> For the complete documentation index, see [llms.txt](https://docs.n8n.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.n8n.io/connect/n8n-api/credential-type-policy.md).

# Credential Type Policy

Preview — breaking changes may still occur without major version bump.

## Preview: Retrieve the instance credential type policy

> \*\*Preview\*\* — breaking changes may still occur without major version bump.\
> \
> Returns the composed instance-scope policy: its default action and the rules of every attached policy document in evaluation order. An instance that was never configured reports \`scopeId: null\`, no rules, \`defaultAction: allow\`, and \`version: 0\`.

```json
{"openapi":"3.0.0","info":{"title":"n8n Public API","version":"1.1.1"},"tags":[{"name":"CredentialTypePolicy","description":"Preview — breaking changes may still occur without major version bump."}],"servers":[{"url":"/api/v1","description":"Current n8n instance (self-hosted built-in playground)"},{"url":"{url}/api/v1","description":"Self-hosted n8n instance","variables":{"url":{"default":"https://example.com"}}}],"security":[{"ApiKeyAuth":[]},{"BearerAuth":[]},{"CookieAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-N8N-API-KEY"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"},"CookieAuth":{"type":"apiKey","in":"cookie","name":"n8n-auth"}},"schemas":{"credentialTypePolicyEffectivePublicDto.generated":{"type":"object","properties":{"scopeId":{"type":"string","nullable":true},"rules":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1},"action":{"type":"string","enum":["allow","deny","delegate"]},"selector":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["name"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["package"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["extends"]},"value":{"type":"string","minLength":1}},"required":["kind","value"],"description":"Matches the named credential type and every type that extends it"}],"type":"object"}},"required":["id","action","selector"]}},"defaultAction":{"type":"string","enum":["allow","deny","delegate"]},"version":{"type":"integer","minimum":0}},"required":["scopeId","rules","defaultAction","version"]}},"responses":{"unauthorized":{"description":"Unauthorized"},"forbidden":{"description":"Forbidden"},"serviceUnavailable":{"description":"The requested service is temporarily unavailable."}}},"paths":{"/credential-type-policies/instance":{"get":{"operationId":"getCredentialTypeInstancePolicy","tags":["CredentialTypePolicy"],"summary":"Preview: Retrieve the instance credential type policy","description":"**Preview** — breaking changes may still occur without major version bump.\n\nReturns the composed instance-scope policy: its default action and the rules of every attached policy document in evaluation order. An instance that was never configured reports `scopeId: null`, no rules, `defaultAction: allow`, and `version: 0`.","responses":{"200":{"description":"Operation successful.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/credentialTypePolicyEffectivePublicDto.generated"}}}},"401":{"$ref":"#/components/responses/unauthorized"},"403":{"$ref":"#/components/responses/forbidden"},"503":{"$ref":"#/components/responses/serviceUnavailable"}}}}}}
```

## Preview: Replace the instance credential type policy

> \*\*Preview\*\* — breaking changes may still occur without major version bump.\
> \
> Sets the instance default action and replaces the rules of its single policy document, creating both on first write. \`version\` must equal the version last read; a stale value is rejected with 409. Rule ids must be unique within the list.

```json
{"openapi":"3.0.0","info":{"title":"n8n Public API","version":"1.1.1"},"tags":[{"name":"CredentialTypePolicy","description":"Preview — breaking changes may still occur without major version bump."}],"servers":[{"url":"/api/v1","description":"Current n8n instance (self-hosted built-in playground)"},{"url":"{url}/api/v1","description":"Self-hosted n8n instance","variables":{"url":{"default":"https://example.com"}}}],"security":[{"ApiKeyAuth":[]},{"BearerAuth":[]},{"CookieAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-N8N-API-KEY"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"},"CookieAuth":{"type":"apiKey","in":"cookie","name":"n8n-auth"}},"schemas":{"credentialTypePolicyEffectiveWriteResultPublicDto.generated":{"type":"object","properties":{"scopeId":{"type":"string","nullable":true},"rules":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1},"action":{"type":"string","enum":["allow","deny","delegate"]},"selector":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["name"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["package"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["extends"]},"value":{"type":"string","minLength":1}},"required":["kind","value"],"description":"Matches the named credential type and every type that extends it"}],"type":"object"}},"required":["id","action","selector"]}},"defaultAction":{"type":"string","enum":["allow","deny","delegate"]},"version":{"type":"integer","minimum":0},"warnings":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["shadowed"]},"ruleId":{"type":"string"},"shadowedByRuleId":{"type":"string"}},"required":["kind","ruleId","shadowedByRuleId"]},{"type":"object","properties":{"kind":{"type":"string","enum":["notLoaded"]},"ruleId":{"type":"string"}},"required":["kind","ruleId"]}],"type":"object"}}},"required":["scopeId","rules","defaultAction","version","warnings"]}},"responses":{"badRequest":{"description":"The request is invalid or provides malformed data."},"unauthorized":{"description":"Unauthorized"},"forbidden":{"description":"Forbidden"},"conflict":{"description":"Conflict"},"unsupportedMediaType":{"description":"Unsupported media type."},"serviceUnavailable":{"description":"The requested service is temporarily unavailable."}}},"paths":{"/credential-type-policies/instance":{"put":{"operationId":"putCredentialTypeInstancePolicy","tags":["CredentialTypePolicy"],"summary":"Preview: Replace the instance credential type policy","description":"**Preview** — breaking changes may still occur without major version bump.\n\nSets the instance default action and replaces the rules of its single policy document, creating both on first write. `version` must equal the version last read; a stale value is rejected with 409. Rule ids must be unique within the list.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1},"action":{"type":"string","enum":["allow","deny","delegate"]},"selector":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["name"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["package"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["extends"]},"value":{"type":"string","minLength":1}},"required":["kind","value"],"description":"Matches the named credential type and every type that extends it"}],"type":"object"}},"required":["id","action","selector"]}},"defaultAction":{"type":"string","enum":["allow","deny","delegate"]},"version":{"type":"integer","minimum":0}},"required":["rules","defaultAction","version"]}}}},"responses":{"200":{"description":"Operation successful.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/credentialTypePolicyEffectiveWriteResultPublicDto.generated"}}}},"400":{"$ref":"#/components/responses/badRequest"},"401":{"$ref":"#/components/responses/unauthorized"},"403":{"$ref":"#/components/responses/forbidden"},"409":{"$ref":"#/components/responses/conflict"},"415":{"$ref":"#/components/responses/unsupportedMediaType"},"503":{"$ref":"#/components/responses/serviceUnavailable"}}}}}}
```

## Preview: Retrieve a project's credential type policy

> \*\*Preview\*\* — breaking changes may still occur without major version bump.\
> \
> Returns the project's own composed policy, not the result of combining it with the instance policy. A project that was never configured reports \`scopeId: null\`, no rules, \`defaultAction: allow\`, and \`version: 0\`.

```json
{"openapi":"3.0.0","info":{"title":"n8n Public API","version":"1.1.1"},"tags":[{"name":"CredentialTypePolicy","description":"Preview — breaking changes may still occur without major version bump."}],"servers":[{"url":"/api/v1","description":"Current n8n instance (self-hosted built-in playground)"},{"url":"{url}/api/v1","description":"Self-hosted n8n instance","variables":{"url":{"default":"https://example.com"}}}],"security":[{"ApiKeyAuth":[]},{"BearerAuth":[]},{"CookieAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-N8N-API-KEY"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"},"CookieAuth":{"type":"apiKey","in":"cookie","name":"n8n-auth"}},"schemas":{"credentialTypePolicyEffectivePublicDto.generated":{"type":"object","properties":{"scopeId":{"type":"string","nullable":true},"rules":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1},"action":{"type":"string","enum":["allow","deny","delegate"]},"selector":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["name"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["package"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["extends"]},"value":{"type":"string","minLength":1}},"required":["kind","value"],"description":"Matches the named credential type and every type that extends it"}],"type":"object"}},"required":["id","action","selector"]}},"defaultAction":{"type":"string","enum":["allow","deny","delegate"]},"version":{"type":"integer","minimum":0}},"required":["scopeId","rules","defaultAction","version"]}},"responses":{"unauthorized":{"description":"Unauthorized"},"forbidden":{"description":"Forbidden"},"serviceUnavailable":{"description":"The requested service is temporarily unavailable."}}},"paths":{"/credential-type-policies/projects/{projectId}":{"get":{"operationId":"getCredentialTypeProjectPolicy","tags":["CredentialTypePolicy"],"summary":"Preview: Retrieve a project's credential type policy","description":"**Preview** — breaking changes may still occur without major version bump.\n\nReturns the project's own composed policy, not the result of combining it with the instance policy. A project that was never configured reports `scopeId: null`, no rules, `defaultAction: allow`, and `version: 0`.","parameters":[{"schema":{"type":"string"},"required":true,"description":"The ID of the project.","name":"projectId","in":"path"}],"responses":{"200":{"description":"Operation successful.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/credentialTypePolicyEffectivePublicDto.generated"}}}},"401":{"$ref":"#/components/responses/unauthorized"},"403":{"$ref":"#/components/responses/forbidden"},"503":{"$ref":"#/components/responses/serviceUnavailable"}}}}}}
```

## Preview: Replace a project's credential type policy

> \*\*Preview\*\* — breaking changes may still occur without major version bump.\
> \
> Sets the project's default action and replaces the rules of its single policy document, creating both on first write. The \`delegate\` action is not accepted at project scope. \`version\` must equal the version last read; a stale value is rejected with 409, as is a project document that is shared with another scope.

```json
{"openapi":"3.0.0","info":{"title":"n8n Public API","version":"1.1.1"},"tags":[{"name":"CredentialTypePolicy","description":"Preview — breaking changes may still occur without major version bump."}],"servers":[{"url":"/api/v1","description":"Current n8n instance (self-hosted built-in playground)"},{"url":"{url}/api/v1","description":"Self-hosted n8n instance","variables":{"url":{"default":"https://example.com"}}}],"security":[{"ApiKeyAuth":[]},{"BearerAuth":[]},{"CookieAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-N8N-API-KEY"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"},"CookieAuth":{"type":"apiKey","in":"cookie","name":"n8n-auth"}},"schemas":{"credentialTypePolicyEffectiveWriteResultPublicDto.generated":{"type":"object","properties":{"scopeId":{"type":"string","nullable":true},"rules":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1},"action":{"type":"string","enum":["allow","deny","delegate"]},"selector":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["name"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["package"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["extends"]},"value":{"type":"string","minLength":1}},"required":["kind","value"],"description":"Matches the named credential type and every type that extends it"}],"type":"object"}},"required":["id","action","selector"]}},"defaultAction":{"type":"string","enum":["allow","deny","delegate"]},"version":{"type":"integer","minimum":0},"warnings":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["shadowed"]},"ruleId":{"type":"string"},"shadowedByRuleId":{"type":"string"}},"required":["kind","ruleId","shadowedByRuleId"]},{"type":"object","properties":{"kind":{"type":"string","enum":["notLoaded"]},"ruleId":{"type":"string"}},"required":["kind","ruleId"]}],"type":"object"}}},"required":["scopeId","rules","defaultAction","version","warnings"]}},"responses":{"badRequest":{"description":"The request is invalid or provides malformed data."},"unauthorized":{"description":"Unauthorized"},"forbidden":{"description":"Forbidden"},"conflict":{"description":"Conflict"},"unsupportedMediaType":{"description":"Unsupported media type."},"serviceUnavailable":{"description":"The requested service is temporarily unavailable."}}},"paths":{"/credential-type-policies/projects/{projectId}":{"put":{"operationId":"putCredentialTypeProjectPolicy","tags":["CredentialTypePolicy"],"summary":"Preview: Replace a project's credential type policy","description":"**Preview** — breaking changes may still occur without major version bump.\n\nSets the project's default action and replaces the rules of its single policy document, creating both on first write. The `delegate` action is not accepted at project scope. `version` must equal the version last read; a stale value is rejected with 409, as is a project document that is shared with another scope.","parameters":[{"schema":{"type":"string"},"required":true,"description":"The ID of the project.","name":"projectId","in":"path"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1},"action":{"type":"string","enum":["allow","deny"]},"selector":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["name"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["package"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["extends"]},"value":{"type":"string","minLength":1}},"required":["kind","value"],"description":"Matches the named credential type and every type that extends it"}],"type":"object"}},"required":["id","action","selector"]}},"defaultAction":{"type":"string","enum":["allow","deny"]},"version":{"type":"integer","minimum":0}},"required":["rules","defaultAction","version"]}}}},"responses":{"200":{"description":"Operation successful.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/credentialTypePolicyEffectiveWriteResultPublicDto.generated"}}}},"400":{"$ref":"#/components/responses/badRequest"},"401":{"$ref":"#/components/responses/unauthorized"},"403":{"$ref":"#/components/responses/forbidden"},"409":{"$ref":"#/components/responses/conflict"},"415":{"$ref":"#/components/responses/unsupportedMediaType"},"503":{"$ref":"#/components/responses/serviceUnavailable"}}}}}}
```

## Preview: List credential type policy documents

> \*\*Preview\*\* — breaking changes may still occur without major version bump.\
> \
> Returns a cursor-paginated list of reusable policy documents.

```json
{"openapi":"3.0.0","info":{"title":"n8n Public API","version":"1.1.1"},"tags":[{"name":"CredentialTypePolicy","description":"Preview — breaking changes may still occur without major version bump."}],"servers":[{"url":"/api/v1","description":"Current n8n instance (self-hosted built-in playground)"},{"url":"{url}/api/v1","description":"Self-hosted n8n instance","variables":{"url":{"default":"https://example.com"}}}],"security":[{"ApiKeyAuth":[]},{"BearerAuth":[]},{"CookieAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-N8N-API-KEY"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"},"CookieAuth":{"type":"apiKey","in":"cookie","name":"n8n-auth"}},"parameters":{"limit":{"name":"limit","in":"query","description":"The maximum number of items to return.","required":false,"schema":{"type":"number","default":100,"maximum":250}},"cursor":{"name":"cursor","in":"query","description":"Paginate by setting the cursor parameter to the nextCursor attribute returned by the previous request's response. Default value fetches the first \"page\" of the collection. See pagination for more detail.","required":false,"style":"form","schema":{"type":"string"}}},"responses":{"badRequest":{"description":"The request is invalid or provides malformed data."},"unauthorized":{"description":"Unauthorized"},"forbidden":{"description":"Forbidden"},"serviceUnavailable":{"description":"The requested service is temporarily unavailable."}}},"paths":{"/credential-type-policies/policies":{"get":{"operationId":"listCredentialTypePolicyDocuments","tags":["CredentialTypePolicy"],"summary":"Preview: List credential type policy documents","description":"**Preview** — breaking changes may still occur without major version bump.\n\nReturns a cursor-paginated list of reusable policy documents.","parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/cursor"}],"responses":{"200":{"description":"Operation successful.","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"kind":{"type":"string"},"rules":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1},"action":{"type":"string","enum":["allow","deny","delegate"]},"selector":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["name"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["package"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["extends"]},"value":{"type":"string","minLength":1}},"required":["kind","value"],"description":"Matches the named credential type and every type that extends it"}],"type":"object"}},"required":["id","action","selector"]}},"version":{"type":"integer","minimum":0,"exclusiveMinimum":true},"updatedBy":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","kind","rules","version","updatedBy","createdAt","updatedAt"]}},"nextCursor":{"type":"string","nullable":true}},"required":["data","nextCursor"]}}}},"400":{"$ref":"#/components/responses/badRequest"},"401":{"$ref":"#/components/responses/unauthorized"},"403":{"$ref":"#/components/responses/forbidden"},"503":{"$ref":"#/components/responses/serviceUnavailable"}}}}}}
```

## Preview: Create a credential type policy document

> \*\*Preview\*\* — breaking changes may still occur without major version bump.\
> \
> Creates a reusable policy document that is not yet attached to any scope. Rule ids must be unique within the list. \`warnings\` lists rules that an earlier rule already shadows.

```json
{"openapi":"3.0.0","info":{"title":"n8n Public API","version":"1.1.1"},"tags":[{"name":"CredentialTypePolicy","description":"Preview — breaking changes may still occur without major version bump."}],"servers":[{"url":"/api/v1","description":"Current n8n instance (self-hosted built-in playground)"},{"url":"{url}/api/v1","description":"Self-hosted n8n instance","variables":{"url":{"default":"https://example.com"}}}],"security":[{"ApiKeyAuth":[]},{"BearerAuth":[]},{"CookieAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-N8N-API-KEY"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"},"CookieAuth":{"type":"apiKey","in":"cookie","name":"n8n-auth"}},"parameters":{"idempotencyKey":{"name":"Idempotency-Key","in":"header","description":"Safe retry key for this POST. Use 1 to 128 visible ASCII characters. The same key and the same request return the first successful response. A different request with this key returns 422. A retry while the first request is in progress returns 409.","required":false,"schema":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[\\x21-\\x7E]+$"}}},"schemas":{"credentialTypePolicyDocumentWriteResultPublicDto.generated":{"type":"object","properties":{"policy":{"type":"object","properties":{"id":{"type":"string"},"kind":{"type":"string"},"rules":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1},"action":{"type":"string","enum":["allow","deny","delegate"]},"selector":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["name"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["package"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["extends"]},"value":{"type":"string","minLength":1}},"required":["kind","value"],"description":"Matches the named credential type and every type that extends it"}],"type":"object"}},"required":["id","action","selector"]}},"version":{"type":"integer","minimum":0,"exclusiveMinimum":true},"updatedBy":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","kind","rules","version","updatedBy","createdAt","updatedAt"]},"warnings":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["shadowed"]},"ruleId":{"type":"string"},"shadowedByRuleId":{"type":"string"}},"required":["kind","ruleId","shadowedByRuleId"]},{"type":"object","properties":{"kind":{"type":"string","enum":["notLoaded"]},"ruleId":{"type":"string"}},"required":["kind","ruleId"]}],"type":"object"}}},"required":["policy","warnings"]}},"responses":{"badRequest":{"description":"The request is invalid or provides malformed data."},"unauthorized":{"description":"Unauthorized"},"forbidden":{"description":"Forbidden"},"conflict":{"description":"Conflict"},"unsupportedMediaType":{"description":"Unsupported media type."},"unprocessableEntity":{"description":"Unprocessable Entity"},"serviceUnavailable":{"description":"The requested service is temporarily unavailable."}}},"paths":{"/credential-type-policies/policies":{"post":{"operationId":"createCredentialTypePolicyDocument","tags":["CredentialTypePolicy"],"summary":"Preview: Create a credential type policy document","description":"**Preview** — breaking changes may still occur without major version bump.\n\nCreates a reusable policy document that is not yet attached to any scope. Rule ids must be unique within the list. `warnings` lists rules that an earlier rule already shadows.","parameters":[{"$ref":"#/components/parameters/idempotencyKey"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1},"action":{"type":"string","enum":["allow","deny","delegate"]},"selector":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["name"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["package"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["extends"]},"value":{"type":"string","minLength":1}},"required":["kind","value"],"description":"Matches the named credential type and every type that extends it"}],"type":"object"}},"required":["id","action","selector"]}}},"required":["rules"]}}}},"responses":{"201":{"description":"Operation successful.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/credentialTypePolicyDocumentWriteResultPublicDto.generated"}}}},"400":{"$ref":"#/components/responses/badRequest"},"401":{"$ref":"#/components/responses/unauthorized"},"403":{"$ref":"#/components/responses/forbidden"},"409":{"$ref":"#/components/responses/conflict"},"415":{"$ref":"#/components/responses/unsupportedMediaType"},"422":{"$ref":"#/components/responses/unprocessableEntity"},"503":{"$ref":"#/components/responses/serviceUnavailable"}}}}}}
```

## Preview: Retrieve a credential type policy document

> \*\*Preview\*\* — breaking changes may still occur without major version bump.

```json
{"openapi":"3.0.0","info":{"title":"n8n Public API","version":"1.1.1"},"tags":[{"name":"CredentialTypePolicy","description":"Preview — breaking changes may still occur without major version bump."}],"servers":[{"url":"/api/v1","description":"Current n8n instance (self-hosted built-in playground)"},{"url":"{url}/api/v1","description":"Self-hosted n8n instance","variables":{"url":{"default":"https://example.com"}}}],"security":[{"ApiKeyAuth":[]},{"BearerAuth":[]},{"CookieAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-N8N-API-KEY"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"},"CookieAuth":{"type":"apiKey","in":"cookie","name":"n8n-auth"}},"responses":{"unauthorized":{"description":"Unauthorized"},"forbidden":{"description":"Forbidden"},"notFound":{"description":"The specified resource was not found."},"serviceUnavailable":{"description":"The requested service is temporarily unavailable."}}},"paths":{"/credential-type-policies/policies/{policyId}":{"get":{"operationId":"getCredentialTypePolicyDocument","tags":["CredentialTypePolicy"],"summary":"Preview: Retrieve a credential type policy document","description":"**Preview** — breaking changes may still occur without major version bump.","parameters":[{"schema":{"type":"string"},"required":true,"description":"The ID of the credential type policy document.","name":"policyId","in":"path"}],"responses":{"200":{"description":"Operation successful.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"kind":{"type":"string"},"rules":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1},"action":{"type":"string","enum":["allow","deny","delegate"]},"selector":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["name"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["package"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["extends"]},"value":{"type":"string","minLength":1}},"required":["kind","value"],"description":"Matches the named credential type and every type that extends it"}],"type":"object"}},"required":["id","action","selector"]}},"version":{"type":"integer","minimum":0,"exclusiveMinimum":true},"updatedBy":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","kind","rules","version","updatedBy","createdAt","updatedAt"]}}}},"401":{"$ref":"#/components/responses/unauthorized"},"403":{"$ref":"#/components/responses/forbidden"},"404":{"$ref":"#/components/responses/notFound"},"503":{"$ref":"#/components/responses/serviceUnavailable"}}}}}}
```

## Preview: Replace the rules of a credential type policy document

> \*\*Preview\*\* — breaking changes may still occur without major version bump.\
> \
> Replaces the document's whole rule list. \`version\` must equal the version last read; a stale value is rejected with 409. Every scope the document is attached to has its version bumped. A \`delegate\` rule is rejected when the document is attached to a project scope.

```json
{"openapi":"3.0.0","info":{"title":"n8n Public API","version":"1.1.1"},"tags":[{"name":"CredentialTypePolicy","description":"Preview — breaking changes may still occur without major version bump."}],"servers":[{"url":"/api/v1","description":"Current n8n instance (self-hosted built-in playground)"},{"url":"{url}/api/v1","description":"Self-hosted n8n instance","variables":{"url":{"default":"https://example.com"}}}],"security":[{"ApiKeyAuth":[]},{"BearerAuth":[]},{"CookieAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-N8N-API-KEY"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"},"CookieAuth":{"type":"apiKey","in":"cookie","name":"n8n-auth"}},"schemas":{"credentialTypePolicyDocumentWriteResultPublicDto.generated":{"type":"object","properties":{"policy":{"type":"object","properties":{"id":{"type":"string"},"kind":{"type":"string"},"rules":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1},"action":{"type":"string","enum":["allow","deny","delegate"]},"selector":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["name"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["package"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["extends"]},"value":{"type":"string","minLength":1}},"required":["kind","value"],"description":"Matches the named credential type and every type that extends it"}],"type":"object"}},"required":["id","action","selector"]}},"version":{"type":"integer","minimum":0,"exclusiveMinimum":true},"updatedBy":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","kind","rules","version","updatedBy","createdAt","updatedAt"]},"warnings":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["shadowed"]},"ruleId":{"type":"string"},"shadowedByRuleId":{"type":"string"}},"required":["kind","ruleId","shadowedByRuleId"]},{"type":"object","properties":{"kind":{"type":"string","enum":["notLoaded"]},"ruleId":{"type":"string"}},"required":["kind","ruleId"]}],"type":"object"}}},"required":["policy","warnings"]}},"responses":{"badRequest":{"description":"The request is invalid or provides malformed data."},"unauthorized":{"description":"Unauthorized"},"forbidden":{"description":"Forbidden"},"notFound":{"description":"The specified resource was not found."},"conflict":{"description":"Conflict"},"unsupportedMediaType":{"description":"Unsupported media type."},"serviceUnavailable":{"description":"The requested service is temporarily unavailable."}}},"paths":{"/credential-type-policies/policies/{policyId}":{"put":{"operationId":"updateCredentialTypePolicyDocument","tags":["CredentialTypePolicy"],"summary":"Preview: Replace the rules of a credential type policy document","description":"**Preview** — breaking changes may still occur without major version bump.\n\nReplaces the document's whole rule list. `version` must equal the version last read; a stale value is rejected with 409. Every scope the document is attached to has its version bumped. A `delegate` rule is rejected when the document is attached to a project scope.","parameters":[{"schema":{"type":"string"},"required":true,"description":"The ID of the credential type policy document.","name":"policyId","in":"path"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1},"action":{"type":"string","enum":["allow","deny","delegate"]},"selector":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["name"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["package"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["extends"]},"value":{"type":"string","minLength":1}},"required":["kind","value"],"description":"Matches the named credential type and every type that extends it"}],"type":"object"}},"required":["id","action","selector"]}},"version":{"type":"integer","minimum":0}},"required":["rules","version"]}}}},"responses":{"200":{"description":"Operation successful.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/credentialTypePolicyDocumentWriteResultPublicDto.generated"}}}},"400":{"$ref":"#/components/responses/badRequest"},"401":{"$ref":"#/components/responses/unauthorized"},"403":{"$ref":"#/components/responses/forbidden"},"404":{"$ref":"#/components/responses/notFound"},"409":{"$ref":"#/components/responses/conflict"},"415":{"$ref":"#/components/responses/unsupportedMediaType"},"503":{"$ref":"#/components/responses/serviceUnavailable"}}}}}}
```

## Preview: Delete a credential type policy document

> \*\*Preview\*\* — breaking changes may still occur without major version bump.\
> \
> Deletes a policy document. A document that is still attached to a scope is rejected with 409; detach it first.

```json
{"openapi":"3.0.0","info":{"title":"n8n Public API","version":"1.1.1"},"tags":[{"name":"CredentialTypePolicy","description":"Preview — breaking changes may still occur without major version bump."}],"servers":[{"url":"/api/v1","description":"Current n8n instance (self-hosted built-in playground)"},{"url":"{url}/api/v1","description":"Self-hosted n8n instance","variables":{"url":{"default":"https://example.com"}}}],"security":[{"ApiKeyAuth":[]},{"BearerAuth":[]},{"CookieAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-N8N-API-KEY"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"},"CookieAuth":{"type":"apiKey","in":"cookie","name":"n8n-auth"}},"responses":{"unauthorized":{"description":"Unauthorized"},"forbidden":{"description":"Forbidden"},"notFound":{"description":"The specified resource was not found."},"conflict":{"description":"Conflict"},"serviceUnavailable":{"description":"The requested service is temporarily unavailable."}}},"paths":{"/credential-type-policies/policies/{policyId}":{"delete":{"operationId":"deleteCredentialTypePolicyDocument","tags":["CredentialTypePolicy"],"summary":"Preview: Delete a credential type policy document","description":"**Preview** — breaking changes may still occur without major version bump.\n\nDeletes a policy document. A document that is still attached to a scope is rejected with 409; detach it first.","parameters":[{"schema":{"type":"string"},"required":true,"description":"The ID of the credential type policy document.","name":"policyId","in":"path"}],"responses":{"204":{"description":"Operation successful."},"401":{"$ref":"#/components/responses/unauthorized"},"403":{"$ref":"#/components/responses/forbidden"},"404":{"$ref":"#/components/responses/notFound"},"409":{"$ref":"#/components/responses/conflict"},"503":{"$ref":"#/components/responses/serviceUnavailable"}}}}}}
```

## Preview: Retrieve a scope's attached policy documents

> \*\*Preview\*\* — breaking changes may still occur without major version bump.\
> \
> Returns every attached policy document and the scope version. Attachments use evaluation order: floor first, then priority ascending within each group. Use this version when replacing the attachments. \`scopeId\` comes from \`GET /instance\` or \`GET /projects/{projectId}\`, and is null until the scope is first written. This route needs instance-level access, also for a project scope.

```json
{"openapi":"3.0.0","info":{"title":"n8n Public API","version":"1.1.1"},"tags":[{"name":"CredentialTypePolicy","description":"Preview — breaking changes may still occur without major version bump."}],"servers":[{"url":"/api/v1","description":"Current n8n instance (self-hosted built-in playground)"},{"url":"{url}/api/v1","description":"Self-hosted n8n instance","variables":{"url":{"default":"https://example.com"}}}],"security":[{"ApiKeyAuth":[]},{"BearerAuth":[]},{"CookieAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-N8N-API-KEY"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"},"CookieAuth":{"type":"apiKey","in":"cookie","name":"n8n-auth"}},"schemas":{"credentialTypePolicyAttachmentsPublicDto.generated":{"type":"object","properties":{"attachments":{"type":"array","items":{"type":"object","properties":{"policyId":{"type":"string"},"rules":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1},"action":{"type":"string","enum":["allow","deny","delegate"]},"selector":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["name"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["package"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["extends"]},"value":{"type":"string","minLength":1}},"required":["kind","value"],"description":"Matches the named credential type and every type that extends it"}],"type":"object"}},"required":["id","action","selector"]}},"priority":{"type":"integer"},"isFloor":{"type":"boolean"}},"required":["policyId","rules","priority","isFloor"]}},"version":{"type":"integer","minimum":0,"exclusiveMinimum":true}},"required":["attachments","version"]}},"responses":{"unauthorized":{"description":"Unauthorized"},"forbidden":{"description":"Forbidden"},"notFound":{"description":"The specified resource was not found."},"serviceUnavailable":{"description":"The requested service is temporarily unavailable."}}},"paths":{"/credential-type-policies/scopes/{scopeId}/attachments":{"get":{"operationId":"getCredentialTypePolicyAttachments","tags":["CredentialTypePolicy"],"summary":"Preview: Retrieve a scope's attached policy documents","description":"**Preview** — breaking changes may still occur without major version bump.\n\nReturns every attached policy document and the scope version. Attachments use evaluation order: floor first, then priority ascending within each group. Use this version when replacing the attachments. `scopeId` comes from `GET /instance` or `GET /projects/{projectId}`, and is null until the scope is first written. This route needs instance-level access, also for a project scope.","parameters":[{"schema":{"type":"string"},"required":true,"description":"The ID of the credential type policy scope.","name":"scopeId","in":"path"}],"responses":{"200":{"description":"Operation successful.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/credentialTypePolicyAttachmentsPublicDto.generated"}}}},"401":{"$ref":"#/components/responses/unauthorized"},"403":{"$ref":"#/components/responses/forbidden"},"404":{"$ref":"#/components/responses/notFound"},"503":{"$ref":"#/components/responses/serviceUnavailable"}}}}}}
```

## Preview: Replace a scope's attached policy documents

> \*\*Preview\*\* — breaking changes may still occur without major version bump.\
> \
> Replaces every attachment on a scope. \`scopeId\` comes from the scope's \`GET\` response once it has been written. Each \`policyId\` and each \`(isFloor, priority)\` pair must be unique within the list. \`version\` must match the current scope version. A stale version returns 409 without changes. A successful write bumps the scope's version.

```json
{"openapi":"3.0.0","info":{"title":"n8n Public API","version":"1.1.1"},"tags":[{"name":"CredentialTypePolicy","description":"Preview — breaking changes may still occur without major version bump."}],"servers":[{"url":"/api/v1","description":"Current n8n instance (self-hosted built-in playground)"},{"url":"{url}/api/v1","description":"Self-hosted n8n instance","variables":{"url":{"default":"https://example.com"}}}],"security":[{"ApiKeyAuth":[]},{"BearerAuth":[]},{"CookieAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-N8N-API-KEY"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"},"CookieAuth":{"type":"apiKey","in":"cookie","name":"n8n-auth"}},"schemas":{"credentialTypePolicyAttachmentsPublicDto.generated":{"type":"object","properties":{"attachments":{"type":"array","items":{"type":"object","properties":{"policyId":{"type":"string"},"rules":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1},"action":{"type":"string","enum":["allow","deny","delegate"]},"selector":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["name"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["package"]},"value":{"type":"string","minLength":1}},"required":["kind","value"]},{"type":"object","properties":{"kind":{"type":"string","enum":["extends"]},"value":{"type":"string","minLength":1}},"required":["kind","value"],"description":"Matches the named credential type and every type that extends it"}],"type":"object"}},"required":["id","action","selector"]}},"priority":{"type":"integer"},"isFloor":{"type":"boolean"}},"required":["policyId","rules","priority","isFloor"]}},"version":{"type":"integer","minimum":0,"exclusiveMinimum":true}},"required":["attachments","version"]}},"responses":{"badRequest":{"description":"The request is invalid or provides malformed data."},"unauthorized":{"description":"Unauthorized"},"forbidden":{"description":"Forbidden"},"notFound":{"description":"The specified resource was not found."},"conflict":{"description":"Conflict"},"unsupportedMediaType":{"description":"Unsupported media type."},"serviceUnavailable":{"description":"The requested service is temporarily unavailable."}}},"paths":{"/credential-type-policies/scopes/{scopeId}/attachments":{"put":{"operationId":"replaceCredentialTypePolicyAttachments","tags":["CredentialTypePolicy"],"summary":"Preview: Replace a scope's attached policy documents","description":"**Preview** — breaking changes may still occur without major version bump.\n\nReplaces every attachment on a scope. `scopeId` comes from the scope's `GET` response once it has been written. Each `policyId` and each `(isFloor, priority)` pair must be unique within the list. `version` must match the current scope version. A stale version returns 409 without changes. A successful write bumps the scope's version.","parameters":[{"schema":{"type":"string"},"required":true,"description":"The ID of the credential type policy scope.","name":"scopeId","in":"path"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"attachments":{"type":"array","items":{"type":"object","properties":{"policyId":{"type":"string","minLength":1},"priority":{"type":"integer"},"isFloor":{"type":"boolean"}},"required":["policyId","priority","isFloor"]}},"version":{"type":"integer","minimum":0}},"required":["attachments","version"]}}}},"responses":{"200":{"description":"Operation successful.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/credentialTypePolicyAttachmentsPublicDto.generated"}}}},"400":{"$ref":"#/components/responses/badRequest"},"401":{"$ref":"#/components/responses/unauthorized"},"403":{"$ref":"#/components/responses/forbidden"},"404":{"$ref":"#/components/responses/notFound"},"409":{"$ref":"#/components/responses/conflict"},"415":{"$ref":"#/components/responses/unsupportedMediaType"},"503":{"$ref":"#/components/responses/serviceUnavailable"}}}}}}
```