> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amlok.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create risk policy version

> Store an immutable policy version. AMLOK validates typed rules and units; attached policy documents provide context and do not become executable rules automatically.

Store an immutable policy version. AMLOK validates typed rules and units; attached policy documents provide context and do not become executable rules automatically. All IDs and cursors must belong to the authorized workspace and environment. Required scope: configuration:write.

Examples use synthetic IDs. Replace them with values returned by your environment.


## OpenAPI

````yaml openapi/amlok.json POST /v1/risk-policy-versions
openapi: 3.1.0
info:
  title: AMLOK API
  version: 1.0.0
  description: >-
    AMLOK API: borrower connections, Insights origination, immutable risk
    packages and Signal monitoring. Use your institution-issued API origin.
servers: []
security:
  - BearerAuth: []
paths:
  /v1/risk-policy-versions:
    post:
      tags:
        - Configuration
      summary: Create risk policy version
      description: >-
        Store an immutable policy version. AMLOK validates typed rules and
        units; attached policy documents provide context and do not become
        executable rules automatically. All IDs and cursors must belong to the
        authorized workspace and environment. Required scope:
        configuration:write.
      operationId: createRiskPolicyVersion
      parameters:
        - name: Idempotency-Key
          in: header
          required: true
          schema:
            type: string
            minLength: 1
          description: >-
            Stable for one intended command and its retries, scoped to key
            workspace/environment and operation. Mismatched body returns 409.
            Full response replay 24 hours; durable receipt remains.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RiskPolicyInput'
            example:
              external_id: working-capital-policy
              version: '1'
              name: Illustrative policy, not a recommended threshold
              borrower_type: business
              market: CA
              rules:
                - id: dscr-minimum
                  dimension_key: dscr
                  operator: gte
                  threshold: '1.25'
                  unit: ratio
                  on_missing: review
                  on_fail: review
                  calculation_version: amlok-dscr-1
              policy_document_ids: []
      responses:
        '201':
          description: Successful response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/RiskPolicyVersion'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
                additionalProperties: false
              example:
                data:
                  id: rpv_synthetic
                  created_at: '2026-11-06T12:00:00Z'
                  definition:
                    external_id: working-capital-policy
                    version: '1'
                    name: Illustrative policy, not a recommended threshold
                    borrower_type: business
                    market: CA
                    rules:
                      - id: dscr-minimum
                        dimension_key: dscr
                        operator: gte
                        threshold: '1.25'
                        unit: ratio
                        on_missing: review
                        on_fail: review
                        calculation_version: amlok-dscr-1
                    policy_document_ids: []
                  sha256: >-
                    0000000000000000000000000000000000000000000000000000000000000000
                meta:
                  request_id: req_synthetic
                  schema_version: 1.0.0
                  environment: sandbox
          headers:
            X-Request-ID:
              schema:
                type: string
                minLength: 1
              description: Same request ID as meta.request_id or error.request_id.
        '400':
          description: >-
            Inspect structured error; retry only when retryable. 429 and 503 can
            include Retry-After.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    $ref: '#/components/schemas/Error'
                required:
                  - error
                additionalProperties: false
              example:
                error:
                  code: validation_error
                  message: Validation error.
                  retryable: false
                  request_id: req_synthetic
                  field: null
          headers:
            X-Request-ID:
              schema:
                type: string
                minLength: 1
              description: Same request ID as meta.request_id or error.request_id.
        '401':
          description: >-
            Inspect structured error; retry only when retryable. 429 and 503 can
            include Retry-After.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    $ref: '#/components/schemas/Error'
                required:
                  - error
                additionalProperties: false
              example:
                error:
                  code: unauthenticated
                  message: Unauthenticated.
                  retryable: false
                  request_id: req_synthetic
                  field: null
          headers:
            X-Request-ID:
              schema:
                type: string
                minLength: 1
              description: Same request ID as meta.request_id or error.request_id.
        '402':
          description: >-
            Inspect structured error; retry only when retryable. 429 and 503 can
            include Retry-After.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    $ref: '#/components/schemas/Error'
                required:
                  - error
                additionalProperties: false
              example:
                error:
                  code: insufficient_credits
                  message: Insufficient credits.
                  retryable: false
                  request_id: req_synthetic
                  field: null
          headers:
            X-Request-ID:
              schema:
                type: string
                minLength: 1
              description: Same request ID as meta.request_id or error.request_id.
        '403':
          description: >-
            Inspect structured error; retry only when retryable. 429 and 503 can
            include Retry-After.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    $ref: '#/components/schemas/Error'
                required:
                  - error
                additionalProperties: false
              example:
                error:
                  code: forbidden
                  message: Forbidden.
                  retryable: false
                  request_id: req_synthetic
                  field: null
          headers:
            X-Request-ID:
              schema:
                type: string
                minLength: 1
              description: Same request ID as meta.request_id or error.request_id.
        '404':
          description: >-
            Inspect structured error; retry only when retryable. 429 and 503 can
            include Retry-After.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    $ref: '#/components/schemas/Error'
                required:
                  - error
                additionalProperties: false
              example:
                error:
                  code: not_found
                  message: Not found.
                  retryable: false
                  request_id: req_synthetic
                  field: null
          headers:
            X-Request-ID:
              schema:
                type: string
                minLength: 1
              description: Same request ID as meta.request_id or error.request_id.
        '409':
          description: >-
            Inspect structured error; retry only when retryable. 429 and 503 can
            include Retry-After.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    $ref: '#/components/schemas/Error'
                required:
                  - error
                additionalProperties: false
              example:
                error:
                  code: idempotency_conflict
                  message: Idempotency conflict.
                  retryable: false
                  request_id: req_synthetic
                  field: null
          headers:
            X-Request-ID:
              schema:
                type: string
                minLength: 1
              description: Same request ID as meta.request_id or error.request_id.
        '410':
          description: >-
            Inspect structured error; retry only when retryable. 429 and 503 can
            include Retry-After.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    $ref: '#/components/schemas/Error'
                required:
                  - error
                additionalProperties: false
              example:
                error:
                  code: cursor_expired
                  message: Cursor expired.
                  retryable: false
                  request_id: req_synthetic
                  field: null
          headers:
            X-Request-ID:
              schema:
                type: string
                minLength: 1
              description: Same request ID as meta.request_id or error.request_id.
        '413':
          description: >-
            Request exceeds the effective profile size limit or media type is
            unsupported. No command is accepted.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    $ref: '#/components/schemas/Error'
                required:
                  - error
                additionalProperties: false
              example:
                error:
                  code: payload_too_large
                  message: payload too large
                  retryable: false
                  request_id: req_synthetic
                  field: null
        '415':
          description: >-
            Request exceeds the effective profile size limit or media type is
            unsupported. No command is accepted.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    $ref: '#/components/schemas/Error'
                required:
                  - error
                additionalProperties: false
              example:
                error:
                  code: unsupported_media_type
                  message: unsupported media type
                  retryable: false
                  request_id: req_synthetic
                  field: null
        '422':
          description: >-
            Inspect structured error; retry only when retryable. 429 and 503 can
            include Retry-After.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    $ref: '#/components/schemas/Error'
                required:
                  - error
                additionalProperties: false
              example:
                error:
                  code: validation_error
                  message: Validation error.
                  retryable: false
                  request_id: req_synthetic
                  field: null
          headers:
            X-Request-ID:
              schema:
                type: string
                minLength: 1
              description: Same request ID as meta.request_id or error.request_id.
        '429':
          description: >-
            Inspect structured error; retry only when retryable. 429 and 503 can
            include Retry-After.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    $ref: '#/components/schemas/Error'
                required:
                  - error
                additionalProperties: false
              example:
                error:
                  code: rate_limited
                  message: Rate limited.
                  retryable: true
                  request_id: req_synthetic
                  field: null
          headers:
            Retry-After:
              description: Minimum delay in seconds before retry.
              schema:
                type: integer
                minimum: 0
            X-Request-ID:
              schema:
                type: string
                minLength: 1
              description: Same request ID as meta.request_id or error.request_id.
        '503':
          description: >-
            Inspect structured error; retry only when retryable. 429 and 503 can
            include Retry-After.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    $ref: '#/components/schemas/Error'
                required:
                  - error
                additionalProperties: false
              example:
                error:
                  code: temporarily_unavailable
                  message: Temporarily unavailable.
                  retryable: true
                  request_id: req_synthetic
                  field: null
          headers:
            Retry-After:
              description: Minimum delay in seconds before retry.
              schema:
                type: integer
                minimum: 0
            X-Request-ID:
              schema:
                type: string
                minLength: 1
              description: Same request ID as meta.request_id or error.request_id.
      security:
        - BearerAuth: []
      x-codeSamples:
        - lang: Shell
          label: cURL
          source: |-
            curl --request POST --fail-with-body --max-time 30 \
              "${AMLOK_API_BASE_URL}/v1/risk-policy-versions" \
              --header "Authorization: Bearer ${AMLOK_API_KEY}" \
              --header 'Accept: application/json' \
              --header 'Idempotency-Key: createRiskPolicyVersion-synthetic-0042' \
              --header 'Content-Type: application/json' \
              --data '{"external_id":"working-capital-policy","version":"1","name":"Illustrative policy, not a recommended threshold","borrower_type":"business","market":"CA","rules":[{"id":"dscr-minimum","dimension_key":"dscr","operator":"gte","threshold":"1.25","unit":"ratio","on_missing":"review","on_fail":"review","calculation_version":"amlok-dscr-1"}],"policy_document_ids":[]}'
        - lang: Python
          source: >
            import os

            import requests


            headers = {'Accept': 'application/json', 'Idempotency-Key':
            'createRiskPolicyVersion-synthetic-0042', 'Content-Type':
            'application/json'}

            headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]

            response = requests.request('POST', os.environ["AMLOK_API_BASE_URL"]
            + '/v1/risk-policy-versions', headers=headers, json={'external_id':
            'working-capital-policy', 'version': '1', 'name': 'Illustrative
            policy, not a recommended threshold', 'borrower_type': 'business',
            'market': 'CA', 'rules': [{'id': 'dscr-minimum', 'dimension_key':
            'dscr', 'operator': 'gte', 'threshold': '1.25', 'unit': 'ratio',
            'on_missing': 'review', 'on_fail': 'review', 'calculation_version':
            'amlok-dscr-1'}], 'policy_document_ids': []}, timeout=30,
            allow_redirects=False)

            response.raise_for_status()

            print(response.json())
        - lang: JavaScript
          source: >
            const headers = {"Accept": "application/json", "Idempotency-Key":
            "createRiskPolicyVersion-synthetic-0042", "Content-Type":
            "application/json"};

            headers.Authorization = `Bearer ${process.env.AMLOK_API_KEY}`;

            const response = await fetch(process.env.AMLOK_API_BASE_URL +
            "/v1/risk-policy-versions", {
              method: "POST", headers, redirect: "error", signal: AbortSignal.timeout(30000),
              body: JSON.stringify({"external_id": "working-capital-policy", "version": "1", "name": "Illustrative policy, not a recommended threshold", "borrower_type": "business", "market": "CA", "rules": [{"id": "dscr-minimum", "dimension_key": "dscr", "operator": "gte", "threshold": "1.25", "unit": "ratio", "on_missing": "review", "on_fail": "review", "calculation_version": "amlok-dscr-1"}], "policy_document_ids": []})
            });

            if (!response.ok) throw new Error(`HTTP ${response.status}: ${await
            response.text()}`);

            console.log(await response.json());
components:
  schemas:
    RiskPolicyInput:
      type: object
      properties:
        external_id:
          type: string
          minLength: 1
          description: >-
            External id for RiskPolicyInput. Constraints, requiredness and
            allowed values are defined by this schema.
        version:
          type: string
          minLength: 1
          description: >-
            Version for RiskPolicyInput. Constraints, requiredness and allowed
            values are defined by this schema.
        name:
          type: string
          minLength: 1
          description: >-
            Name for RiskPolicyInput. Constraints, requiredness and allowed
            values are defined by this schema.
        borrower_type:
          type: string
          enum:
            - business
            - person
          description: >-
            Borrower type for RiskPolicyInput. Constraints, requiredness and
            allowed values are defined by this schema.
        market:
          type: string
          enum:
            - US
            - CA
          description: >-
            Market for RiskPolicyInput. Constraints, requiredness and allowed
            values are defined by this schema.
        rules:
          type: array
          items:
            $ref: '#/components/schemas/PolicyRule'
          minItems: 1
          description: >-
            Rules for RiskPolicyInput. Constraints, requiredness and allowed
            values are defined by this schema.
        policy_document_ids:
          type: array
          items:
            type: string
            minLength: 1
            description: >-
              Opaque identifier, authorized within the API key workspace and
              environment.
          uniqueItems: true
          description: >-
            Policy document ids for RiskPolicyInput. Constraints, requiredness
            and allowed values are defined by this schema.
      required:
        - external_id
        - version
        - name
        - borrower_type
        - market
        - rules
        - policy_document_ids
      additionalProperties: false
      description: >-
        Validated against authorized dimensions and the institution-approved
        policy before use. Documents provide context; they are not automatically
        executable policies.
    RiskPolicyVersion:
      type: object
      properties:
        id:
          type: string
          minLength: 1
          description: >-
            Opaque identifier, authorized within the API key workspace and
            environment.
        created_at:
          type: string
          minLength: 1
          format: date-time
          description: UTC time the record was created.
        definition:
          $ref: '#/components/schemas/RiskPolicyInput'
          description: >-
            Definition for RiskPolicyVersion. Constraints, requiredness and
            allowed values are defined by this schema.
        sha256:
          type: string
          minLength: 1
          pattern: ^[a-f0-9]{64}$
          description: >-
            Sha256 for RiskPolicyVersion. Constraints, requiredness and allowed
            values are defined by this schema.
      required:
        - id
        - created_at
        - definition
        - sha256
      additionalProperties: false
    Meta:
      type: object
      properties:
        request_id:
          type: string
          minLength: 1
          description: >-
            Opaque identifier, authorized within the API key workspace and
            environment.
        schema_version:
          type: string
          minLength: 1
          description: >-
            Schema version for Meta. Constraints, requiredness and allowed
            values are defined by this schema.
        environment:
          type: string
          enum:
            - sandbox
            - live
          description: >-
            Environment for Meta. Constraints, requiredness and allowed values
            are defined by this schema.
      required:
        - request_id
        - schema_version
        - environment
      additionalProperties: false
    Error:
      type: object
      properties:
        code:
          type: string
          enum:
            - validation_error
            - unauthenticated
            - forbidden
            - not_found
            - invalid_state
            - idempotency_conflict
            - insufficient_credits
            - precondition_failed
            - cursor_expired
            - rate_limited
            - temporarily_unavailable
            - deal_snapshot_conflict
            - payload_too_large
            - unsupported_media_type
            - document_rejected
            - processing_failed
            - session_expired
            - consent_purpose_missing
            - sandbox_only
            - scenario_not_available
            - idempotency_result_expired
          description: >-
            Code for Error. Constraints, requiredness and allowed values are
            defined by this schema.
        message:
          type: string
          minLength: 1
          description: >-
            Message for Error. Constraints, requiredness and allowed values are
            defined by this schema.
        retryable:
          type: boolean
          description: >-
            Retryable for Error. Constraints, requiredness and allowed values
            are defined by this schema.
        request_id:
          type: string
          minLength: 1
          description: >-
            Opaque identifier, authorized within the API key workspace and
            environment.
        field:
          anyOf:
            - type: string
              minLength: 1
            - type: 'null'
          description: >-
            Field for Error. Constraints, requiredness and allowed values are
            defined by this schema.
      required:
        - code
        - message
        - retryable
        - request_id
        - field
      additionalProperties: false
    PolicyRule:
      type: object
      properties:
        id:
          type: string
          minLength: 1
          description: Opaque identifier for this PolicyRule record.
        dimension_key:
          type: string
          minLength: 1
          description: >-
            Scalar metric key from configuration.dimensions, for example dscr or
            debt_to_income, never a dimension-family name. Unit, borrower
            applicability and calculation version must match approved
            configuration.
        operator:
          type: string
          enum:
            - gt
            - gte
            - lt
            - lte
            - eq
          description: >-
            Operator for PolicyRule. Constraints, requiredness and allowed
            values are defined by this schema.
        threshold:
          type: string
          minLength: 1
          pattern: ^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$
          description: >-
            Threshold for PolicyRule. Constraints, requiredness and allowed
            values are defined by this schema.
        unit:
          type: string
          minLength: 1
          description: >-
            Unit for PolicyRule. Constraints, requiredness and allowed values
            are defined by this schema.
        on_missing:
          const: review
          description: >-
            On missing for PolicyRule. Constraints, requiredness and allowed
            values are defined by this schema.
        on_fail:
          type: string
          enum:
            - review
            - outside_policy
          description: >-
            On fail for PolicyRule. Constraints, requiredness and allowed values
            are defined by this schema.
        calculation_version:
          type: string
          minLength: 1
          description: >-
            Pin the calculation version returned by configuration.dimensions. A
            different method requires a new immutable risk-policy version.
      required:
        - id
        - dimension_key
        - operator
        - threshold
        - unit
        - on_missing
        - on_fail
        - calculation_version
      additionalProperties: false
      description: >-
        This rule language supports scalar comparisons only. Units and types
        must match the approved dimension. No executable code, arbitrary
        expressions or inferred pass for missing data.
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: API key
      description: >-
        Server-to-server API key bound to exactly one workspace, institution
        tenant and environment. No caller-supplied workspace override is
        accepted. Do not use in public browser code.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.