---
title: Create REST API access policy
description: Create an API access policy and map an authentication profile to restrict the authentication type for a REST API. For example, you can create an API access policy that allows only ID token authentication for a REST API.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/platform-security/authentication/create-api-access-policy.html
release: australia
product: Authentication
classification: authentication
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 2
breadcrumb: [REST API access policies, API access policy, Authentication, Access Management]
---

# Create REST API access policy

Create an API access policy and map an authentication profile to restrict the authentication type for a REST API. For example, you can create an API access policy that allows only ID token authentication for a REST API.

## Before you begin

Make sure that an authentication profile is created. For more information, see [Create an authentication profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/create-authentication-profile.md).

Role required: api\_service\_admin, adaptive\_auth\_policy\_admin

## Procedure

1.  Navigate to **All** > **System Web Services** > **REST API Access Policies**.

2.  Select **New**.

3.  On the form, fill in the mandatory fields and submit.

    \[Omitted image "rest-api-access-policy.png"\] Alt text: API access policy fields

    **Note:** You must reopen the submitted form to populate additional fields.

<table id="table_d4x_w45_d4b"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Name

</td><td>

Unique name of the API access policy.

</td></tr><tr><td>

Active

</td><td>

Option to make the API access policy active.

</td></tr><tr><td>

REST API

</td><td>

The REST API to which the access policy is applied. For example, **Attachment API**.

</td></tr><tr><td>

REST API PATH

</td><td>

API path of the REST API. This field is auto-populated based on the selected REST API. For example, **now/attachment**.

</td></tr><tr><td>

HTTP Method

</td><td>

Method used for interacting with the API. This field is auto-populated based on the selected REST API.

</td></tr><tr><td>

Version

</td><td>

Version of the API. For example, **v1**. This field is auto-populated based on the selected REST API.**Note:** If you want to create an authentication policy for all versions of a REST API, you must create individual policies for each version.

</td></tr><tr><td>

Resource

</td><td>

Child resource of the REST API. This field is auto-populated based on the selected REST API. For example, **/now/attachment**

</td></tr><tr><td>

Table

</td><td>

The tables to which the API access policy applies. This option only applies to policies for the Table API.

</td></tr><tr><td>

Application

</td><td>

Scope of the application.

</td></tr><tr><td>

Global

</td><td>

Option to apply the policy to all methods, versions, and resources for the API.

</td></tr><tr><td>

Apply to all methods

</td><td>

Option to apply the policy to all the methods, versions, and resources for the API.

</td></tr><tr><td>

Apply to all resources

</td><td>

Option to apply the policy to all or the API resources.

</td></tr><tr><td>

Apply to all versions

</td><td>

Option to apply the policy to all or the API versions.

</td></tr><tr><td>

Apply to all tables

</td><td>

Option to apply the policy to all tables. This option only applies to policies for the Table API.

</td></tr><tr><td>

[Advertise all auth schemes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/create-authentication-profile.md)

</td><td>

Determines whether the `WWW-Authenticate` header includes all configured authentication schemes. When set to `false` \(default\), the header includes only the most recently configured authentication profile in the policy. When set to `true`, the header lists all configured authentication schemes.

</td></tr></tbody>
</table>    **Note:** To understand more about the API access policy prioritization, see [API access policy prioritization](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/api-access-policy-prioritization.md).

4.  Double-click **Insert a new row**.

5.  Select an inbound authentication profile from the list and select the save icon \[Omitted image "green-checkmark.png"\] Alt text: save icon.

    For example, you can add **Basic Auth**, **ID Token**, **Certificate based Auth**, **OAuth** or **WSSE Auth**.

    1.  To add one or more inbound authentication profiles, select **New** to create a new profile.

    2.  Choose **What Kind of authentication profiles?**.

        -   **Create standard http authentication profiles**
        -   **Create WSSE authentication profiles**
        -   **Create API Key authentication profiles**
        -   **Create HMAC authentication profiles**
        \[Omitted image "auth-profile.png"\] Alt text: Authentication profile

    3.  After creating the authentication profile, save the record.

6.  Select **Submit** to submit the REST API access policy.