> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentwallex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tạo chính sách

> Tạo chính sách mới và gắn vào một agent.

Chính sách kiểm soát các giao dịch mà agent được phép thực hiện. Mọi giao dịch đều được đánh giá theo các chính sách của agent trước khi ký MPC.

### Nội dung yêu cầu

<ParamField body="agent_id" type="string" required>
  Agent để gắn chính sách này.
</ParamField>

<ParamField body="type" type="string" required>
  Loại chính sách. Giá trị: `spending_limit`, `address_control`, `token_control`, `velocity_control`, `schedule`, `human_approval`.
</ParamField>

<ParamField body="rules" type="object" required>
  Đối tượng quy tắc chính sách. Cấu trúc phụ thuộc vào `type`.

  <Expandable title="Quy tắc giới hạn chi tiêu">
    <ParamField body="max_transaction_amount" type="string">Số tiền tối đa mỗi giao dịch.</ParamField>
    <ParamField body="daily_limit" type="string">Tổng luân chuyển 24 giờ.</ParamField>
    <ParamField body="monthly_limit" type="string">Tổng luân chuyển 30 ngày.</ParamField>
  </Expandable>

  <Expandable title="Quy tắc kiểm soát địa chỉ">
    <ParamField body="allowed_addresses" type="string[]">Danh sách trắng địa chỉ người nhận.</ParamField>
    <ParamField body="blocked_addresses" type="string[]">Danh sách đen địa chỉ.</ParamField>
  </Expandable>

  <Expandable title="Quy tắc kiểm soát token">
    <ParamField body="allowed_tokens" type="string[]">Các ký hiệu token được phép (ví dụ: `["USDC", "USDT"]`).</ParamField>
  </Expandable>

  <Expandable title="Quy tắc kiểm soát tần suất">
    <ParamField body="max_count" type="integer">Số giao dịch tối đa trong cửa sổ.</ParamField>
    <ParamField body="window_seconds" type="integer">Cửa sổ thời gian tính bằng giây.</ParamField>
  </Expandable>

  <Expandable title="Quy tắc lịch trình">
    <ParamField body="timezone" type="string">Múi giờ IANA (ví dụ: `America/New_York`).</ParamField>
    <ParamField body="allowed_hours" type="object">Đối tượng với giờ `start` và `end` (0-23).</ParamField>
    <ParamField body="allowed_days" type="integer[]">Các ngày được phép (1=Thứ Hai, 7=Chủ Nhật).</ParamField>
  </Expandable>

  <Expandable title="Quy tắc phê duyệt thủ công">
    <ParamField body="threshold" type="string">Số tiền vượt quá mức này cần phê duyệt.</ParamField>
    <ParamField body="timeout_seconds" type="integer">Thời gian trước khi tự động từ chối.</ParamField>
    <ParamField body="approvers" type="string[]">Địa chỉ email của người phê duyệt.</ParamField>
  </Expandable>
</ParamField>

### Ví dụ

```bash theme={null}
curl -X POST https://api.agentwallex.com/api/v1/policies \
  -H "X-API-Key: awx_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_id": "agent_abc123",
    "type": "spending_limit",
    "rules": {
      "max_transaction_amount": "500",
      "daily_limit": "5000",
      "monthly_limit": "50000"
    }
  }'
```


## OpenAPI

````yaml POST /api/v1/policies
openapi: 3.1.0
info:
  title: AgentWallex API
  description: >-
    REST API for managing AI agent wallets, on-chain transactions, spending
    policies, webhooks, and x402 micropayments.
  version: 1.0.0
  contact:
    name: AgentWallex Support
    url: https://agentwallex.com
servers:
  - url: https://api.agentwallex.com
    description: Production
  - url: https://api-sandbox.agentwallex.com
    description: Sandbox
security:
  - ApiKeyAuth: []
  - BearerAuth: []
tags:
  - name: Agents
    description: Create and manage AI agent wallets.
  - name: Transactions
    description: Send payments and query transaction history.
  - name: Policies
    description: Configure spending limits and access controls.
  - name: Webhooks
    description: Register and manage webhook endpoints.
  - name: x402
    description: x402 micropayment negotiation and session management.
paths:
  /api/v1/policies:
    post:
      tags:
        - Policies
      summary: Create Policy
      description: >-
        Create a new policy and attach it to an agent. Policies control what
        transactions an agent is allowed to execute. Every transaction is
        evaluated against the agent's policies before MPC signing.
      operationId: createPolicy
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - agent_id
                - type
                - rules
              properties:
                agent_id:
                  type: string
                  description: Agent to attach this policy to.
                type:
                  type: string
                  enum:
                    - spending_limit
                    - address_control
                    - token_control
                    - velocity_control
                    - schedule
                    - human_approval
                  description: Policy type.
                rules:
                  $ref: '#/components/schemas/PolicyRules'
            example:
              agent_id: agent_abc123
              type: spending_limit
              rules:
                max_transaction_amount: '500'
                daily_limit: '5000'
                monthly_limit: '50000'
      responses:
        '200':
          description: Policy created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Policy'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/RateLimited'
        '500':
          $ref: '#/components/responses/InternalError'
components:
  schemas:
    PolicyRules:
      type: object
      description: Policy rules object. Structure depends on the policy type.
      properties:
        max_transaction_amount:
          type: string
          description: Max per-transaction amount (spending_limit).
        daily_limit:
          type: string
          description: Rolling 24-hour total (spending_limit).
        monthly_limit:
          type: string
          description: Rolling 30-day total (spending_limit).
        allowed_addresses:
          type: array
          items:
            type: string
          description: Whitelisted recipient addresses (address_control).
        blocked_addresses:
          type: array
          items:
            type: string
          description: Blacklisted addresses (address_control).
        allowed_tokens:
          type: array
          items:
            type: string
          description: Permitted token symbols (token_control), e.g., `["USDC", "USDT"]`.
        max_count:
          type: integer
          description: Maximum number of transactions in the window (velocity_control).
        window_seconds:
          type: integer
          description: Time window in seconds (velocity_control).
        timezone:
          type: string
          description: IANA timezone, e.g., `America/New_York` (schedule).
        allowed_hours:
          type: object
          description: Object with `start` and `end` hour, 0-23 (schedule).
          properties:
            start:
              type: integer
              minimum: 0
              maximum: 23
              description: Start hour (0-23).
            end:
              type: integer
              minimum: 0
              maximum: 23
              description: End hour (0-23).
        allowed_days:
          type: array
          items:
            type: integer
            minimum: 1
            maximum: 7
          description: Allowed days (1=Monday, 7=Sunday) (schedule).
        threshold:
          type: string
          description: Amount above which approval is required (human_approval).
        timeout_seconds:
          type: integer
          description: Time before auto-reject (human_approval).
        approvers:
          type: array
          items:
            type: string
            format: email
          description: Email addresses of approvers (human_approval).
    Policy:
      type: object
      description: A policy that controls what transactions an agent is allowed to execute.
      properties:
        id:
          type: string
          description: Unique policy identifier (e.g., `pol_abc123`).
        agent_id:
          type: string
          description: Agent this policy is attached to.
        type:
          type: string
          enum:
            - spending_limit
            - address_control
            - token_control
            - velocity_control
            - schedule
            - human_approval
          description: Policy type.
        rules:
          $ref: '#/components/schemas/PolicyRules'
        created_at:
          type: string
          format: date-time
          description: ISO 8601 creation timestamp.
        updated_at:
          type: string
          format: date-time
          description: ISO 8601 last-update timestamp.
    ErrorResponse:
      type: object
      description: Standard error response.
      required:
        - code
        - type
        - message
      properties:
        code:
          type: string
          description: Machine-readable error code.
        type:
          type: string
          enum:
            - invalid_request_error
            - authentication_error
            - authorization_error
            - not_found_error
            - rate_limit_error
            - internal_error
          description: Error type category.
        message:
          type: string
          description: Human-readable error description.
  responses:
    BadRequest:
      description: Invalid request body or parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            code: invalid_request
            type: invalid_request_error
            message: The request body is missing required fields.
    Unauthorized:
      description: Missing or invalid credentials.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            code: authentication_failed
            type: authentication_error
            message: The provided API key is invalid or expired.
    Forbidden:
      description: Insufficient permissions.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            code: insufficient_permissions
            type: authorization_error
            message: You do not have permission to perform this action.
    RateLimited:
      description: Rate limit exceeded.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            code: rate_limit_exceeded
            type: rate_limit_error
            message: Too many requests. Please retry after a short delay.
    InternalError:
      description: Server-side error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            code: server_error
            type: internal_error
            message: An unexpected error occurred. Please try again later.
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
      description: API key authentication. Keys are prefixed with `awx_`.
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: JWT bearer token authentication.

````