Access Service | Equinix Product Documentation

Create Access Policy

Request

Allows a user to create a new access policy. The access policy is created in the project identified by the projectId. An access policy contains that same data as a permission set but also includes the grants field for indicating what principals can use the access policy. Access to this operation is controlled by the project being accessed.

The auth token's access policy must allow action:use/createAccessPolicy.

Security

bearerAuth

Path

projectIdstring(ProjectId)^project:[0-9a-zA-Z](?![^:]*-$)(?![^:]*--)[0-...required

Globally unique identifier of a project. Callers may URL encode this value.

Example:project:abc-123

Bodyapplication/jsonrequired

tagsobject, <= 10 properties(Tags)required

Additional user-controlled data about this resource.

descriptionstring^.{0,500}$

Example:"A description string."

permissionsArray of any, unique(UserRectSet)required

A set of permissions, each of which may be an inline permission, a permission set reference, or a foreign access policy reference.

intersectArray of any, unique(UserRectSet)

Entries must appear in both the intersect field and the permissions to be in the results from this permission object.

subtractArray of objects, unique(InlinePermission)

Entries in the subtract field are not included in the results from this permission object.

accessPolicyIdstring(AccessPolicyId)^accesspolicy:[a-zA-Z](?![^:]*-$)(?![^:]*--)[...required

Uniquely identifies an access policy within a project.

Example:"accesspolicy:my-policy"

allowBadRefsstring

Indicates that the access policy should be created even if it includes invalid references to permission objects.

Value:"additional"

Example:"additional"

Payload

{
  "tags": {
    "property1": "my tag value",
    "property2": "my tag value"
  },
  "description": "A description string.",
  "permissions": [
    { … }
  ],
  "intersect": [
    { … }
  ],
  "subtract": [
    { … }
  ],
  "accessPolicyId": "accesspolicy:my-policy",
  "allowBadRefs": "additional"
}

Responses

Success

Bodyapplication/json

descriptionstring^.{0,500}$

Example:"A description string."

tagsobject, <= 10 properties(Tags)required

Additional user-controlled data about this resource.

updatedAtstring(UpdatedAt)^.*$

A string timestamp indicating when the resource was last updated. Formatted like: "2025-02-12T17:24:19.033772087Z"

Example:"2024-01-15T12:00:00Z"

permissionsArray of any, unique(UserRectSet)required

A set of permissions, each of which may be an inline permission, a permission set reference, or a foreign access policy reference.

createdBystring(CreatedBy)^.*$

A string indicating the principal who invoked an operation to create the resource.

Example:"principal:ABCD-EFG-12345:idp:example-user"

createdAtstring(CreatedAt)^.*$

A string timestamp indicating when the resource was created. Formatted like: "2025-02-12T17:24:19.033772087Z"

Example:"2024-01-15T12:00:00Z"

revstring(ResourceRev)^.*$required

An opaque string that represents the revision of a given resource. Each time the resource is updated, this value changes.

Example:"abc123"

approvedAtstring(UpdatedAt)^.*$

A string timestamp indicating when the resource was last updated. Formatted like: "2025-02-12T17:24:19.033772087Z"

Example:"2024-01-15T12:00:00Z"

ernstring(Ern)^ern:(?<cloud>[^:]{1,50}):(?<service>[^:/]{1,...required

Equinix resource name, a universally unique identifier for a resource across all clouds, regions, and services. Formatted as "ern:<cloudId>:<serviceId>:<regionId>:<projectId>:<resourceType>:<resourceId>".

Example:"ern:eqix:equinix/sts:global:abc-123:SomeType:res-id"

disabledPolicyany

Value:true

Example:true

updatedBystring(UpdatedBy)^.*$

A string indicating the principal who last invoked an operation to update the resource.

Example:"principal:ABCD-EFG-12345:idp:example-user"

managedany

Value:true

Example:true

intersectArray of any, unique(UserRectSet)

Entries must appear in both the intersect field and the permissions to be in the results from this permission object.

subtractArray of objects, unique(InlinePermission)

Entries in the subtract field are not included in the results from this permission object.

accessPolicyIdAccessPolicyId (string) or ManagedPolicyId (string)required

One of:

Uniquely identifies an access policy within a project.

string(AccessPolicyId)

approvedBystring(ApprovedBy)^.*$

A string indicating the principal who invoked an operation to approve the resource.

Example:"principal:ABCD-EFG-12345:idp:example-user"

Response

{
  "description": "A description string.",
  "tags": {
    "property1": "my tag value",
    "property2": "my tag value"
  },
  "updatedAt": "2024-01-15T12:00:00Z",
  "permissions": [
    { … }
  ],
  "createdBy": "principal:ABCD-EFG-12345:idp:example-user",
  "createdAt": "2024-01-15T12:00:00Z",
  "rev": "abc123",
  "approvedAt": "2024-01-15T12:00:00Z",
  "ern": "ern:eqix:equinix/sts:global:abc-123:SomeType:res-id",
  "disabledPolicy": true,
  "updatedBy": "principal:ABCD-EFG-12345:idp:example-user",
  "managed": true,
  "intersect": [
    { … }
  ],
  "subtract": [
    { … }
  ],
  "accessPolicyId": "accesspolicy:my-policy",
  "approvedBy": "principal:ABCD-EFG-12345:idp:example-user"
}