curl --request POST \
  --url https://{tenant}/tyk/policies \
  --header 'Content-Type: application/json' \
  --header 'X-Tyk-Authorization: <api-key>' \
  --data '
{
  "access_rights": {
    "8ddd91f3cda9453442c477b06c4e2da4": {
      "allowed_urls": [
        {
          "methods": [
            "GET"
          ],
          "url": "/users"
        }
      ],
      "api_id": "8ddd91f3cda9453442c477b06c4e2da4",
      "api_name": "Itachi api",
      "disable_introspection": false,
      "versions": [
        "Default"
      ]
    }
  },
  "active": true,
  "hmac_enabled": false,
  "id": "5ead7120575961000181867e",
  "is_inactive": false,
  "key_expires_in": 2592000,
  "max_query_depth": -1,
  "meta_data": {
    "update": "sample policy update",
    "user_type": "mobile_user"
  },
  "name": "Sample policy",
  "partitions": {
    "acl": true,
    "complexity": false,
    "per_api": false,
    "quota": true,
    "rate_limit": true
  },
  "per": 60,
  "quota_max": 10000,
  "quota_renewal_rate": 3600,
  "rate": 1000,
  "tags": [
    "security"
  ],
  "throttle_interval": 10,
  "throttle_retry_limit": 10
}
'

import requests

url = "https://{tenant}/tyk/policies"

payload = {
    "access_rights": { "8ddd91f3cda9453442c477b06c4e2da4": {
            "allowed_urls": [
                {
                    "methods": ["GET"],
                    "url": "/users"
                }
            ],
            "api_id": "8ddd91f3cda9453442c477b06c4e2da4",
            "api_name": "Itachi api",
            "disable_introspection": False,
            "versions": ["Default"]
        } },
    "active": True,
    "hmac_enabled": False,
    "id": "5ead7120575961000181867e",
    "is_inactive": False,
    "key_expires_in": 2592000,
    "max_query_depth": -1,
    "meta_data": {
        "update": "sample policy update",
        "user_type": "mobile_user"
    },
    "name": "Sample policy",
    "partitions": {
        "acl": True,
        "complexity": False,
        "per_api": False,
        "quota": True,
        "rate_limit": True
    },
    "per": 60,
    "quota_max": 10000,
    "quota_renewal_rate": 3600,
    "rate": 1000,
    "tags": ["security"],
    "throttle_interval": 10,
    "throttle_retry_limit": 10
}
headers = {
    "X-Tyk-Authorization": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'X-Tyk-Authorization': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    access_rights: {
      '8ddd91f3cda9453442c477b06c4e2da4': {
        allowed_urls: [{methods: ['GET'], url: '/users'}],
        api_id: '8ddd91f3cda9453442c477b06c4e2da4',
        api_name: 'Itachi api',
        disable_introspection: false,
        versions: ['Default']
      }
    },
    active: true,
    hmac_enabled: false,
    id: '5ead7120575961000181867e',
    is_inactive: false,
    key_expires_in: 2592000,
    max_query_depth: -1,
    meta_data: {update: 'sample policy update', user_type: 'mobile_user'},
    name: 'Sample policy',
    partitions: {acl: true, complexity: false, per_api: false, quota: true, rate_limit: true},
    per: 60,
    quota_max: 10000,
    quota_renewal_rate: 3600,
    rate: 1000,
    tags: ['security'],
    throttle_interval: 10,
    throttle_retry_limit: 10
  })
};

fetch('https://{tenant}/tyk/policies', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{tenant}/tyk/policies",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'access_rights' => [
        '8ddd91f3cda9453442c477b06c4e2da4' => [
                'allowed_urls' => [
                                [
                                                                'methods' => [
                                                                                                                                'GET'
                                                                ],
                                                                'url' => '/users'
                                ]
                ],
                'api_id' => '8ddd91f3cda9453442c477b06c4e2da4',
                'api_name' => 'Itachi api',
                'disable_introspection' => false,
                'versions' => [
                                'Default'
                ]
        ]
    ],
    'active' => true,
    'hmac_enabled' => false,
    'id' => '5ead7120575961000181867e',
    'is_inactive' => false,
    'key_expires_in' => 2592000,
    'max_query_depth' => -1,
    'meta_data' => [
        'update' => 'sample policy update',
        'user_type' => 'mobile_user'
    ],
    'name' => 'Sample policy',
    'partitions' => [
        'acl' => true,
        'complexity' => false,
        'per_api' => false,
        'quota' => true,
        'rate_limit' => true
    ],
    'per' => 60,
    'quota_max' => 10000,
    'quota_renewal_rate' => 3600,
    'rate' => 1000,
    'tags' => [
        'security'
    ],
    'throttle_interval' => 10,
    'throttle_retry_limit' => 10
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-Tyk-Authorization: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://{tenant}/tyk/policies"

	payload := strings.NewReader("{\n  \"access_rights\": {\n    \"8ddd91f3cda9453442c477b06c4e2da4\": {\n      \"allowed_urls\": [\n        {\n          \"methods\": [\n            \"GET\"\n          ],\n          \"url\": \"/users\"\n        }\n      ],\n      \"api_id\": \"8ddd91f3cda9453442c477b06c4e2da4\",\n      \"api_name\": \"Itachi api\",\n      \"disable_introspection\": false,\n      \"versions\": [\n        \"Default\"\n      ]\n    }\n  },\n  \"active\": true,\n  \"hmac_enabled\": false,\n  \"id\": \"5ead7120575961000181867e\",\n  \"is_inactive\": false,\n  \"key_expires_in\": 2592000,\n  \"max_query_depth\": -1,\n  \"meta_data\": {\n    \"update\": \"sample policy update\",\n    \"user_type\": \"mobile_user\"\n  },\n  \"name\": \"Sample policy\",\n  \"partitions\": {\n    \"acl\": true,\n    \"complexity\": false,\n    \"per_api\": false,\n    \"quota\": true,\n    \"rate_limit\": true\n  },\n  \"per\": 60,\n  \"quota_max\": 10000,\n  \"quota_renewal_rate\": 3600,\n  \"rate\": 1000,\n  \"tags\": [\n    \"security\"\n  ],\n  \"throttle_interval\": 10,\n  \"throttle_retry_limit\": 10\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Tyk-Authorization", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://{tenant}/tyk/policies")
  .header("X-Tyk-Authorization", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"access_rights\": {\n    \"8ddd91f3cda9453442c477b06c4e2da4\": {\n      \"allowed_urls\": [\n        {\n          \"methods\": [\n            \"GET\"\n          ],\n          \"url\": \"/users\"\n        }\n      ],\n      \"api_id\": \"8ddd91f3cda9453442c477b06c4e2da4\",\n      \"api_name\": \"Itachi api\",\n      \"disable_introspection\": false,\n      \"versions\": [\n        \"Default\"\n      ]\n    }\n  },\n  \"active\": true,\n  \"hmac_enabled\": false,\n  \"id\": \"5ead7120575961000181867e\",\n  \"is_inactive\": false,\n  \"key_expires_in\": 2592000,\n  \"max_query_depth\": -1,\n  \"meta_data\": {\n    \"update\": \"sample policy update\",\n    \"user_type\": \"mobile_user\"\n  },\n  \"name\": \"Sample policy\",\n  \"partitions\": {\n    \"acl\": true,\n    \"complexity\": false,\n    \"per_api\": false,\n    \"quota\": true,\n    \"rate_limit\": true\n  },\n  \"per\": 60,\n  \"quota_max\": 10000,\n  \"quota_renewal_rate\": 3600,\n  \"rate\": 1000,\n  \"tags\": [\n    \"security\"\n  ],\n  \"throttle_interval\": 10,\n  \"throttle_retry_limit\": 10\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{tenant}/tyk/policies")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Tyk-Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"access_rights\": {\n    \"8ddd91f3cda9453442c477b06c4e2da4\": {\n      \"allowed_urls\": [\n        {\n          \"methods\": [\n            \"GET\"\n          ],\n          \"url\": \"/users\"\n        }\n      ],\n      \"api_id\": \"8ddd91f3cda9453442c477b06c4e2da4\",\n      \"api_name\": \"Itachi api\",\n      \"disable_introspection\": false,\n      \"versions\": [\n        \"Default\"\n      ]\n    }\n  },\n  \"active\": true,\n  \"hmac_enabled\": false,\n  \"id\": \"5ead7120575961000181867e\",\n  \"is_inactive\": false,\n  \"key_expires_in\": 2592000,\n  \"max_query_depth\": -1,\n  \"meta_data\": {\n    \"update\": \"sample policy update\",\n    \"user_type\": \"mobile_user\"\n  },\n  \"name\": \"Sample policy\",\n  \"partitions\": {\n    \"acl\": true,\n    \"complexity\": false,\n    \"per_api\": false,\n    \"quota\": true,\n    \"rate_limit\": true\n  },\n  \"per\": 60,\n  \"quota_max\": 10000,\n  \"quota_renewal_rate\": 3600,\n  \"rate\": 1000,\n  \"tags\": [\n    \"security\"\n  ],\n  \"throttle_interval\": 10,\n  \"throttle_retry_limit\": 10\n}"

response = http.request(request)
puts response.read_body

{
  "action": "added",
  "key": "5ead7120575961000181867e",
  "status": "ok"
}

{
  "message": "Request malformed",
  "status": "error"
}

{
  "message": "Attempted administrative access with invalid or missing key!",
  "status": "error"
}

{
  "message": "Due to enabled service policy source, please use the Dashboard API.",
  "status": "error"
}