> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apinizer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Policies API

> The Policies API provides endpoints for managing policies in API proxies. Policies are rules that can be applied to requests, responses, or errors to control behavior, security, transformation, and more.

## Endpoints

* [List Policies](/api-reference/policies/crud/list-policies) - Get all policies for an API proxy
* [Add Policy](/api-reference/policies/crud/add-policy) - Add a new policy to an API proxy
* [Update Policy](/api-reference/policies/crud/update-policy) - Update an existing policy
* [Delete Policy](/api-reference/policies/crud/delete-policy) - Delete a policy from an API proxy

## Policy Types

Policies are organized by type. Each policy type has its own documentation page with complete examples:

### Authentication Policies

* [Basic Authentication](/api-reference/policies/policies/policy-auth-basic)
* [Clear Text Authentication](/api-reference/policies/policies/policy-auth-clear-text)
* [Digest Authentication](/api-reference/policies/policies/policy-auth-digest)
* [JWT Authentication](/api-reference/policies/policies/policy-auth-jwt)
* [OAuth2 Authentication](/api-reference/policies/policies/policy-auth-oauth2)
* [OIDC Authentication](/api-reference/policies/policies/policy-oidc)
* [mTLS Authentication](/api-reference/policies/policies/policy-auth-mtls)
* [API Authentication](/api-reference/policies/policies/policy-api-authentication)
* [SAML Validation](/api-reference/policies/policies/policy-saml-validation)

### Security Policies

* [WS-Security Encrypt](/api-reference/policies/policies/policy-ws-security-encrypt)
* [WS-Security Decrypt](/api-reference/policies/policies/policy-ws-security-decrypt)
* [WS-Security Sign](/api-reference/policies/policies/policy-ws-security-sign)
* [WS-Security Sign Validation](/api-reference/policies/policies/policy-ws-security-sign-validation)
* [WS-Security Username Token](/api-reference/policies/policies/policy-ws-security-username)
* [WS-Security Timestamp](/api-reference/policies/policies/policy-ws-security-timestamp)
* [WS-Security From Target](/api-reference/policies/policies/policy-ws-security-from-target)
* [WS-Security To Target](/api-reference/policies/policies/policy-ws-security-to-target)
* [JOSE Validation](/api-reference/policies/policies/policy-jose-validation)
* [JOSE Implementation](/api-reference/policies/policies/policy-jose-implementation)
* [Digital Sign](/api-reference/policies/policies/policy-digital-sign)
* [Digital Sign Verification](/api-reference/policies/policies/policy-digital-sign-verification)
* [Encryption](/api-reference/policies/policies/policy-encryption)
* [Decryption](/api-reference/policies/policies/policy-decryption)

### Rate Limiting & Quota Policies

* [API Based Throttling](/api-reference/policies/policies/policy-api-based-throttling)
* [API Based Quota](/api-reference/policies/policies/policy-api-based-quota)
* [Client Ban](/api-reference/policies/policies/policy-client-ban)

### IP Filtering Policies

* [Blocked IP List](/api-reference/policies/policies/policy-black-ip)
* [Allowed IP List](/api-reference/policies/policies/policy-white-ip)

### Transformation Policies

* [JSON Transformation](/api-reference/policies/policies/policy-json-transformation)
* [XML Transformation](/api-reference/policies/policies/policy-xml-transformation)
* [Request Protocol Transformation](/api-reference/policies/policies/policy-request-protocol-transformation)
* [Response Protocol Transformation](/api-reference/policies/policies/policy-response-protocol-transformation)

### Validation Policies

* [JSON Schema Validation](/api-reference/policies/policies/policy-json-schema-validation)
* [XML Schema Validation](/api-reference/policies/policies/policy-xml-schema-validation)
* [Max Message Size](/api-reference/policies/policies/policy-max-message-size)
* [Min Message Size](/api-reference/policies/policies/policy-min-message-size)

### Content Policies

* [Content Filter](/api-reference/policies/policies/policy-content-filter)
* [Redaction](/api-reference/policies/policies/policy-redaction)

### Scripting Policies

* [Script](/api-reference/policies/policies/policy-script)

### Integration Policies

* [API Call](/api-reference/policies/policies/policy-api-call)

### Advanced Policies

* [Time Restriction](/api-reference/policies/policies/policy-time-restriction)
* [Business Rule](/api-reference/policies/policies/policy-business-rule)
* [Policy Group](/api-reference/policies/policies/policy-group)

## Authentication

All endpoints require authentication using a Personal API Access Token.

## Permissions

### GET Operations (List Policies)

* User must have **`API_MANAGEMENT` + `VIEW`** permission in the project
* If the asset category does not exist, user must have **at least one permission** in the project

### POST/PUT/DELETE Operations (Add/Update/Delete Policy)

* User must have **`API_MANAGEMENT` + `MANAGE`** permission in the project
* If `deploy: true` is set in the request, user must also have **`API_MANAGEMENT` + `DEPLOY_UNDEPLOY`** permission

### Permission Requirements

| Operation                | Required Permission                                                     |
| ------------------------ | ----------------------------------------------------------------------- |
| List Policies            | `API_MANAGEMENT` + `VIEW` (or any permission if category doesn't exist) |
| Add/Update/Delete Policy | `API_MANAGEMENT` + `MANAGE`                                             |
| Deploy Policy            | `API_MANAGEMENT` + `DEPLOY_UNDEPLOY`                                    |

## Related Documentation

* [Authentication Guide](/api-reference/getting-started/authentication) - How to obtain and use API tokens
* [Error Handling](/api-reference/getting-started/error-handling) - Error response formats