---
title: "Attach session policy"
url: https://hexelstudio.com/docs/api/ciam-iam/sessions/attach-session-policy
---

# Attach session policy

**POST** `/session-policies/{session_id}/policies`

Attach a policy document (a JSON string) to an STS session (the token's sid claim) in the caller's organization. Session policies only narrow: in that session an action is allowed only if some session policy Allows it and none Denies it. Enforced by the full evaluator (/internal/evaluate, /authz/*), not by policy snapshots.

## Path parameters

- `session_id: string`

  Session ID

## Headers

- `Authorization: string`

  `Bearer <token>`.

## Body parameters

- `created_at: optional string`

- `document: optional string`

- `id: optional string`

- `name: optional string`

- `organization_id: optional string`

  owner; set from the caller (migration 037)

- `session_id: optional string`

## Returns

`201` Created (`SessionPolicy`)

- `created_at: optional string`

- `document: optional string`

- `id: optional string`

- `name: optional string`

- `organization_id: optional string`

  owner; set from the caller (migration 037)

- `session_id: optional string`

## Errors

- `400` Bad Request

## Example

```bash
curl --request POST \
  --url 'https://api.hexelstudio.com/v1/session-policies/{session_id}/policies' \
  --header "Authorization: Bearer $ACCESS_TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{
  "created_at": "2026-01-01T00:00:00Z",
  "document": "string",
  "id": "string",
  "name": "string",
  "organization_id": "string",
  "session_id": "string"
}'
```

### Response (201)

```json
{
  "created_at": "2026-01-01T00:00:00Z",
  "document": "string",
  "id": "string",
  "name": "string",
  "organization_id": "string",
  "session_id": "string"
}
```

### Response (400)

```json
{
  "key": "string"
}
```