Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

Timbal API key. Obtain your API key from the Timbal platform settings. See Authentication for more information.

Path Parameters

org_id
string
required
kb_id
string
required

Body

application/json
name
string
required

Operator-facing label.

row_filter_dsl
object
required

Row predicate JSON. Stored opaquely in this release.

audit_level
enum<string>

Audit verbosity for matches against this rule.

Available options:
none,
normal,
verbose
break_glass_allowed
boolean
column_masks
null | object
compliance_tags
string[]
description
string | null
enabled
boolean

Defaults to true; set false to author the rule in a draft state.

external_id
string | null
labels
object

Free-form key/value labels.

purpose_tags
string[]
source
enum<string>

Provenance of the rule.

Available options:
manual,
imported,
derived
table_name
string | null

Target table within the knowledge base. Omit to apply to every table.

Response

Policy created

audit_level
enum<string>
required

Audit verbosity for matches against this rule.

Available options:
none,
normal,
verbose
break_glass_allowed
boolean
required

Whether sessions may bypass the rule via a logged escalation.

compliance_tags
string[]
required

Compliance classifications (e.g. hipaa.phi, pci.pan).

created_at
string<date-time>
required
enabled
boolean
required

When false, the rule body is inactive everywhere it is bound.

id
string
required
kb_id
string
required
labels
object
required

Free-form key/value labels.

name
string
required

Operator-facing label.

purpose_tags
string[]
required

Purpose-of-use bindings (e.g. treatment, research).

revision
integer<int32>
required

Revision token for optimistic concurrency on update and delete.

row_filter_dsl
object
required

Row predicate authored as JSON. Stored opaquely in this release.

source
enum<string>
required

Provenance of the rule.

Available options:
manual,
imported,
derived
updated_at
string<date-time>
required
column_masks
null | object

Per-column transformation map. Null means no masks. {"col": {"type":"redact"}} is the canonical "hide this column".

description
string | null
external_id
string | null
table_name
string | null

Target table within the knowledge base. Null applies to every table.