Skip to main content
POST
Apply or update access policy

gRPC method: EnsureAccessPolicy

Creates or updates an access policy by name. The supplied policy replaces any existing policy with the same name. The version field must be v1alpha1. Each statement carries an effect (Allow or Deny), a list of actions, a list of resources, and a list of principals. To allow every action on every resource for every principal, save the following as data.json:
data.json
Example request

Supported actions

Access policies accept every S3 action (s3:*) plus a set of CoreWeave-specific actions in the cwobject:* namespace. The canonical list of cwobject:* actions and their required resources value lives in the CoreWeave AI Object Storage actions reference and the IAM Access Policies documentation.

Authorizations

Authorization
string
header
default:Bearer {API_ACCESS_TOKEN}
required

CoreWeave API access token sent as a bearer token in the Authorization header (the value is prefixed with Bearer). Used by every operation except the SAML/OIDC token-exchange endpoints (anonymous) and the container credentials GET (which uses ContainerCredentialsAuth).

Body

application/json

Inputs for creating or replacing an access policy by name.

policy
object
required

The full access-policy document. Replaces any existing policy with the same name.

Response

Last modified on August 5, 2026