---
title: "Create a Holder Policy"
description: "Endpoint: /v1/{target}/policy-store-service-api/policies/add | API Reference"
stack: "Enterprise Stack (commercial) — version 0.21.0"
stack_version: "0.21.0"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/enterprise-stack/services/holder-policy-store-service/policy-creation
generated: 2026-07-08
---
# Create a Holder Policy

**Option: CURL**

Endpoint:
`/v1/{target}/policy-store-service-api/policies/add` | [API Reference](https://enterprise.sandbox.walt.id/swagger/index.html#/Service%20%7C%20Wallet%20Service/post_v1__target__wallet_service_api_dependencies_add)

**Example Request**

```bash
curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/policy-store-service-api/policies/add' \
  -H 'accept: */*' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "_id": "waltid.tenant1.policy-store1.policy1",
  "policy": {
    "priority": 1,
    "description": "This policy checks for a name claim in the wallet and block the presentation if it exists.",
    "direction": null,
    "check": {
      "type": "basic",
        "claims_present": ["name"]
    },
    "action": "BLOCK"
  }
}'
```

**Path Parameters**

- `orgID`: - When performing operations within an organization, it is essential to use the organization's Base URL or
  another valid host alias. For example, if your organization is named `test`, your default Base URL will
  be `test.enterprise-sandbox.walt.dev` when using the sandbox environment.
- `target`: _resourceIdentifier_ - The target indicates the organization + tenant + serviceId in which to create the new
  policy
  and the policy's ID (`{organizationID}.{tenantID}.{PolicyStore}.[NewPolicyId]`), e.g.
  `waltid.tenant1.policy-store1.policy1`
- **Body Parameters**

- `_id`: _policyId_ - The unique identifier for the policy, typically in the format
  `{organizationID}.{tenantID}.{PolicyStore}.[NewPolicyId]`
- `policy`: _holderPolicy_ - The policy object containing:
    - `priority`: _integer_ - The priority of the policy (lower numbers have higher priority).
    - `description`: _string_ - A description of the policy.
    - `direction`: _string_ - The direction of the policy, can be `null` for no specific direction or "RECEIVE" | "PRESENT" for a specific direction.
    - `check`: _holderPolicyCheck_ - The check to perform, which can be a basic check or a DCQL query.
        - For a basic check, use:
          ```json
          {
            "type": "basic",
            "claims_present": ["claim1", "claim2"]
          }
          ```
        - For a DCQL check, use:
          ```json
          {
            "type": "dcql",
            "dcql_query": {
            "credentials": [
               {
                 "id": "example_jwt_vc",
                 "format": "JWT_VC_JSON",
                 "meta": {
                  "type": "W3cCredentialMeta",
                  "typeValues": [["OpenBadgeCredential", "VerifiableCredential"]]
                },
                 "claims": [
                  {
                    "path": ["credentialSubject", "achievement"]
                  }
                ]
              }
             ]
            }
          }
          ```
    - `action`: _string_ - The action to take if the check passes, either `ALLOW` or `BLOCK`.

- ---
**Response Codes**

- `201` - Policy successfully created.

---