# Access Policies ## Access policies An access policy is a set of rules and each one determines the access to one or multiple resources. Access policies can be managed via . When creating access policies you should give access only to the resources you need to access via the API. ### Creating an access policy In this example we will create an access policy that will allow you to send and retrieve messages sent to any channels in your workspace

Create a custom policy

1. The first step is to give your access policy a meaningful **name** and **description.** \

Access Policy Name and Description

2. Next define a policy definition. The one shown will **Allow** you to **Create** (POST/Send) messages to the /channels endpoint and also create media for sending image messages

Access Policy Create Definition

3. The second policy definition will **Allow** you to **View** (GET) all messages and specific messages on channels 4. Finally Create Policy\

Access Policy Get Definition

### Understanding policy definitions Policy definitions provide extremely fine grained control over the endpoints in your workspace. Each of your access policies can have one or more definitions. By default any endpoints that do not have explicit allow access (will result in access denied when trying to access them). Examining a definition in detail: | Field Name | Description | Values | | | | | ----------- | -------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | ------------------------------------------ | ---------- | | Effect | Allow or deny permission to a list of resources |

Allow
Deny

| | | | | Action | Allow any or specific actions on the attached resource(s) |

Any
Create (POST)
View (GET | HEAD | OPTIONS)
Delete (DELETE)
Update (PUT | PATCH)

| | Resource(s) | Path of the resource. Policy definitions can contain one or more resources |

Path of the resource. Example: /workspaces/{workspaceID}/channels

Valid wildcards:

\* - Any value for a specific part of the path e.g. /workspaces/*/channels (applies to all workspaces in an organisation)

\*\* - Any value for all child paths e.g. /workspaces/*/channels/\*\* (access to all paths below /channels)

| | | | --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.bird.com/api/api-access/access-policies.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.