> For the complete documentation index, see [llms.txt](https://docs.enclaive.cloud/vault/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enclaive.cloud/vault/api/system-backend/sys-policies.md).

# /sys/policies/

The `/sys/policies` endpoints are used to manage ACL, RGP, and EGP policies in Vault.

RGPs and EGPs are Vault Enterprise upgrade features that are not available in Vault Open Source or basic Vault Enterprise installations.

### List ACL policies

This endpoint lists all configured ACL policies.

| Method | Path                |
| ------ | ------------------- |
| `LIST` | `/sys/policies/acl` |

#### Sample request

```shell-session
$ curl \
    -X LIST --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/sys/policies/acl
```

#### Sample response

```json
{
  "keys": ["root", "my-policy"]
}
```

### Read ACL policy

This endpoint retrieves information about the named ACL policy.

| Method | Path                      |
| ------ | ------------------------- |
| `GET`  | `/sys/policies/acl/:name` |

#### Parameters

* `name` `(string: <required>)` – Specifies the name of the policy to retrieve. This is specified as part of the request URL.

#### Sample request

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/sys/policies/acl/my-policy
```

#### Sample response

```json
{
  "name": "deploy",
  "policy": "path \"secret/foo\" {..."
}
```

### Create/Update ACL policy

This endpoint adds a new or updates an existing ACL policy. Once a policy is updated, it takes effect immediately to all associated users.

| Method | Path                      |
| ------ | ------------------------- |
| `POST` | `/sys/policies/acl/:name` |

#### Parameters

* `name` `(string: <required>)` – Specifies the name of the policy to create. This is specified as part of the request URL.
* `policy` `(string: <required>)` - Specifies the policy document. This can be base64-encoded to avoid string escaping.

#### Sample payload

```json
{
  "policy": "path \"secret/foo\" {..."
}
```

#### Sample request

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/sys/policies/acl/my-policy
```

### Delete ACL policy

This endpoint deletes the ACL policy with the given name. This will immediately affect all users associated with this policy. (A deleted policy set on a token acts as an empty policy.)

| Method   | Path                      |
| -------- | ------------------------- |
| `DELETE` | `/sys/policies/acl/:name` |

#### Parameters

* `name` `(string: <required>)` – Specifies the name of the policy to delete. This is specified as part of the request URL.

#### Sample request

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    http://127.0.0.1:8200/v1/sys/policies/acl/my-policy
```

### List RGP policies

This endpoint lists all configured RGP policies.

| Method | Path                |
| ------ | ------------------- |
| `LIST` | `/sys/policies/rgp` |

#### Sample request

```shell-session
$ curl \
    -X LIST --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/sys/policies/rgp
```

#### Sample response

```json
{
  "keys": ["webapp", "database"]
}
```

### Read RGP policy

This endpoint retrieves information about the named RGP policy.

| Method | Path                      |
| ------ | ------------------------- |
| `GET`  | `/sys/policies/rgp/:name` |

#### Parameters

* `name` `(string: <required>)` – Specifies the name of the policy to retrieve. This is specified as part of the request URL.

#### Sample request

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/sys/policies/rgp/webapp
```

#### Sample response

```json
{
  "name": "webapp",
  "policy": "rule main = {...",
  "enforcement_level": "soft-mandatory"
}
```

### Create/Update RGP policy

This endpoint adds a new or updates an existing RGP policy. Once a policy is updated, it takes effect immediately to all associated users.

| Method | Path                      |
| ------ | ------------------------- |
| `POST` | `/sys/policies/rgp/:name` |

#### Parameters

* `name` `(string: <required>)` – Specifies the name of the policy to create. This is specified as part of the request URL.
* `policy` `(string: <required>)` - Specifies the policy document. This can be base64-encoded to avoid string escaping.
* `enforcement_level` `(string: <required>)` - Specifies the enforcement level to use. This must be one of `advisory`, `soft-mandatory`, or `hard-mandatory`.

#### Sample payload

```json
{
  "policy": "rule main = {...",
  "enforcement_level": "soft-mandatory"
}
```

#### Sample request

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/sys/policies/rgp/webapp
```

### Delete RGP policy

This endpoint deletes the RGP policy with the given name. This will immediately affect all users associated with this policy. (A deleted policy set on a token acts as an empty policy.)

| Method   | Path                      |
| -------- | ------------------------- |
| `DELETE` | `/sys/policies/rgp/:name` |

#### Parameters

* `name` `(string: <required>)` – Specifies the name of the policy to delete. This is specified as part of the request URL.

#### Sample request

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    http://127.0.0.1:8200/v1/sys/policies/rgp/webapp
```

### List EGP policies

This endpoint lists all configured EGP policies. Since EGP policies act on a path, this endpoint returns two identifiers:

* `keys` contains a mapping of names to associated paths in a format that `vault list` understands
* `name_path_map` contains an object mapping names to paths and glob status in a more machine-friendly format

| Method | Path                |
| ------ | ------------------- |
| `LIST` | `/sys/policies/egp` |

#### Sample request

```shell-session
$ curl \
    -X LIST --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/sys/policies/egp
```

#### Sample response

```json
{
  "keys": ["breakglass"]
}
```

### Read EGP policy

This endpoint retrieves information about the named EGP policy.

| Method | Path                      |
| ------ | ------------------------- |
| `GET`  | `/sys/policies/egp/:name` |

#### Parameters

* `name` `(string: <required>)` – Specifies the name of the policy to retrieve. This is specified as part of the request URL.

#### Sample request

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/sys/policies/egp/breakglass
```

#### Sample response

```json
{
  "enforcement_level": "soft-mandatory",
  "name": "breakglass",
  "paths": ["*"],
  "policy": "rule main = {..."
}
```

### Create/Update EGP policy

This endpoint adds a new or updates an existing EGP policy. Once a policy is updated, it takes effect immediately to all associated users.

| Method | Path                      |
| ------ | ------------------------- |
| `POST` | `/sys/policies/egp/:name` |

#### Parameters

* `name` `(string: <required>)` – Specifies the name of the policy to create. This is specified as part of the request URL.
* `policy` `(string: <required>)` - Specifies the policy document. This can be base64-encoded to avoid string escaping.
* `enforcement_level` `(string: <required>)` - Specifies the enforcement level to use. This must be one of `advisory`, `soft-mandatory`, or `hard-mandatory`.
* `paths` `(string or array: required)` - Specifies the paths on which this EGP should be applied, either as a comma-separated list or an array. Glob characters can denote suffixes, e.g. `secret/*`; a path of `*` will affect all authenticated and login requests.

#### Sample payload

```json
{
  "policy": "rule main = {...",
  "paths": ["*", "secret/*", "transit/keys/*"],
  "enforcement_level": "soft-mandatory"
}
```

#### Sample request

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/sys/policies/egp/breakglass
```

### Delete EGP policy

This endpoint deletes the EGP policy with the given name from all paths on which it was configured.

| Method   | Path                      |
| -------- | ------------------------- |
| `DELETE` | `/sys/policies/egp/:name` |

#### Parameters

* `name` `(string: <required>)` – Specifies the name of the policy to delete. This is specified as part of the request URL.

#### Sample request

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    http://127.0.0.1:8200/v1/sys/policies/egp/breakglass
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.enclaive.cloud/vault/api/system-backend/sys-policies.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.