> ## Documentation Index > Fetch the complete documentation index at: https://www.qovery.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Create an organization policy api token > Create a policy api token, intended for autonomous agents calling the Qovery API. Unlike a regular api token, a policy api token carries **no organization role**. The Open Policy Agent (rego) policy attached to it is evaluated on every request and is the only thing constraining what the token can do: a policy that allows everything grants full organization admin access. For that reason only an organization owner or admin can create one. The generated token value is returned only in this response and cannot be retrieved afterwards. ## OpenAPI ````yaml /api-reference/openapi.yaml post /organization/{organizationId}/policyApiToken openapi: 3.0.0 info: version: 1.0.4 title: Qovery API description: > - Qovery is the fastest way to deploy your full-stack apps on any Cloud provider. - ℹ️ The API is stable and still in development. contact: name: Qovery Product Team url: https://www.qovery.com email: support+api+documentation@qovery.com x-logo: url: https://console.qovery.com/assets/logos/logo-white.svg altText: Qovery servers: - url: https://api.qovery.com security: - bearerAuth: [] - ApiKeyAuth: [] tags: - name: Account - name: Account Info - name: IPs - name: Alert Receivers - name: Alert Rules - name: Admin - name: ArgoCD - name: Application - name: Application Actions - name: Application Configuration - name: Application Database - name: Application Deployment Restriction - name: Application Deployment History - name: Application Environment Variable - name: Application Logs - name: Application Main Calls - name: Application Secret - name: Application Annotations Group - name: Applications - name: AutoscalingPolicy - name: Container - name: Container Actions - name: Container Configuration - name: Container Database - name: Container Deployment History - name: Container Environment Variable - name: Container Logs - name: Container Main Calls - name: Container Registry - name: Container Secret - name: Container Annotations Group - name: Containers - name: Deployment Stage Main Calls - name: Job - name: Job Actions - name: Job Configuration - name: Job Database - name: Job Deployment Restriction - name: Job Deployment History - name: Job Environment Variable - name: Job Logs - name: Job Main Calls - name: Job Registry - name: Job Secret - name: Job Annotations Group - name: Jobs - name: KedaTriggerAuthentication - name: Helm - name: Helm Actions - name: Helm Configuration - name: Helm Database - name: Helm Deployment Restriction - name: Helm Deployment History - name: Helm Logs - name: Helm Main Calls - name: Helm Repository - name: Helms - name: Backups - name: Billing - name: Blueprint Catalog - name: Cloud Provider - name: Cloud Provider Credentials - name: Clusters - name: Platform Configuration - name: Custom Domain - name: Container Custom Domain - name: Database - name: Database Actions - name: Database Application - name: Database Container - name: Database Deployment History - name: Database Main Calls - name: Database Annotations Group - name: Databases - name: Environment - name: Environment Actions - name: Environment Deployment History - name: Environment Deployment Rule - name: Environment Logs - name: Environment Main Calls - name: Environment Secret - name: Environment Variable - name: Environments - name: Git - name: Github App - name: Git repositories - name: Members - name: Organization - name: Organization Account Git Repositories - name: Organization Cluster Lock - name: Organization Main Calls - name: Organization Custom Role - name: Organization Event - name: Organization Api Token - name: Organization Policy Api Token - name: Organization Webhook - name: Organization Annotations Group - name: Organization Labels Group - name: Organization Enterprise Connection - name: Project - name: Project Deployment Rule - name: Project Environment Variable - name: Project Main Calls - name: Project Secret - name: Projects - name: Referral & Rewards - name: Secret Manager Access - name: Terraforms - name: Terraform Main Calls - name: Terraform Resources - name: Terraform Deployment History - name: Terraform Deployment Restriction - name: Container Registries - name: Helm Repositories - name: User Sign Up - name: Variable Main Calls - name: Helm Custom Domain - name: Lifecycle Template Main Calls - name: Blueprint Main Calls paths: /organization/{organizationId}/policyApiToken: post: tags: - Organization Policy Api Token summary: Create an organization policy api token description: >- Create a policy api token, intended for autonomous agents calling the Qovery API. Unlike a regular api token, a policy api token carries **no organization role**. The Open Policy Agent (rego) policy attached to it is evaluated on every request and is the only thing constraining what the token can do: a policy that allows everything grants full organization admin access. For that reason only an organization owner or admin can create one. The generated token value is returned only in this response and cannot be retrieved afterwards. operationId: createOrganizationPolicyApiToken parameters: - $ref: '#/components/parameters/organizationId' requestBody: content: application/json: schema: $ref: '#/components/schemas/OrganizationPolicyApiTokenCreateRequest' responses: '201': description: Organization policy api token created content: application/json: schema: $ref: '#/components/schemas/OrganizationPolicyApiTokenCreate' '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '404': $ref: '#/components/responses/404' '409': description: Organization Policy Api Token name is already taken components: parameters: organizationId: name: organizationId in: path description: Organization ID required: true schema: type: string format: uuid schemas: OrganizationPolicyApiTokenCreateRequest: type: object required: - name - opa_policy properties: name: type: string description: type: string opa_policy: type: string description: >- Open Policy Agent (rego) rule definitions, without a `package` declaration: Qovery prepends a per-token package so that one token's rules cannot authorize another's. The policy must define an `allow` rule, and the request is denied unless it evaluates to true. expires_at: type: string format: date-time nullable: true OrganizationPolicyApiTokenCreate: allOf: - $ref: '#/components/schemas/Base' - type: object properties: name: type: string description: type: string token: type: string description: >- the generated token to send in 'Authorization' header prefixed by 'Token '. It is returned only here and cannot be retrieved afterwards. creator_name: type: string nullable: true user_sub: type: string expires_at: type: string format: date-time nullable: true Base: type: object required: - id - created_at properties: id: type: string format: uuid readOnly: true created_at: type: string readOnly: true format: date-time updated_at: type: string readOnly: true format: date-time responses: '400': description: Bad request '401': description: Access token is missing or invalid '403': description: Access forbidden '404': description: Resource not found securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- JWT tokens should be used with OIDC account (human to machine). JWT tokens used by the Qovery console to communicate with the API have a TTL. Curl Example ' curl https://console.qovery.com/organization -H "Authorization: Bearer $qovery_token" ' ApiKeyAuth: type: apiKey in: header name: Authorization description: >- Token API are generated by Qovery to manage machine to machine interaction and do not have a TTL. Curl Example ' curl https://console.qovery.com/organization -H "Authorization: Token $qovery_token" ' ````