---
sourceDocument: Xanadu Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/platform-security

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Create REST API access policy

# Create REST API access policy {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Create an API access policy and map an authentication profile to restrict the
authentication type for a REST API. For example, you can create an API access policy that
allows only ID token authentication for a REST API.

## Before you begin

* Role required: admin
* Make sure that an authentication profile is created. For more information, see [Create an authentication
  profile](https://www.servicenow.com/docs/qXEiEKz8uDLYAuF3AU3GOw "Create an authentication profile and add one or more authentication policies to the profile. You can also configure the ID Token and OAuth Token authentication profiles that are available by default.").
{#create-api-access-policy__ul_t32_dn5_d4b}

## Procedure

1. Navigate to AllSystem Web ServicesREST API Access Policies.
2. Click New.
3. On the form, fill in the fields.  
   {#create-api-access-policy__table_d4x_w45_d4b__entry__2}

   | Field | Description |
   |-|-|
   | Name | Unique name of the API access policy. |
   | Active | Option to make the API access policy active. |
   | REST API | The REST API to which the access policy is applied. For example, Attachment API. |
   | REST API PATH | API path of the REST API. This field is auto-populated based on the selected REST API. For example, now/attachment. |
   | HTTP Method | Method used for interacting with the API. This field is auto-populated based on the selected REST API. |
   | Version | Version of the API. For example, v1. This field is auto-populated based on the selected REST API. Note: If you want to create an authentication policy for all versions of a REST API, you must create individual policies for each version. |
   | Resource | Child resource of the REST API. This field is auto-populated based on the selected REST API. For example, /now/attachment |
   | Application | Scope of the application. |
   | Global | Enable to apply auth policy to all methods, versions, and resources for the API. |
   | Apply to all methods | Enable to apply auth policy for the API to all the methods, versions, and resources for the API. |
   | Apply to all resources | Enable to apply auth policy for the API to all the versions. |
   | Apply to all versions | Enable to apply auth policy for the API to all the resources. |
   [Table 1. API Access Policies]

   {#create-api-access-policy__table_d4x_w45_d4b}  
   Note:  
   To understand more about the API access policy prioritization, see [API access policy prioritization](https://www.servicenow.com/docs/zcH2ObyNRSWcKCIWemBVGA "Learn about the policy prioritization logic if there are multiple API access policy configured for your ServiceNow instance.").
4. Double-click Insert a new row.
5. Select an inbound authentication profile from the list and click the save icon ![save icon]().  
   For example, you can add Basic Auth, ID Token, Certificate based Auth, OAuth or WSSE Auth.
   1. To add one or more inbound authentication profiles, click New to create a new profile.
   2. Choose What Kind of authentication profiles?.  
      * Create standard http authentication profiles
      * Create WSSE authentication profiles

      {#create-api-access-policy__ul_bnj_gpr_2wb}
   3. After creating the authentication profile, save the record.
   {#create-api-access-policy__substeps_vvx_qvx_2wb}
6. Click Submit to submit the REST API access policy.

*[\>]: and then