# Create RBAC policy

Create a new RBAC policy that defines resource access for a role

Endpoint: POST /api/core/rbac/policies/
Version: 3.59.0-ai-plus
Security: PlatformApiKeyAuthentication

## Request fields (application/json):

  - `resources` (array, required)
    List of resource paths this policy grants access to (e.g., ['/platforms/1/mentors', '/platforms/1/mentors/settings'])

  - `role_id` (integer, required)
    ID of the role this policy applies to

  - `platform_key` (string, required)
    Platform key where this policy applies

  - `users_to_add` (array)
    List of user IDs to add to this Policy

  - `users_to_remove` (array)
    List of user IDs to remove from this Policy

  - `groups_to_add` (array)
    List of group IDs to add to this Policy

  - `groups_to_remove` (array)
    List of group IDs to remove from this Policy

## Response 201 fields (application/json):

  - `id` (integer, required)

  - `role` (object, required)
    Role information (read-only)

  - `role.name` (string, required)

  - `role.actions` (array, required)
    List of actions/permissions this role can perform (e.g., ['Ibl.Mentor/Settings/read', 'Ibl.Mentor/Settings/write'])

  - `platform` (object, required)
    Platform information (read-only)

  - `platform.key` (string, required)
    The platform key

  - `platform.name` (string,null)
    The name of the platform

  - `resources` (array, required)
    List of resource paths this policy grants access to (e.g., ['/platforms/1/mentors', '/platforms/1/mentors/settings'])

  - `users` (array, required)

  - `users.id` (integer, required)
    edX user ID

  - `users.username` (string,null)
    edX username

  - `groups` (array, required)

  - `groups.name` (string)
    Optional name of the group

  - `groups.unique_id` (string, required)
    The unique identifier for the group

  - `groups.description` (string)
    Optional group description