Create Approval Policy V1

Create an approval policy. The policy fires when a worker tool-call’s name matches any of tool_patterns…

POST /api/v1/approval-policies

cURL

curl --request POST \
  --url 'https://api.computer.stateset.app/api/v1/approval-policies' \
  --header "X-API-Key: $STATESET_COMPUTER_USE_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "Two-Person Tent",
  "tool_patterns": [
    "string"
  ],
  "auto_approve_rules": {}
}'

201

{
  "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "name": "Two-Person Tent",
  "tool_patterns": [
    "string"
  ],
  "auto_approve_rules": {},
  "is_active": true,
  "created_at": "2026-08-31T14:22:05Z",
  "updated_at": "2026-08-31T14:22:05Z"
}

Create an approval policy.

The policy fires when a worker tool-call’s name matches any of tool_patterns. Without auto_approve_rules, every match pauses the job and creates an ApprovalRequest for human review. With auto-approve rules, matches are silently approved based on the rule (rate-limit windows, allow-listed input subsets, etc. — see operator docs).

Admin scope only — these gates are security-sensitive.

Request body

ApprovalPolicyRequest

name · string · required

Human-readable policy name (≤128 chars). Used in audit logs.

tool_patterns · string[]

Tool-name patterns that trigger this policy. Glob-style: computer:* matches every computer-tool action, bash:rm * matches bash with rm-prefixed input. Each pattern ≤256 chars.

auto_approve_rules · object

Optional rules that auto-approve a matching tool call without human review. Free-form dict — see operator docs for the supported keys (max_per_hour, allow_safe_subset, etc.).

Response

ApprovalPolicySummary

id · string · required

name · string · required

tool_patterns · string[] · required

auto_approve_rules · object · required

is_active · boolean · required

created_at · string · required

updated_at · string · required

Status codes

Code	Meaning
201	Successful Response
422	Validation Error

cURL

curl --request POST \
  --url 'https://api.computer.stateset.app/api/v1/approval-policies' \
  --header "X-API-Key: $STATESET_COMPUTER_USE_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "Two-Person Tent",
  "tool_patterns": [
    "string"
  ],
  "auto_approve_rules": {}
}'

201

{
  "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "name": "Two-Person Tent",
  "tool_patterns": [
    "string"
  ],
  "auto_approve_rules": {},
  "is_active": true,
  "created_at": "2026-08-31T14:22:05Z",
  "updated_at": "2026-08-31T14:22:05Z"
}