> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quantumapi.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Policies

> Create, read, update, and delete policy rule sets attached to vaults.

Policies enforce constraints on transactions before they leave Qustody. Each policy is attached to a vault and consists of one or more rules. See [Policies concepts](/concepts/policies) for the full rule reference.

All endpoints require an authenticated principal with the `policies:create`, `policies:read`, `policies:update`, or `policies:delete` permission as appropriate.

## Create policy

```http theme={null}
POST /v1/policies
```

```bash theme={null}
curl -X POST https://api.qustody.io/v1/policies \
  -H "Authorization: Bearer $QUSTODY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "vault_id": "vault_01HXYZ...",
    "name": "treasury-default",
    "rules": [
      {"type": "MAX_AMOUNT", "value": "100000000000000000000"},
      {"type": "REQUIRE_APPROVAL", "value": "2"},
      {"type": "WHITELIST_ADDRESS", "addresses": ["0xabc..."]}
    ]
  }'
```

**Response 201**

```json theme={null}
{
  "id": "pol_01HXYZ...",
  "vault_id": "vault_01HXYZ...",
  "name": "treasury-default",
  "rules": [...],
  "created_at": "2026-04-27T10:15:00Z"
}
```

## List policies

```http theme={null}
GET /v1/policies?vault_id={id}&page=1&per_page=50
```

Returns the policies visible to the caller's tenant. Filterable by `vault_id`.

## Get policy

```http theme={null}
GET /v1/policies/{id}
```

## Update policy

```http theme={null}
PUT /v1/policies/{id}
```

Replaces the rule set in full. Existing transactions in flight are not re-evaluated; future submissions use the new policy.

## Delete policy

```http theme={null}
DELETE /v1/policies/{id}
```

A vault without a policy accepts any transaction subject to RBAC. Production deployments should keep at least one policy attached.

## Errors

| Code | Type              | When                                           |
| ---- | ----------------- | ---------------------------------------------- |
| 1100 | `VALIDATION`      | Invalid rule shape or unknown `type`           |
| 1200 | `POLICY_DENIED`   | Returned by the transaction endpoint, not here |
| 1400 | `VAULT_NOT_FOUND` | `vault_id` does not exist in tenant            |

See the full [error catalog](/reference/error-codes).