Create Firewall Policy
Create a new firewall policy (allow/block/challenge), with its conditions in the same call: pass conditions and the policy and every condition are saved together — or, if any condition is refused, nothing is. Without conditions the policy starts with none (attach them later via POST /v1/firewall/policies/{uuid}/conditions). A policy with zero conditions matches every request, so send its conditions with it, or create it with enabled: false and flip it on once its conditions are in.
Plan-gated: requires the firewall_policies entitlement.
Request body
allow (default), block or challenge. challenge makes HTTP visitors pass the edge browser check (the challenge rule's check) first; on TCP/UDP endpoints it blocks. Anything else returns 400.100.true. Set false while you build out conditions, then flip on.{type, operator, value, logical_operator?} exactly as in Add Firewall Condition. All are validated first, then the policy and its conditions are written in one transaction: all or nothing. Adding conditions takes the firewall update permission as well as create.Firewall policies are always account-scoped — they apply to every endpoint owned by the caller. There is no per-endpoint scope and no per-policy custom block status; block-action policies use the user's configured custom firewall error template if active, otherwise the platform default (HTTP 403).
Response (201 Created)
The newly-created policy, in the list entry shape: its id and uuid (the same uuid string), plus user_uuid and account_uuid, the stored fields, created_at / updated_at, hit_count (0 for a new policy) — and its conditions (each with its uuid) when you sent any (omitted otherwise).
Deprecated: until the sunset this response also carries the legacy integer user_id and account_id fields. Don't use them; read user_uuid and account_uuid.
Errors
name, invalid action, an invalid condition, or invalid JSON. A refused condition is named — "error": "Condition 2: …" with the field under fields as conditions[1].value (0-based) — and nothing is saved.firewall_policies, or your role lacks the firewall permission (create; with conditions, also update).