Access Policies
An access policy is a set of rules that determines access to one or more API resources. Policies are the building blocks of access roles and define the fine-grained operations a role can perform.
Policies are managed at Workspace > Team > Roles & Policies > Policies.
Access keys use a simplified permission model and do not require custom policies. See API Authorization for details on creating access keys.
Managed policies
Bird provides managed policies for common operations, organized by application area (General, Developer, Marketing, Support, Email, AI Hub, CRM, and more). Each managed policy includes a description, the number of operations it covers, and whether it has resource filters.
Understanding policy rules
Policy rules provide fine-grained control over API access. By default, any endpoint not explicitly allowed is denied.
| Field | Description | Values |
|---|---|---|
| Effect | Allow or deny access to the listed resources | Allow, Deny |
| Action | The HTTP method(s) the rule permits | Any, Create (POST), View (GET) |
| Resource(s) | API path(s) the rule applies to | e.g. /workspaces/{workspaceID}/channels |
Resource path wildcards
Use wildcards to match multiple paths:
- * matches any value for a single path segment, e.g. /workspaces/*/channels applies to all workspaces
- ** matches all child paths, e.g. /workspaces/*/channels/** grants access to all paths below /channels