--- title: "How do I create a data policy?" slug: "how-do-i-create-a-data-policy" tags: ["data policy", "access control"] updated: 2026-06-30T13:10:07Z published: 2026-06-30T13:10:07Z canonical: "support.lusid.com/how-do-i-create-a-data-policy" stale: true --- > ## Documentation Index > Fetch the complete documentation index at: https://support.lusid.com/llms.txt > Use this file to discover all available pages before exploring further. # How do I create a data policy? Providing you are a LUSID user with sufficient privileges, you can create a [data policy](/v1/docs/what-are-a-policy-and-a-policy-collection) to restrict access to one or more entity datasets. > **Note:** Once created, you should assign the policy to a [role](/v1/docs/what-is-a-role). An [entity](/v1/docs/what-is-an-entity) in LUSID is a portfolio, instrument, quote or similar repository of LUSID data. Note not all entities [support every access check](/v1/docs/understanding-how-lusids-identity-management-and-access-control-systems-work#support-for-data-policy-checks) LUSID is capable of making. Note also that a data policy requires an equivalent [feature policy](/v1/docs/how-do-i-create-a-feature-policy) to enable calls to appropriate API endpoints to perform operations on that data, though if you are using the LUSID web app you can create both in the same operation. In a data policy you specify the entity dataset(s) users can access and the actions they can perform on those datasets: | **Action** | **Enables the user to...** | | --- | --- | | `Any` | Perform all the actions below. | | `List` | Retrieve entity data. Note `Read` must also be specified for an entity if it is available. | | `Read` | Retrieve entity data. Note `List` must also be specified for an entity if it is available. | | `Update` | Update existing entity data. | | `Add` | Add new entity data. | | `Upsert` | Either update existing or add new entity data, depending whether it currently exists or not. | | `Delete` | Delete entity data. | | `ReadMetadata` | Retrieve access metadata specified for an entity. | | `WriteMetadata` | Update existing or add new metadata for an entity. | > **Note:** Transactions and holdings are sub-entities of portfolios. To allow access, choose the `Update` action on the portfolio dataset for holdings, and the `UpsertTransactions` action for transactions. Note for transactions you can choose the `UpsertTransactions` action on the transaction type dataset as well (or alternatively). ## Using the LUSID web app 1. Sign in to the [LUSID web app](https://www.lusid.com/app) using the credentials of a LUSID administrator. 2. From the left-hand menu, select **Identity and Access > Policies**: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(189).png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A00%3A35Z&se=2026-11-04T03%3A00%3A35Z&sr=c&sp=r&sig=CpoRqZsYP1tbM3slPSwXOR1rAD7ETYDhaZgIY6FmO3c%3D) 3. On the **Policies** dashboard, click the **Create policy** button. ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(190).png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A00%3A35Z&se=2026-11-04T03%3A00%3A35Z&sr=c&sp=r&sig=CpoRqZsYP1tbM3slPSwXOR1rAD7ETYDhaZgIY6FmO3c%3D) 4. Specify a unique **Policy code**, **Policy validity** dates if necessary, and select whether the policy should **Allow** or **Deny** access to the data specified: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(191).png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A00%3A35Z&se=2026-11-04T03%3A00%3A35Z&sr=c&sp=r&sig=CpoRqZsYP1tbM3slPSwXOR1rAD7ETYDhaZgIY6FmO3c%3D) 5. On the **Features** tab, [select the features](/v1/docs/how-do-i-create-a-feature-policy) you want the policy to cover. 6. On the **Data Resources** tab, add actions for datasets. For example, to allow write access to all portfolio data: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image-UJQUH7RX.png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A00%3A35Z&se=2026-11-04T03%3A00%3A35Z&sr=c&sp=r&sig=CpoRqZsYP1tbM3slPSwXOR1rAD7ETYDhaZgIY6FmO3c%3D) 7. Choose a **Selector** type from the following options to nominate a data partition to restrict the policy to: For example, to restrict the policy to just portfolios within the scope **Finbourne-Examples**: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(194).png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A00%3A35Z&se=2026-11-04T03%3A00%3A35Z&sr=c&sp=r&sig=CpoRqZsYP1tbM3slPSwXOR1rAD7ETYDhaZgIY6FmO3c%3D) - **Identifier** allows you to specify a **Scope** and **Code** pair to restrict the policy to. Note the ***** value applies the policy to every code within the specified scope. - **MetadataExpression** allows you to restrict the policy based on an access metadata expression. [Read more.](/v1/docs/understanding-access-metadata-amd) - **Match all** applies the policy to every scope in LUSID. 8. Click **Next** to reach the **Time Restrictions** tab. Optionally, specify any time restrictions for your policy, such as taking effect on the first day of the month. [Read more.](/v1/docs/how-do-i-specify-an-expiry-date-or-a-rolling-validity-date-for-a-policy) ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(195).png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A00%3A35Z&se=2026-11-04T03%3A00%3A35Z&sr=c&sp=r&sig=CpoRqZsYP1tbM3slPSwXOR1rAD7ETYDhaZgIY6FmO3c%3D) 9. Click **Next** to reach the **Advanced Options** tab. Optionally, specify any conditions for your policy to apply at runtime for any given evaluation of access control permissions. You can specify: - **Request header** to apply the policy if the request has a specified header and value. - **Identity claim** to apply the policy if the user’s authentication token has a specified claim and value. - **Identity scope** to apply the policy if the user’s authentication token is issued in response to supplying a specified scope. 10. Select **Done** to review the policy, and **Save** to create the policy: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(196).png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A00%3A35Z&se=2026-11-04T03%3A00%3A35Z&sr=c&sp=r&sig=CpoRqZsYP1tbM3slPSwXOR1rAD7ETYDhaZgIY6FmO3c%3D) ## Using the Access API The syntax of the JSON object you need to provide in the body of the request to the [CreatePolicy](https://www.lusid.com/docs/api/access/endpoints/policies/CreatePolicy) API is complicated and highly specific to the nature of the policy you are trying to create. Currently, we recommend creating the policy in the [LUSID web app](/v1/docs/how-do-i-create-a-data-policy#using-the-lusid-web-app). Once created, you can manage the policy entirely programmatically. If you *do* need to create a policy using the `CreatePolicy` API, you can create one policy per API call. 1. [Obtain an API access token.](/v1/docs/how-do-i-obtain-and-use-a-short-lived-api-access-token-from-okta) 2. Call the [CreatePolicy](https://www.lusid.com/docs/api/access/endpoints/policies/CreatePolicy) API for your LUSID domain, passing in your API access token and: > [!TIP] > Tip > > You can examine the [CreatePolicy API Reference](https://www.lusid.com/docs/api/access/endpoints/policies/CreatePolicy) documentation to see the allowed values for each option. ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(321).png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A00%3A35Z&se=2026-11-04T03%3A00%3A35Z&sr=c&sp=r&sig=CpoRqZsYP1tbM3slPSwXOR1rAD7ETYDhaZgIY6FmO3c%3D) - A `code` that uniquely identifies the policy. - A friendly `description`. - The [applications](/v1/docs/understanding-all-the-applications-in-the-finbourne-platform) the data resources are within, for example `LUSID`, `Drive` or `Workflow`. - Whether the policy `grant` should `Allow` or `Deny` access to the specified data resources. - A date from `when` the policy should `activate`, and optionally `deactivate`. - An array of `selectors`, that is, data resources to control access to. If you have generated selectors from a [policy template](/v1/docs/how-do-i-create-a-policy-from-a-policy-template), you can use them here. Each selector should contain: - One of: - `idSelectorDefinition` to specify an `identifier` to restrict the policy to. The shape of this parameter varies depending on the entity type; for most data resources, the identifier is a `scope` and `code` pair. You can specify a `*` value to apply the policy to all identifiers of a particular identifier type. - `metadataSelectorDefinition` to restrict the policy based on access metadata (AMD) `expressions` for the AMD associated with an identifier. Each expression should specify: > [!TIP] > Tip > > [Read more on access metadata (AMD) here.](/v1/docs/understanding-access-metadata-amd) - A `metadataKey`, for example `FundGroup`. - An `operator`, for example `Equals` or `In`. - A `textValue` to match on, for example `FundGroup1`. - `matchAllSelectorDefinition` to apply the policy to every scope for the entity in LUSID. - An array of `actions` the policy should allow or deny access to. Each action should specify: - A `scope` value of `default`. - The `activity` the policy should allow or deny access to (as listed in the table at the start of this article), for example `Read` or `List`. - The `entity` the policy relates to, for example `Portfolio`. - Optionally, a friendly `name` and `description` for the selector. - Values `for` when the policy should be applied, out of `asAtRangeForSpec`, `asAtRelative`, `effectiveDateHasQuality`, `effectiveDateRelative` and `effectiveRange`. - `if` values for when the policy should be applied, out of: - `ifRequestHeaderExpression` to apply the policy if the request has a specified header and value. - `ifIdentityClaimExpression` to apply the policy if the user’s authentication token has a specified claim and value. - `ifIdentityScopeExpression` to apply the policy if the user’s authentication token is issued in response to supplying a specified scope. - If you used a policy template to generate the policy `selectors`, specify the `templateMetadata` to track the policy when changes are made to the template used. [Read more on policy templates.](/v1/docs/how-do-i-create-a-policy-template) For example, to create a policy that allows full data access to portfolios within the `Finbourne-Examples` scope: ```json curl -X POST "https://.lusid.com/access/api/policies"  -H "Authorization: Bearer "  -d "{  "code": "data-policy-allow-write-portfolio-data",  "description": "A policy that allows write access to portfolio data",  "applications": [ "LUSID" ],  "grant": "Allow", "selectors": [        {            "idSelectorDefinition": {                "identifier": {                    "code": "*",                    "scope": "Finbourne-Examples"                },                "actions": [                    {                        "scope": "default",                        "activity": "Read",                        "entity": "Portfolio"                    },{                        "scope": "default",                        "activity": "Add",                        "entity": "Portfolio"                    },{                        "scope": "default",                        "activity": "Delete",                        "entity": "Portfolio"                    },{                        "scope": "default",                        "activity": "Update",                        "entity": "Portfolio"                    },{                        "scope": "default",                        "activity": "List",                        "entity": "Portfolio"                    },{                        "scope": "default",                        "activity": "Any",                        "entity": "Portfolio"                    },{                        "scope": "default",                        "activity": "ReadMetadata",                        "entity": "Portfolio"                    },{                        "scope": "default",                        "activity": "UpdateMetadata",                        "entity": "Portfolio"                    }         ] } } ],  "for": [    { "effectiveDateHasQuality": {        "quality": "IsFirstDayOfAnyMonth"      } } ],  "when": {    "activate": "2024-10-15T18:00:00.0000000+00:00",    "deactivate": "2027-01-01T18:00:00.0000000+00:00"  } }" ```