--- title: "How do I create a feature policy?" slug: "how-do-i-create-a-feature-policy" tags: ["feature policy", "access control"] updated: 2026-06-30T13:09:02Z published: 2026-06-30T13:09:02Z canonical: "support.lusid.com/how-do-i-create-a-feature-policy" stale: true --- > ## Documentation Index > Fetch the complete documentation index at: https://support.lusid.com/llms.txt > Use this file to discover all available pages before exploring further. # How do I create a feature policy? Providing you are a LUSID user with sufficient privileges, you can create a [feature policy](/v1/docs/what-are-a-policy-and-a-policy-collection) to restrict access to one or more LUSID API endpoints. > **Note:** Once created, you should assign the policy to a [role](/v1/docs/what-is-a-role). Note a feature policy applies to a [personal user](/v1/docs/what-are-a-personal-user-and-a-service-user) using the LUSID web app, since the web app itself calls the API. Note also that a feature policy requires an equivalent [data policy](/v1/docs/how-do-i-create-a-data-policy) in order to yield any data, though if you are using the LUSID web app you can create both in the same operation. ## Using the LUSID web app 1. Log in to the [LUSID web app](https://www.lusid.com/app) using the credentials of a LUSID administrator. 2. From the left-hand menu, select **Identity and Access > Policies**: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(197).png?sv=2026-02-06&spr=https&st=2026-11-04T01%3A47%3A10Z&se=2026-11-04T02%3A47%3A10Z&sr=c&sp=r&sig=x2b4UUc8tv5sBHCn0tALtq%2F56mdqHwdLa87BvJ6T8Ts%3D) 3. On the **Policies** dashboard, click the **Create policy** button. ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(190).png?sv=2026-02-06&spr=https&st=2026-11-04T01%3A47%3A10Z&se=2026-11-04T02%3A47%3A10Z&sr=c&sp=r&sig=x2b4UUc8tv5sBHCn0tALtq%2F56mdqHwdLa87BvJ6T8Ts%3D) 4. Specify a unique **Policy code**, **Policy validity** dates if necessary, and select whether the policy should **Allow** or **Deny** access to the features specified: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(201).png?sv=2026-02-06&spr=https&st=2026-11-04T01%3A47%3A10Z&se=2026-11-04T02%3A47%3A10Z&sr=c&sp=r&sig=x2b4UUc8tv5sBHCn0tALtq%2F56mdqHwdLa87BvJ6T8Ts%3D) 5. On the **Features** tab, select the checkbox of each feature (corresponding to API endpoints) to add to the policy: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(199).png?sv=2026-02-06&spr=https&st=2026-11-04T01%3A47%3A10Z&se=2026-11-04T02%3A47%3A10Z&sr=c&sp=r&sig=x2b4UUc8tv5sBHCn0tALtq%2F56mdqHwdLa87BvJ6T8Ts%3D)Selecting which API endpoints is subjective, but to grant read-only access to the instrument master for example, you might choose: `GetInstrument`, `GetInstruments`, `ListInstruments`, `GetInstrumentIdentifierTypes`, `GetInstrumentProperties`, `ListInstrumentProperties` API endpoints are identified by their operation ID. Examine the [API reference](https://www.lusid.com/docs/api/lusid/intro) for more information on each endpoint; the operation ID is printed under the URL: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(116).png?sv=2026-02-06&spr=https&st=2026-11-04T01%3A47%3A10Z&se=2026-11-04T02%3A47%3A10Z&sr=c&sp=r&sig=x2b4UUc8tv5sBHCn0tALtq%2F56mdqHwdLa87BvJ6T8Ts%3D) 6. Select **Next** to reach the **Data Resources** tab. Optionally, [select any data resources you want to add to the policy](/v1/docs/how-do-i-create-a-data-policy). 7. Click **Next** to reach the **Time Restrictions** tab. Optionally, specify any time restrictions for your policy, such as taking effect on the first day of the month. [Read more.](/v1/docs/how-do-i-specify-an-expiry-date-or-a-rolling-validity-date-for-a-policy) ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(195).png?sv=2026-02-06&spr=https&st=2026-11-04T01%3A47%3A10Z&se=2026-11-04T02%3A47%3A10Z&sr=c&sp=r&sig=x2b4UUc8tv5sBHCn0tALtq%2F56mdqHwdLa87BvJ6T8Ts%3D) 8. Click **Next** to reach the **Advanced Options** tab. Optionally, specify any conditions for your policy to apply at runtime for any given evaluation of access control permissions. You can specify: - **Request header** to apply the policy if the request has a specified header and value. - **Identity claim** to apply the policy if the user’s authentication token has a specified claim and value. - **Identity scope** to apply the policy if the user’s authentication token is issued in response to supplying a specified scope. 9. Select **Done** to review the policy, and **Save** to create the policy: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(202).png?sv=2026-02-06&spr=https&st=2026-11-04T01%3A47%3A10Z&se=2026-11-04T02%3A47%3A10Z&sr=c&sp=r&sig=x2b4UUc8tv5sBHCn0tALtq%2F56mdqHwdLa87BvJ6T8Ts%3D) ## Using the Access API The syntax of the JSON object you need to provide in the body of the request to the [CreatePolicy](https://www.lusid.com/docs/api/access/endpoints/policies/CreatePolicy) API is complicated and highly specific to the nature of the policy you are trying to create. Currently, we recommend creating the policy in the [LUSID web app](/v1/docs/how-do-i-create-a-data-policy#using-the-lusid-web-app). Once created, you can manage the policy entirely programmatically. If you *do* need to create a policy using the `CreatePolicy` API, you can create one policy per API call. 1. [Obtain an API access token.](/v1/docs/how-do-i-obtain-and-use-a-short-lived-api-access-token-from-okta) 2. Call the [CreatePolicy](https://www.lusid.com/docs/api/access/endpoints/policies/CreatePolicy) API for your LUSID domain, passing in your API access token and: > [!TIP] > Tip > > You can examine the [CreatePolicy API](https://www.lusid.com/docs/api/access/endpoints/policies/CreatePolicy) documentation to see the allowed values for each option. ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(321).png?sv=2026-02-06&spr=https&st=2026-11-04T01%3A47%3A10Z&se=2026-11-04T02%3A47%3A10Z&sr=c&sp=r&sig=x2b4UUc8tv5sBHCn0tALtq%2F56mdqHwdLa87BvJ6T8Ts%3D) - A `code` that uniquely identifies the policy. - A friendly `description`. - The [applications](/v1/docs/understanding-all-the-applications-in-the-finbourne-platform) the features are within, for example `LUSID`, `Drive` or `Workflow`. - Whether the policy `grant` should `Allow` or `Deny` access to the specified features. - A date from `when` the policy should `activate`, and optionally `deactivate`. - An array of `selectors`, that is, features to control access to. If you have generated selectors from a [policy template](/v1/docs/how-do-i-create-a-policy-from-a-policy-template), you can use them here. Each selector should contain an `idSelectorDefinition` specifying: - `identifiers` to restrict the policy to, including: - A `scope` value of the API application the policy refers to, for example `LUSID` or `Drive`. - A `code` value in the relevant format: - For API endpoints, use `api-<endpoint>-<operationID>`. For example, `ListInstruments` could use `api-instruments-listinstruments`. > [!TIP] > Tip > > Examine the [API reference](https://www.lusid.com/docs/api/lusid/intro) for more information on each endpoint; the operation ID is printed under the URL: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(322).png?sv=2026-02-06&spr=https&st=2026-11-04T01%3A47%3A10Z&se=2026-11-04T02%3A47%3A10Z&sr=c&sp=r&sig=x2b4UUc8tv5sBHCn0tALtq%2F56mdqHwdLa87BvJ6T8Ts%3D) - For Luminesce [providers](/v1/docs/luminesce-and-lumipy), specify the provider name, for example `Lusid.Instrument.Equity`. - An array of `actions` the policy should allow or deny access to. Each action should specify: - The same `scope` value as specified in `identifiers`. - The `activity` value `Execute`. - The `entity` value `Feature`. - Optionally, a friendly `name` and `description` for the selector. - Values `for` when the policy should be applied, out of `asAtRangeForSpec`, `asAtRelative`, `effectiveDateHasQuality`, `effectiveDateRelative` and `effectiveRange`. - `if` values for when the policy should be applied, out of: - `ifRequestHeaderExpression` to apply the policy if the request has a specified header and value. - `ifIdentityClaimExpression` to apply the policy if the user’s authentication token has a specified claim and value. - `ifIdentityScopeExpression` to apply the policy if the user’s authentication token is issued in response to supplying a specified scope. - If you used a policy template to generate the policy `selectors`, specify the `templateMetadata` to track the policy when changes are made to the template used. [Read more on policy templates.](/v1/docs/how-do-i-create-a-policy-template) For example, to create a policy that allows read-only access to the instrument master: ```json curl -X POST "https://.lusid.com/access/api/policies"  -H "Authorization: Bearer "  -d "{  "code": "feature-policy-allow-instrument-endpoints",  "description": "A policy that allows access to Instrument API GET and LIST endpoints",  "applications": [ "LUSID" ],  "grant": "Allow",  "selectors": [        { "idSelectorDefinition": {                "identifier": {                    "code": "api-instruments-getinstrument",                    "scope": "LUSID"                },                "actions": [ {                        "scope": "LUSID",                        "activity": "Execute",                        "entity": "Feature"                    } ],                "name": "Run GetInstrument"            } },        { "idSelectorDefinition": {                "identifier": {                    "code": "api-instruments-getinstrumentidentifiertypes",                    "scope": "LUSID"                },                "actions": [ {                        "scope": "LUSID",                        "activity": "Execute",                        "entity": "Feature"                    } ],                "name": "Run GetInstrumentIdentifierTypes"            } },        { "idSelectorDefinition": {                "identifier": {                    "code": "api-instruments-getinstrumentproperties",                    "scope": "LUSID"                },                "actions": [ {                        "scope": "LUSID",                        "activity": "Execute",                        "entity": "Feature"                    } ],                "name": "Run GetInstrumentProperties"            } },        { "idSelectorDefinition": {                "identifier": {                    "code": "api-instruments-getinstruments",                    "scope": "LUSID"                },                "actions": [ {                        "scope": "LUSID",                        "activity": "Execute",                        "entity": "Feature"                    } ],                "name": "Run GetInstruments"            } },        { "idSelectorDefinition": {                "identifier": {                    "code": "api-instruments-listproperties",                    "scope": "LUSID"                },                "actions": [ {                        "scope": "LUSID",                        "activity": "Execute",                        "entity": "Feature"                    } ],                "name": "Run ListInstrumentProperties"            } },        { "idSelectorDefinition": {                "identifier": {                    "code": "api-instruments-listinstruments",                    "scope": "LUSID"                },                "actions": [ {                        "scope": "LUSID",                        "activity": "Execute",                        "entity": "Feature"                    } ],                "name": "Run ListInstruments"            } }    ],  "when": {    "activate": "2016-08-31T18:00:00.0000000+00:00",    "deactivate": "2027-08-31T18:00:00.0000000+00:00"  } }" ```