --------------- | ------------------------------------------------ | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `defaultEffect` | [Effect](#enum-gitpod-v1-security-policy-effect) | No | default\_effect controls executables that do not match a rule. For Veto Exec, omit this field or set it to EFFECT\_ALLOW. EFFECT\_UNSPECIFIED is normalized to EFFECT\_ALLOW. | | `rules` | array of Rule | No | rules contains executable-specific audit or block decisions. | `gitpod.v1.SecurityPolicy.Spec.PortPolicy` | Field | Type | Required | Description | | ------------------- | ------------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `maxAdmissionLevel` | [AdmissionLevel](#enum-gitpod-v1-admission-level) | No | max\_admission\_level caps the maximum admission level for user-opened ports in environments assigned this security policy. UNSPECIFIED applies no additional cap. | Admission level describes who can access an environment instance and its ports. | Value | Number | Description | | ------------------------------ | -----: | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `ADMISSION_LEVEL_UNSPECIFIED` | 0 | | | `ADMISSION_LEVEL_OWNER_ONLY` | 1 | **Deprecated.** ADMISSION\_LEVEL\_OWNER\_ONLY means the environment can only be accessed by the creator. Deprecated: Use ADMISSION\_LEVEL\_CREATOR\_ONLY instead. | | `ADMISSION_LEVEL_EVERYONE` | 2 | ADMISSION\_LEVEL\_EVERYONE means the environment (including ports) can be accessed by everyone. | | `ADMISSION_LEVEL_ORGANIZATION` | 3 | ADMISSION\_LEVEL\_ORGANIZATION means the environment (including ports) can be accessed by all members of the organization. | | `ADMISSION_LEVEL_CREATOR_ONLY` | 4 | ADMISSION\_LEVEL\_CREATOR\_ONLY means the environment (including ports) can only be accessed by the user who created the environment. | | Value | Number | Description | | -------------------- | -----: | ----------- | | `EFFECT_UNSPECIFIED` | 0 | | | `EFFECT_ALLOW` | 1 | | | `EFFECT_BLOCK` | 2 | | | `EFFECT_AUDIT` | 3 | |