Skip to content
REST API access policies › API access policy › Authentication › Access Management
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Create REST API access policy

Create an API access policy and map an authentication profile to restrict the authentication type for a REST API. For example, you can create an API access policy that allows only ID token authentication for a REST API.

Before you begin

Make sure that an authentication profile is created. For more information, see Create an authentication profile.

Role required: api_service_admin, adaptive_auth_policy_admin

Procedure

  1. Navigate to All > System Web Services > REST API Access Policies.

  2. Select New.

  3. On the form, fill in the mandatory fields and submit.

Image omitted: rest-api-access-policy.png
API access policy fields
**Note:** You must reopen the submitted form to populate additional fields.
FieldDescription
NameUnique name of the API access policy.
ActiveOption to make the API access policy active.
REST APIThe REST API to which the access policy is applied. For example, Attachment API.
REST API PATHAPI path of the REST API. This field is auto-populated based on the selected REST API. For example, now/attachment.
HTTP MethodMethod used for interacting with the API. This field is auto-populated based on the selected REST API.
VersionVersion of the API. For example, v1. This field is auto-populated based on the selected REST API.Note: If you want to create an authentication policy for all versions of a REST API, you must create individual policies for each version.
ResourceChild resource of the REST API. This field is auto-populated based on the selected REST API. For example, /now/attachment
TableThe tables to which the API access policy applies. This option only applies to policies for the Table API.
ApplicationScope of the application.
GlobalOption to apply the policy to all methods, versions, and resources for the API.
Apply to all methodsOption to apply the policy to all the methods, versions, and resources for the API.
Apply to all resourcesOption to apply the policy to all or the API resources.
Apply to all versionsOption to apply the policy to all or the API versions.
Apply to all tablesOption to apply the policy to all tables. This option only applies to policies for the Table API.
Advertise all auth schemesDetermines whether the `WWW-Authenticate` header includes all configured authentication schemes. When set to `false` \(default\), the header includes only the most recently configured authentication profile in the policy. When set to `true`, the header lists all configured authentication schemes.
**Note:** To understand more about the API access policy prioritization, see [API access policy prioritization](api-access-policy-prioritization.md).

  1. Double-click Insert a new row.

  2. Select an inbound authentication profile from the list and select the save icon

Image omitted: green-checkmark.png
save icon.
For example, you can add **Basic Auth**, **ID Token**, **Certificate based Auth**, **OAuth** or **WSSE Auth**.

1.  To add one or more inbound authentication profiles, select **New** to create a new profile.

2.  Choose **What Kind of authentication profiles?**.

    -   **Create standard http authentication profiles**
    -   **Create WSSE authentication profiles**
    -   **Create API Key authentication profiles**
    -   **Create HMAC authentication profiles**
Image omitted: auth-profile.png
Authentication profile
3.  After creating the authentication profile, save the record.
  1. Select Submit to submit the REST API access policy.