> This page is for Developer Documentation.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.benchling.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.benchling.com/_mcp/server.

# Add DataPolicy statements

PATCH https://{tenant_name}.benchling.com/api/v3/policy/{policy_id}:add-policy-statements
Content-Type: application/json

Add policy statements to a DataPolicy. Acts as an upsert keyed on (itemType, action): for each incoming statement, any existing statement with the same item type and action is overwritten with the provided condition, and statements for other (itemType, action) pairs are left unchanged. Only DataPolicy objects can be edited.

Reference: https://docs.benchling.com/docs/api/benchling-api/policy/addpolicystatements

## Authentication

- `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer <token>`, where token is your auth token.

## Request

### Path parameters

- `policy_id` (string, required) — ID of the Policy.

### Headers

- `EARLY-ACCESS` (string, optional) — Set to true to access beta operations via /api/v3.

### Body (application/json)

This endpoint expects an object.

- `statements` (list of PolicyStatementInput, required) — Policy statements to add. Any existing statement with the same item type and action is overwritten with the provided condition; other statements are left unchanged.

## Response

### 200

OK

- `__typename` (string, optional)
- `createdAt` (string, optional)
- `description` (string, optional, nullable)
- `id` (string, optional)
- `modifiedAt` (string, optional)
- `name` (string, optional)
- `policyStatements` (list of PolicyStatement, optional)
- `policyType` (enum, optional)
  - Allowed values: `DATA_POLICY`, `SCHEMA_POLICY`, `POLICY`

## Errors

### 400 Policy Add Policy Statements Request Bad Request Error

Bad Request

- `detail` (GeneralErrorDetail, required, nullable)
- `instance` (string, required)
- `status` (integer, required)
- `title` (string, required, nullable)
- `type` (string, required)
- `invalidId` (string, optional)

### 403 Policy Add Policy Statements Request Forbidden Error

Forbidden

- `detail` (GeneralErrorDetail, required, nullable)
- `instance` (string, required)
- `status` (integer, required)
- `title` (string, required, nullable)
- `type` (string, required)
- `invalidId` (string, optional)

### 404 Policy Add Policy Statements Request Not Found Error

Not Found

- `detail` (GeneralErrorDetail, required, nullable)
- `instance` (string, required)
- `status` (integer, required)
- `title` (string, required, nullable)
- `type` (string, required)
- `invalidId` (string, optional)

### 409 Policy Add Policy Statements Request Conflict Error

Conflict

- `detail` (GeneralErrorDetail, required, nullable)
- `instance` (string, required)
- `status` (integer, required)
- `title` (string, required, nullable)
- `type` (string, required)
- `invalidId` (string, optional)

### 429 Policy Add Policy Statements Request Too Many Requests Error

Too Many Requests

- `detail` (TooManyRequestsErrorBodyDetail, required, nullable)
- `instance` (string, required)
- `status` (integer, required)
- `title` (string, required, nullable)
- `type` (string, required)
- `invalidId` (string, optional)

### 500 Policy Add Policy Statements Request Internal Server Error

Internal Server Error

- `detail` (InternalServerErrorBodyDetail, required, nullable)
- `instance` (string, required)
- `status` (integer, required)
- `title` (string, required, nullable)
- `type` (string, required)
- `errorId` (string, optional)

## Types

### PolicyStatementInput

- `action` (enum, required) — The action being granted on the item type.
  - Allowed values: `READ`, `APPEND`, `WRITE`, `ADMIN`, `ARCHIVE`, `CHANGE_ASSIGNMENT_OF_OBJECTS`, `CHANGE_REGISTRY_IDENTIFIER`, `CREATE`, `CREATE_ENTRIES_FROM_DRAFT_TEMPLATES`, `CREATE_LOCATION`, `CREATE_REQUEST`, `CREATE_RESULT`, `CREATE_SUBFOLDER`, `CREATE_TEST_ORDERS`, `EDIT_BARCODES`, `EDIT_CHEMICAL_STRUCTURE`, `EDIT_CONTAINER`, `EDIT_FIELDS_IF_PENDING_INVALID`, `EDIT_FIELDS_IF_IN_PROGRESS`, `EDIT_FIELDS_IF_TERMINAL`, `EDIT_NAMES_AND_ALIASES`, `EDIT_NAMES_AND_BARCODES`, `EDIT_POLYMER_FEATURES`, `EDIT_RESIDUES`, `EDIT_RESTRICTED_SAMPLE_USERS`, `EDIT_RESULT`, `EDIT_SCHEMA_AND_FIELDS`, `EDIT_STATUS`, `EDIT_USER_EMAIL`, `EXECUTE_REQUEST`, `LIST_DEFINITION`, `MANAGE_COLLABORATORS`, `MANAGE_CAPABILITIES`, `READ_APP_CONFIG`, `READ_APP_SESSION`, `REGISTER`, `RETRACT_REVIEW`, `RESTRICT_SAMPLES`, `REVOKE_USER_CREDENTIALS`, `SUSPEND_USER`, `UNREGISTER`, `UNRESTRICT_SAMPLES`, `WRITE_APP_CONFIG`, `WRITE_APP_SESSION`, `UNKNOWN`
- `condition` (enum, required) — The condition under which the action is granted.
  - Allowed values: `ALWAYS`, `IS_AUTHOR`, `IS_ASSIGNEE`, `UNKNOWN`
- `itemType` (enum, required) — The type of item the statement applies to.
  - Allowed values: `AA_MONOMER`, `AGENT_MEMORY`, `AGENT_SKILL`, `AI_MODEL`, `ANALYSIS`, `SQL_DASHBOARD`, `PROTEIN_FORMAT`, `APP_DEFINITION`, `ASYNC_TASK`, `AV_SCAN_RECORD`, `BATCH`, `APP_INSTALLATION`, `APP_SESSION`, `BIOENTITY`, `BOX`, `BUSINESS_RULE`, `ASSEMBLY`, `CHAT`, `CHEMICAL_COUNTERPART`, `CONFIG_MIGRATION_HISTORY`, `CONNECTION`, `CONTAINER`, `EVENT_SUBSCRIPTION`, `EXTENSION_DEFINITION`, `FOLDER_OR_PROJECT`, `FILE`, `INSTRUMENT`, `NON_LOCATION_STORABLE`, `LEGACY_DATA_IMPORT_RUN`, `LIBRARY_PARAMETER_DEFINITION`, `LOCATION`, `MCP_SERVER_CONFIG`, `MCP_SERVER_USER_CONFIGURATION`, `MODEL_RUN`, `NUCLEOTIDE_MONOMER`, `ENTRY`, `ORGANIZATION`, `PLATE`, `PROCEDURE`, `WORKFLOW_TASK_GROUP`, `WORKFLOW_TASK`, `WORKFLOW_OUTPUT`, `PROTOCOL`, `REGISTRY`, `REVIEW_PROCESS`, `LEGACY_REQUEST`, `REQUEST_TEMPLATE`, `REQUEST`, `RESULT`, `AGENT`, `SAMPLE_TYPE`, `SCHEMA`, `STUDY`, `TEAM`, `TEMPLATE_COLLECTION`, `TENANT`, `TEST_ORDER`, `USER`, `WAREHOUSE_LOGIN`, `WAREHOUSE_CUSTOM_VIEW`, `WORKFLOW`, `WORKLIST`, `WORKSHEET`, `OTHER`, `UNIT_TYPE`, `UNKNOWN`

### PolicyStatement

A single permission rule within a Policy. Combines an ItemType (what kind of object), an Action (what operation), and a Condition (when it applies) to define a specific permission grant. Multiple PolicyStatements together form a complete Policy that determines what actions a user can perform.

- `__typename` (string, optional)
- `action` (enum, optional)
  - Allowed values: `READ`, `APPEND`, `WRITE`, `ADMIN`, `ARCHIVE`, `CHANGE_ASSIGNMENT_OF_OBJECTS`, `CHANGE_REGISTRY_IDENTIFIER`, `CREATE`, `CREATE_ENTRIES_FROM_DRAFT_TEMPLATES`, `CREATE_LOCATION`, `CREATE_REQUEST`, `CREATE_RESULT`, `CREATE_SUBFOLDER`, `CREATE_TEST_ORDERS`, `EDIT_BARCODES`, `EDIT_CHEMICAL_STRUCTURE`, `EDIT_CONTAINER`, `EDIT_FIELDS_IF_PENDING_INVALID`, `EDIT_FIELDS_IF_IN_PROGRESS`, `EDIT_FIELDS_IF_TERMINAL`, `EDIT_NAMES_AND_ALIASES`, `EDIT_NAMES_AND_BARCODES`, `EDIT_POLYMER_FEATURES`, `EDIT_RESIDUES`, `EDIT_RESTRICTED_SAMPLE_USERS`, `EDIT_RESULT`, `EDIT_SCHEMA_AND_FIELDS`, `EDIT_STATUS`, `EDIT_USER_EMAIL`, `EXECUTE_REQUEST`, `LIST_DEFINITION`, `MANAGE_COLLABORATORS`, `MANAGE_CAPABILITIES`, `READ_APP_CONFIG`, `READ_APP_SESSION`, `REGISTER`, `RETRACT_REVIEW`, `RESTRICT_SAMPLES`, `REVOKE_USER_CREDENTIALS`, `SUSPEND_USER`, `UNREGISTER`, `UNRESTRICT_SAMPLES`, `WRITE_APP_CONFIG`, `WRITE_APP_SESSION`, `UNKNOWN`
- `condition` (enum, optional)
  - Allowed values: `ALWAYS`, `IS_AUTHOR`, `IS_ASSIGNEE`, `UNKNOWN`
- `itemType` (enum, optional)
  - Allowed values: `AA_MONOMER`, `AGENT_MEMORY`, `AGENT_SKILL`, `AI_MODEL`, `ANALYSIS`, `SQL_DASHBOARD`, `PROTEIN_FORMAT`, `APP_DEFINITION`, `ASYNC_TASK`, `AV_SCAN_RECORD`, `BATCH`, `APP_INSTALLATION`, `APP_SESSION`, `BIOENTITY`, `BOX`, `BUSINESS_RULE`, `ASSEMBLY`, `CHAT`, `CHEMICAL_COUNTERPART`, `CONFIG_MIGRATION_HISTORY`, `CONNECTION`, `CONTAINER`, `EVENT_SUBSCRIPTION`, `EXTENSION_DEFINITION`, `FOLDER_OR_PROJECT`, `FILE`, `INSTRUMENT`, `NON_LOCATION_STORABLE`, `LEGACY_DATA_IMPORT_RUN`, `LIBRARY_PARAMETER_DEFINITION`, `LOCATION`, `MCP_SERVER_CONFIG`, `MCP_SERVER_USER_CONFIGURATION`, `MODEL_RUN`, `NUCLEOTIDE_MONOMER`, `ENTRY`, `ORGANIZATION`, `PLATE`, `PROCEDURE`, `WORKFLOW_TASK_GROUP`, `WORKFLOW_TASK`, `WORKFLOW_OUTPUT`, `PROTOCOL`, `REGISTRY`, `REVIEW_PROCESS`, `LEGACY_REQUEST`, `REQUEST_TEMPLATE`, `REQUEST`, `RESULT`, `AGENT`, `SAMPLE_TYPE`, `SCHEMA`, `STUDY`, `TEAM`, `TEMPLATE_COLLECTION`, `TENANT`, `TEST_ORDER`, `USER`, `WAREHOUSE_LOGIN`, `WAREHOUSE_CUSTOM_VIEW`, `WORKFLOW`, `WORKLIST`, `WORKSHEET`, `OTHER`, `UNIT_TYPE`, `UNKNOWN`

### GeneralErrorDetail

### TooManyRequestsErrorBodyDetail

### InternalServerErrorBodyDetail

## Examples

**Request**

```json
{
  "statements": [
    {
      "action": "READ",
      "condition": "ALWAYS",
      "itemType": "AA_MONOMER"
    }
  ]
}
```

**Response**

```json
{
  "__typename": "__typename",
  "createdAt": "createdAt",
  "description": "description",
  "id": "id",
  "modifiedAt": "modifiedAt",
  "name": "name",
  "policyStatements": [
    {
      "__typename": "__typename",
      "action": "READ",
      "condition": "ALWAYS",
      "itemType": "AA_MONOMER"
    }
  ],
  "policyType": "DATA_POLICY"
}
```

**SDK Code**

```python
import requests

url = "https://{tenant_name}.benchling.com/api/v3/policy/policy_id:add-policy-statements"

payload = { "statements": [
        {
            "action": "READ",
            "condition": "ALWAYS",
            "itemType": "AA_MONOMER"
        }
    ] }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.json())
```

```javascript
const url = 'https://{tenant_name}.benchling.com/api/v3/policy/policy_id:add-policy-statements';
const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"statements":[{"action":"READ","condition":"ALWAYS","itemType":"AA_MONOMER"}]}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```