> ## Documentation Index > Fetch the complete documentation index at: https://docs.dakota.xyz/llms.txt > Use this file to discover all available pages before exploring further. # Add a new rule to a policy > Creates a new rule under the specified policy. ## OpenAPI ````yaml /openapi.yaml post /policies/{policy_id}/rules openapi: 3.0.3 info: title: Dakota Platform API version: 1.0.0 description: >- Combined API specification for Dakota Platform services: - Issuance API: Asset minting and burning operations - Onboarding API: Know Your Business/Customer verification - On/Off Ramp API: Managing on-ramp and off-ramp accounts - Recipients API: Managing destinations for KYB'd entities - Transactions API: Viewing transaction history across platform operations ## Authentication and API Headers All API endpoints require the following headers: - `x-idempotency-key`: Required for all POST endpoints to ensure request idempotency - `x-api-key`: Required for authentication across all endpoints Note: On /applications endpoints you need a token for authentication instead of a x-api-key - `x-application-token`: Required for authentication on public /applications endpoints (alternative to `x-api-key` where documented) ## Rate Limits Requests are rate limited per API key. Every response includes the following headers: | Header | Description | | --- | --- | | `X-RateLimit-Limit` | Maximum requests allowed in the current one-minute window. | | `X-RateLimit-Remaining` | Requests remaining in the current window. | | `X-RateLimit-Reset` | Absolute Unix timestamp (seconds since epoch) when the current rate-limit window resets. | When a request is throttled (`429`), responses also include `Retry-After` with seconds to wait before retrying. servers: - url: https://api.platform.dakota.xyz description: Production environment - url: https://api.platform.sandbox.dakota.xyz description: Sandbox — safe for testing with simulated data security: - ApiKeyAuth: [] tags: - name: Agentic Payments x-alpha: true description: >- Alpha — agent-driven payments: provision agents, draft and approve spending mandates, accept reviewed instructions, and manage scheduled payments. **Prerequisites:** Customer onboarded; signer groups attached for recognition. **Related:** Wallets, Signer Groups, Transactions - name: Mandates x-alpha: true description: >- Alpha — spending mandates: signed, signer-bound authorizations governing what may be spent, approved or cancelled by a second recognized signer (§8 — the dual-control rule that every mandate mutation must be signed by a recognized signer OTHER than the bound one). Independent of agents and scheduled payments. **Prerequisites:** Signer groups attached for recognition. **Related:** Signer Groups, Transactions - name: Insights x-alpha: true description: >- Alpha — read-only account insight: a deterministic report over a customer's agentic activity (funding balances, upcoming obligations, failures, mandate headroom and expiry) plus an advisory chat that narrates it. Never moves money, never creates or changes anything. **Prerequisites:** Customer onboarded; insight is computed from the customer's scheduled payments, mandates, and wallets. **Related:** Agentic Payments, Mandates - name: Customers description: >- Manage customer entities representing businesses and organizations onboarded to Dakota. **Prerequisites:** Complete KYB via Onboarding endpoints before initiating money movement. **Related:** Onboarding, Recipients, Transactions, Accounts, Wallets - name: Wallets description: >- Manage wallets, balances, and wallet-to-signer-group relationships for custody and movement controls. **Prerequisites:** Customer must exist. Configure signer groups before policy-enforced workflows. **Related:** Signer Groups, Policies, Transactions, Customers - name: Transactions description: >- Create, cancel, and retrieve transaction records across account and wallet flows. **Prerequisites:** Accounts or destinations must be configured based on flow type. **Related:** Accounts, Recipients, Policies, Events - name: Recipients description: >- Manage recipient entities and destination rails used by customers for payouts and transfers. **Prerequisites:** Customer must be onboarded and active. **Related:** Customers, Transactions, Accounts, Onboarding - name: Accounts description: >- Manage account resources used for onramp, offramp, and swap operations. **Prerequisites:** Customer must be created and network/asset constraints must be known. **Related:** Customers, Transactions, Auto Transactions, Info - name: Auto Transactions description: >- Manage automated transaction configurations and execution history for account automation workflows. **Prerequisites:** Source account must exist and be configured for automation. **Related:** Accounts, Transactions, Events - name: Onboarding description: >- Manage KYB/KYC onboarding lifecycle, application documents, attestations, and verification steps. **Prerequisites:** Customer context and required entity/application metadata. **Related:** Customers, Exceptions, Recipients, Transactions - name: Policies description: >- Define and manage policy objects and rules used for transaction governance and risk controls. **Prerequisites:** Wallet and signer group resources should be configured for enforcement scenarios. **Related:** Wallets, Signer Groups, Transactions - name: Signer Groups description: >- Manage signer groups and signer assignments for multi-party authorization models. **Prerequisites:** Wallets should exist before linking signer groups. **Related:** Wallets, Policies, Transactions - name: Authentication description: >- Manage API authentication credentials and key lifecycle for platform access. **Prerequisites:** Client organization must be provisioned. **Related:** Users, Info - name: Users description: >- Manage client users, roles, and identity metadata for platform access control. **Prerequisites:** Auth credentials and client context must be established. **Related:** Authentication - name: Webhooks description: >- Manage outbound webhook targets and delivery configuration for event notifications. **Prerequisites:** Subscriber endpoint must be reachable and secured. **Related:** Events, Authentication - name: Payouts description: >- Manage where Dakota sends your accrued developer-fee payouts. **Prerequisites:** Auth credentials and client context must be established. **Related:** Events - name: Events description: >- Retrieve event records emitted by platform operations for audit and troubleshooting. **Prerequisites:** Requesting client must have access to referenced resources. **Related:** Webhooks, Transactions, Onboarding - name: Info description: >- Read platform capability metadata, such as supported rails, networks, and assets. **Prerequisites:** Valid authentication headers. **Related:** Accounts, Transactions - name: Sandbox description: >- Trigger sandbox-only simulation endpoints for safe end-to-end integration testing with synthetic data. The sandbox host (`https://api.platform.sandbox.dakota.xyz`) also accepts a family of `X-Sandbox-*` request headers on most write endpoints (`Customers`, `Accounts`, `Transactions`, simulate endpoints) that let integrators drive deterministic failure modes — pick a preset via `X-Sandbox-Scenario`, or compose a custom one with `X-Sandbox-Error-Step`/`X-Sandbox-Error-Status`/`X-Sandbox-Error-Message`. `X-Sandbox-Instant-Completion` collapses async flows to a single synchronous step, and `X-Sandbox-Skip-Auto-Approval` keeps newly created KYB applications in `pending` for manual-review testing. All `X-Sandbox-*` headers are ignored in production. **Prerequisites:** Sandbox environment and test customer data. **Related:** Customers, Accounts, Transactions, Onboarding paths: /policies/{policy_id}/rules: parameters: - name: policy_id in: path required: true description: Unique identifier of the policy schema: type: string post: tags: - Policies summary: Add a new rule to a policy description: Creates a new rule under the specified policy. operationId: addPolicyRule parameters: - $ref: '#/components/parameters/IdempotencyKeyHeader' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/EndorsedRequest' example: signatures: - LS0tLS1CRUdJ...0tLS0tCg== intent: type: add_policy_rule policy_id: pol_2N4YkKpKu7M3mKpGYmF8kcJ8oZT rule_type: approval_threshold action: deny definition: threshold: 2 description: Require 2 approvals idempotency_key: idem_2N4YkKpKu7M3mKpGYmF8kcJ8oZT responses: '201': description: Policy rule created successfully content: application/json: schema: $ref: '#/components/schemas/Policy' example: id: pol_2N4YkKpKu7M3mKpGYmF8kcJ8oZT client_id: 1NFHrqBHb3cTfLVkFSGmHZqdDPi version: 1 name: High Value Transaction Policy description: Requires approval for transactions above $10,000 rules: - id: rule_2N4YkKpKu7M3mKpGYmF8kcJ8oZT policy_id: pol_2N4YkKpKu7M3mKpGYmF8kcJ8oZT rule_type: amount_threshold action: deny definition: min_amount: 0 threshold: 1000000 created_at: 1640995200 created_at: 1640995200 updated_at: 1640995200 '400': description: Invalid request content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://docs.dakota.xyz/api-reference/errors#invalid-request title: Invalid request status: 400 detail: Invalid request instance: https://api.platform.dakota.xyz/policies/example-id/rules request_id: req_01hzy6y7v8w9x0y1z2a3b4c5d6 '401': description: Unauthorized content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: >- https://docs.dakota.xyz/api-reference/errors#authentication-error title: Unauthorized status: 401 detail: Unauthorized instance: https://api.platform.dakota.xyz/policies/example-id/rules request_id: req_01hzy6y7v8w9x0y1z2a3b4c5d6 '403': description: Forbidden content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://docs.dakota.xyz/api-reference/errors#forbidden title: Forbidden status: 403 detail: Forbidden instance: https://api.platform.dakota.xyz/policies/example-id/rules request_id: req_01hzy6y7v8w9x0y1z2a3b4c5d6 '404': description: Policy not found content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://docs.dakota.xyz/api-reference/errors#not-found title: Policy not found status: 404 detail: Policy not found instance: https://api.platform.dakota.xyz/policies/example-id/rules request_id: req_01hzy6y7v8w9x0y1z2a3b4c5d6 '501': description: Not implemented content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://docs.dakota.xyz/api-reference/errors#not-implemented title: Not implemented status: 501 detail: Not implemented instance: https://api.platform.dakota.xyz/policies/example-id/rules request_id: req_01hzy6y7v8w9x0y1z2a3b4c5d6 default: description: Unexpected error content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://docs.dakota.xyz/api-reference/errors#internal-error title: Unexpected error status: 500 detail: Unexpected error instance: https://api.platform.dakota.xyz/policies/example-id/rules request_id: req_01hzy6y7v8w9x0y1z2a3b4c5d6 externalDocs: description: Read full guide in docs url: >- https://docs.dakota.xyz/api-reference/policies/add-a-new-rule-to-a-policy components: parameters: IdempotencyKeyHeader: name: x-idempotency-key in: header required: true description: >- Unique key to ensure request idempotency. If the same key is used within a certain time window, the original response will be returned instead of executing the request again. schema: type: string format: uuid schemas: EndorsedRequest: type: object required: - signatures - intent properties: signatures: type: array description: List of signatures over the intent items: type: string description: | Cryptographic signature over the intent, base64-encoded. For an ES256 signer this is the ASN.1 DER ECDSA signature over the SHA-256 of the canonical intent. For a WEBAUTHN signer this is the base64 of the WebAuthn assertion JSON (id, rawId, type, and response.authenticatorData / clientDataJSON / signature). See the WebAuthn & Passkey Signing guide. example: LS0tLS1CRUdJ...0tLS0tCg== intent: oneOf: - $ref: '#/components/schemas/SendTransactionIntent' - $ref: '#/components/schemas/AttachGroupToWalletIntent' - $ref: '#/components/schemas/DetachGroupFromWalletIntent' - $ref: '#/components/schemas/AttachPolicyToWalletIntent' - $ref: '#/components/schemas/DetachPolicyFromWalletIntent' - $ref: '#/components/schemas/AddPolicyRuleIntent' - $ref: '#/components/schemas/RemovePolicyRuleIntent' - $ref: '#/components/schemas/UpdatePolicyRuleIntent' - $ref: '#/components/schemas/DeletePolicyIntent' description: The intent being endorsed Policy: type: object required: - id - version - name - created_at - updated_at properties: id: type: string description: Unique identifier for the policy example: pol_2N4YkKpKu7M3mKpGYmF8kcJ8oZT client_id: $ref: '#/components/schemas/KSUID' signer_group_id: type: string description: >- ID of the signer group that governs mutations of this policy. Members of this group must endorse any add_policy_rule, update_policy_rule, remove_policy_rule, or delete_policy intent. example: grp_2N4YkKpKu7M3mKpGYmF8kcJ8oZT nullable: true version: type: integer format: int32 description: Version number of the policy (incremented on rule changes) example: 1 name: type: string description: Human-readable name for the policy example: High Value Transaction Policy description: type: string description: Optional description of the policy's purpose example: Requires approval for transactions above $10,000 nullable: true rules: type: array description: Rules that make up this policy items: $ref: '#/components/schemas/PolicyRule' created_at: type: integer description: Unix timestamp when the policy was created example: 1640995200 updated_at: type: integer description: Unix timestamp when the policy was last updated example: 1640995200 ProblemDetails: type: object required: - type - title - status description: | Error response following RFC 9457 Problem Details. Public API error responses use this format. example: type: https://docs.dakota.xyz/api-reference/errors#not-found title: Customer Not Found status: 404 detail: Customer cst_2abc123 was not found in your organization. instance: https://api.platform.dakota.xyz/customers/cst_2abc123 request_id: req_7f3a8b2c properties: type: type: string format: uri description: | URI reference identifying the problem type. Resolves to human-readable documentation. example: https://docs.dakota.xyz/api-reference/errors#not-found title: type: string description: >- Short, human-readable summary of the problem type. Stable across occurrences. example: Customer Not Found status: type: integer description: HTTP status code for this occurrence. example: 404 detail: type: string description: Human-readable explanation specific to this occurrence. example: Customer cst_2abc123 was not found in your organization. instance: type: string format: uri description: The request path that triggered this error. example: https://api.platform.dakota.xyz/customers/cst_2abc123 request_id: type: string description: Unique request identifier. Include when contacting support. example: req_7f3a8b2c errors: type: array description: Field-level validation errors (present for validation failures). items: $ref: '#/components/schemas/ValidationError' SendTransactionIntent: type: object required: - wallet_id - caip2 - operation - idempotency_key properties: wallet_id: type: string description: Unique identifier for the wallet caip2: type: string description: CAIP-2 chain identifier for the target blockchain network operation: $ref: '#/components/schemas/TransactionOperation' idempotency_key: type: string description: A unique key to ensure idempotency of the request context_digest: type: string description: | Optional opaque SHA-256d digest (base64-encoded) of an upstream operator-meaningful context envelope produced by the originating service (e.g. financial-account). Neither platform nor policy-engine interprets the semantic content. Policy-engine includes the field in canonical hashing so the WebAuthn signature commits to it; beyond that the digest is never read, validated, or logged. The pre-image is persisted upstream and exists for forensic / non-repudiation purposes (see ENG-1962). Intents predating this field validate as today (empty / omitted). AttachGroupToWalletIntent: type: object required: - type - wallet_id - group_id - idempotency_key properties: type: type: string enum: - attach_group_to_wallet example: attach_group_to_wallet wallet_id: type: string description: Unique identifier for the wallet group_id: type: string description: The signer group id to be attached to the wallet idempotency_key: type: string description: A unique key to ensure idempotency of the request DetachGroupFromWalletIntent: type: object required: - type - wallet_id - group_id - idempotency_key properties: type: type: string enum: - detach_group_from_wallet example: detach_group_from_wallet wallet_id: type: string description: Unique identifier for the wallet group_id: type: string description: The signer group id to be detached from the wallet idempotency_key: type: string description: A unique key to ensure idempotency of the request AttachPolicyToWalletIntent: type: object required: - type - wallet_id - policy_id - idempotency_key properties: type: type: string enum: - attach_policy_to_wallet example: attach_policy_to_wallet wallet_id: type: string description: Unique identifier for the wallet example: wal_2N4YkKpKu7M3mKpGYmF8kcJ8oZT policy_id: type: string description: The policy id to be attached to the wallet example: pol_2N4YkKpKu7M3mKpGYmF8kcJ8oZT idempotency_key: type: string description: A unique key to ensure idempotency of the request example: idem_2N4YkKpKu7M3mKpGYmF8kcJ8oZT DetachPolicyFromWalletIntent: type: object required: - type - wallet_id - policy_id - idempotency_key properties: type: type: string enum: - detach_policy_from_wallet example: detach_policy_from_wallet wallet_id: type: string description: Unique identifier for the wallet example: wal_2N4YkKpKu7M3mKpGYmF8kcJ8oZT policy_id: type: string description: The policy id to be detached from the wallet example: pol_2N4YkKpKu7M3mKpGYmF8kcJ8oZT idempotency_key: type: string description: A unique key to ensure idempotency of the request example: idem_2N4YkKpKu7M3mKpGYmF8kcJ8oZT AddPolicyRuleIntent: type: object required: - type - policy_id - rule_type - action - definition - idempotency_key properties: type: type: string enum: - add_policy_rule example: add_policy_rule policy_id: type: string description: The policy id to which the rule will be added example: pol_2N4YkKpKu7M3mKpGYmF8kcJ8oZT rule_type: type: string description: Type of rule to add enum: - approval_threshold - amount_threshold - address_list example: approval_threshold action: type: string description: Action to take when rule matches enum: - allow - deny example: deny definition: type: object description: Rule-specific configuration. Structure depends on rule_type example: threshold: 2 description: Require 2 approvals idempotency_key: type: string description: A unique key to ensure idempotency of the request example: idem_2N4YkKpKu7M3mKpGYmF8kcJ8oZT RemovePolicyRuleIntent: type: object required: - type - policy_id - rule_id - idempotency_key properties: type: type: string enum: - remove_policy_rule example: remove_policy_rule policy_id: type: string description: The policy id from which the rule will be removed example: pol_2N4YkKpKu7M3mKpGYmF8kcJ8oZT rule_id: type: string description: The id of the rule to be removed from the policy example: rule_2N4YkKpKu7M3mKpGYmF8kcJ8oZT idempotency_key: type: string description: A unique key to ensure idempotency of the request example: idem_2N4YkKpKu7M3mKpGYmF8kcJ8oZT UpdatePolicyRuleIntent: type: object required: - type - policy_id - rule_id - updated_definition - idempotency_key properties: type: type: string enum: - update_policy_rule example: update_policy_rule policy_id: type: string description: The policy id from which the rule will be updated example: pol_2N4YkKpKu7M3mKpGYmF8kcJ8oZT rule_id: type: string description: The id of the rule to be updated example: rule_2N4YkKpKu7M3mKpGYmF8kcJ8oZT updated_definition: type: string description: The updated rule definition as JSON string example: '{"amount": "15000", "currency": "USD"}' idempotency_key: type: string description: A unique key to ensure idempotency of the request example: idem_2N4YkKpKu7M3mKpGYmF8kcJ8oZT DeletePolicyIntent: type: object required: - type - policy_id - idempotency_key properties: type: type: string enum: - delete_policy example: delete_policy policy_id: type: string description: The policy id to be deleted example: pol_2N4YkKpKu7M3mKpGYmF8kcJ8oZT idempotency_key: type: string description: A unique key to ensure idempotency of the request example: idem_2N4YkKpKu7M3mKpGYmF8kcJ8oZT KSUID: type: string title: KSUID description: >- KSUID is a 27-character globally unique ID that combines a timestamp with a random component. Used for all entity identifiers in the Dakota platform. pattern: ^[0-9A-Za-z]{27}$ minLength: 27 maxLength: 27 example: 1NFHrqBHb3cTfLVkFSGmHZqdDPi PolicyRule: type: object required: - id - policy_id - rule_type - action - definition - created_at properties: id: type: string description: Unique identifier for the rule (stable within the policy) example: rule_2N4YkKpKu7M3mKpGYmF8kcJ8oZT policy_id: type: string description: Policy ID this rule belongs to example: pol_2N4YkKpKu7M3mKpGYmF8kcJ8oZT rule_type: type: string description: Type of rule enum: - approval_threshold - amount_threshold - address_list example: amount_threshold action: type: string description: Action to take when rule matches enum: - allow - deny example: deny definition: type: object description: Rule-specific configuration as JSON example: min_amount: 0 threshold: 1000000 created_at: type: integer description: Unix timestamp when the rule was created example: 1640995200 ValidationError: type: object required: - field - message properties: field: type: string description: Field path using dot notation for nested fields. example: bank_account.routing_number message: type: string description: Human-readable description of the field error. example: Routing number must be exactly 9 digits code: type: string description: Machine-readable error code for this field. example: invalid_format TransactionOperation: type: object required: - kind - from - to - asset_id properties: kind: type: string description: 'Transaction type: transfer or contract call' from: type: string description: The wallet address initiating the transaction to: type: string description: The recipient address of the transaction amount: type: string description: > Amount to be transferred as a non-negative decimal string. Required for transfer operations; optional for contract calls (defaults to zero). Leading zeros, signs, commas, and non-finite values are rejected. For transfer operations the handler additionally requires the value to be greater than zero. pattern: ^(0|[1-9][0-9]*)(\.[0-9]+)?$ minLength: 1 asset_id: type: string description: Crypto asset symbol for the transfer or contract call. example: USDC method: type: string description: The method name to be invoked on the contract args: type: array description: Arguments for the contract method call items: type: string data: type: string description: The calldata payload for the contract call securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key ````