Hexel StudioDocs

Attach session policy

POST/session-policies/{session_id}/policies

Attach a policy document (a JSON string) to an STS session (the token's sid claim) in the caller's organization. Session policies only narrow: in that session an action is allowed only if some session policy Allows it and none Denies it. Enforced by the full evaluator (/internal/evaluate, /authz/*), not by policy snapshots.

Path parameters

session_idstring

Session ID

Headers

Authorizationstring

Bearer <token>.

Body parameters

Session Policy

created_atoptional string

documentoptional string

idoptional string

nameoptional string

organization_idoptional string

owner; set from the caller (migration 037)

session_idoptional string

Returns

201CreatedSessionPolicy

created_atoptional string

documentoptional string

idoptional string

nameoptional string

organization_idoptional string

owner; set from the caller (migration 037)

session_idoptional string

Errors

400Bad Request

POST Request

curl --request POST \
  --url 'https://api.hexelstudio.com/v1/session-policies/{session_id}/policies' \
  --header "Authorization: Bearer $ACCESS_TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{
  "created_at": "2026-01-01T00:00:00Z",
  "document": "string",
  "id": "string",
  "name": "string",
  "organization_id": "string",
  "session_id": "string"
}'

const res = await fetch("https://api.hexelstudio.com/v1/session-policies/{session_id}/policies", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ACCESS_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "created_at": "2026-01-01T00:00:00Z",
    "document": "string",
    "id": "string",
    "name": "string",
    "organization_id": "string",
    "session_id": "string"
  }),
})
const data = await res.json()

import os
import requests

res = requests.post(
    "https://api.hexelstudio.com/v1/session-policies/{session_id}/policies",
    headers={"Authorization": f"Bearer {os.environ['ACCESS_TOKEN']}"},
    json={
        "created_at": "2026-01-01T00:00:00Z",
        "document": "string",
        "id": "string",
        "name": "string",
        "organization_id": "string",
        "session_id": "string",
    },
)
data = res.json()

Response

{
  "created_at": "2026-01-01T00:00:00Z",
  "document": "string",
  "id": "string",
  "name": "string",
  "organization_id": "string",
  "session_id": "string"
}

{
  "key": "string"
}