> ## Documentation Index > Fetch the complete documentation index at: https://developers.portao3.com.br/llms.txt > Use this file to discover all available pages before exploring further. # Generate a business policy draft > Drafts a business policy from a description in your own words, with AI. Nothing is saved. Describe the rule in `prompt` — amounts, payment types, wallets, who approves — and the answer is a complete `PAYMENT` or `SPEND_REVIEW` policy in `policy`, built only from the condition catalog of that context and from the organization's own active users, groups, wallets and custom fields. Every approver in the draft is checked against the organization before it is returned. Review the draft before you save it. `unsupported` lists what the request asked for that the draft does not express — a restriction the policy cannot express, a wallet or person that could not be found — so the policy may match more than you described: always show it to whoever saves the policy. To save the draft, send `policy` to the create endpoint without the `name` of each approver. Generation takes a few seconds and can take up to 30. To write the draft, the AI model receives the prompt and the organization's users (names and e-mail addresses), groups, active wallets and custom fields. Only organization admins can generate policies. ## OpenAPI ````yaml /api-reference/ruleengine.openapi.json post /realms/{realmId}/organizations/{organizationId}/business-policies/generate-policy openapi: 3.0.3 info: title: Ruleengine version: 1.0.0 description: >- Portão 3 ruleengine API. Every endpoint requires a bearer token in the Authorization header (Authorization: Bearer ) unless its page states otherwise; see the Authentication guide. That requirement is not repeated per endpoint. Generated by tools/openapi from code (routes + security) and the hand-written spec (request/response bodies). Confidence tiers: generated:typed=26 copied:manual=0 unknown=0. servers: - url: https://api.ruleengine.v2.portao3.com.br/ description: production - url: https://api.ruleengine.dev.3pers.com.br/ description: development security: [] tags: - name: Business Policies - name: Policy Requests paths: /realms/{realmId}/organizations/{organizationId}/business-policies/generate-policy: post: tags: - Business Policies summary: Generate a business policy draft description: >- Drafts a business policy from a description in your own words, with AI. Nothing is saved. operationId: >- postRealmsByRealmIdOrganizationsByOrganizationIdBusinessPoliciesGeneratePolicy parameters: - name: realmId in: path required: true description: |- ID of your realm. Format: `UUID` schema: type: string format: uuid example: f495ff0c-ab54-4f99-8e92-ca8682e4de9b - name: organizationId in: path required: true description: |- ID of the organization the policy is for. Format: `UUID` schema: type: string format: uuid example: c4bd3f21-dfbd-44e8-8055-68ba15bed410 requestBody: required: true content: application/json: schema: type: object properties: context: type: string enum: - PAYMENT - SPEND_REVIEW - TRAVEL description: >- Context of the policy to draft: `PAYMENT` or `SPEND_REVIEW`. `TRAVEL` is refused with `POLICY_GENERATION_CONTEXT_UNSUPPORTED`. example: PAYMENT prompt: type: string minLength: 3 maxLength: 2000 description: >- The policy you want, in your own words — amounts, payment types, wallets and who approves. Portuguese works best. example: >- Pagamentos via Pix acima de R$ 5.000 precisam da aprovação do grupo Financeiro. includeWallets: description: >- Deprecated and ignored: the organization's active wallets are always considered. deprecated: true type: boolean required: - context - prompt additionalProperties: false responses: '200': description: Successful response content: application/json: schema: type: object properties: policy: type: object properties: realmId: type: string description: ID of the realm the policy is for. example: f495ff0c-ab54-4f99-8e92-ca8682e4de9b format: uuid organizationId: type: string description: ID of the organization the policy is for. example: c4bd3f21-dfbd-44e8-8055-68ba15bed410 format: uuid context: type: string enum: - PAYMENT - SPEND_REVIEW - TRAVEL description: The `context` you asked for. example: PAYMENT name: type: string description: Name of the policy. example: Pix acima de R$ 5.000 — aprovação do Financeiro description: type: string description: What the policy does, in plain words. example: >- Pagamentos via Pix acima de R$ 5.000,00 precisam da aprovação do grupo Financeiro. order: type: number description: >- Evaluation order: active policies of the same `context` are tried from the lowest `order` up, and the first match decides. example: 0 status: type: string enum: - ACTIVE - DISABLED - ARCHIVED description: The status the policy will have once saved. example: ACTIVE actions: type: object properties: hierarchy: type: boolean description: >- `true`: the `approvals` decide one at a time, in the order listed. `false`: all of them are asked at once. example: false autoAction: type: string enum: - APPROVE - DENY - NONE description: >- What happens when the policy matches. `APPROVE`: allowed right away. `DENY`: refused right away. `NONE`: an approval request is opened and `approvals` decide it. example: NONE moveBalance: type: object properties: addBalance: type: boolean description: >- `true`: when the policy approves — right away or through its approvers — the amount is first moved from the funding wallet (`fromAccountId` + `fromWalletId`) into the wallet the payment comes from (on a `SPEND_REVIEW` policy, the wallet of the reviewed transaction). Nothing moves for an incoming wallet transfer request, which credits the wallet itself, nor when the funding wallet is that wallet and the money would land in the same balance. example: true fromAccountId: type: string description: >- ID of the account that holds the funding wallet. Present when `addBalance` is `true`. example: 66f2a1c7b4d3e80012c9a0b4 fromWalletId: type: string description: >- ID of the funding wallet. Present when `addBalance` is `true`. example: 6710b8e4c9e77b0012a4d6f3 required: - addBalance description: >- Funding from another wallet of the organization once the payment is approved — money moves only when `addBalance` is `true`. Absent when not configured. approvals: type: array items: type: object properties: type: type: string enum: - USER - GROUP description: >- `USER`: one member of the organization. `GROUP`: a user group of the organization — the first member who decides, decides for the group. example: GROUP id: type: string description: ID of the user or of the group. example: 8b0e4c2a-1f6d-4e3b-a9c7-2d5f8e1b6c30 name: type: string description: >- Current name of the user or group. Absent when the approver can no longer be found. Read-only: remove it before sending the policy back on an update. example: Financeiro required: - id - type description: >- One approver of the policy, with the user's or group's current name. description: >- Who approves when `autoAction` is `NONE` — every entry must approve, and one refusal denies the request. Absent or empty for `APPROVE` and `DENY`. required: - autoAction - hierarchy description: >- What the policy does when it matches. Each approver carries its current `name`; remove it before saving. conditions: type: object properties: logic: type: string enum: - AND - OR description: >- How the results of `groups` combine: `AND` — every group must match; `OR` — one is enough. example: AND groups: type: array items: type: object properties: logic: type: string enum: - AND - OR description: >- How the group's `items` combine: `AND` — every item must match; `OR` — one is enough. example: AND dependsOn: type: array items: type: string description: >- Data loaded before the group is evaluated, for items that read it through `dynamicFieldValue`. Absent on most groups. items: type: array items: type: object properties: operator: type: string description: >- How `field` is compared with `value` — see the condition catalog for the operators each field accepts. example: GREATER_THAN field: type: string description: >- Dot path of the value tested, from the condition catalog of the policy's `context` (`TRAVEL` has none). example: amount maskType: type: string description: >- `CPF_CNPJ` or `PHONE`: both sides of the comparison are masked before it runs (an unformatted CPF/CNPJ, or a phone number's middle digits). Absent when nothing is masked. dynamicFieldValue: type: string description: >- Dot path of a value loaded at evaluation time, compared instead of `value`. Absent on most conditions. value: description: >- What `field` is compared with, typed as the catalog says — an amount in centavos, a `YYYY-MM-DD` date, an array for `INCLUDES`, criteria text for `LLM_EVALUATE`. Absent for the operators that take no value. example: 500000 required: - operator - field description: One condition. description: The group's conditions. required: - logic - items description: A group of conditions. description: >- The condition groups. Empty when the policy matches everything — an organization-wide default. required: - logic - groups description: When the policy matches. required: - realmId - organizationId - context - name - order - status - actions - conditions description: >- The drafted policy. Send it to the create endpoint to save it, after removing the `name` of each approver. unsupported: type: array items: type: string example: >- A restrição "somente em dias úteis" não pôde ser expressa. description: >- What the request asked for that the draft does NOT express, in Portuguese — a restriction no condition can capture, a wallet or person that could not be found, an older policy that would always match first. Empty when everything was captured. Always show these before the draft is saved: the policy is otherwise valid and may govern more than the request described. --- Example: `["A restrição \"somente em dias úteis\" não pôde ser expressa."]` required: - policy - unsupported description: A drafted business policy, and what it could not express. '403': description: >- `BUSINESS_POLICY_FORBIDDEN` — You are not an admin of the organization. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - BUSINESS_POLICY_FORBIDDEN description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - RULE_ENGINE description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: BUSINESS_POLICY_FORBIDDEN origin: RULE_ENGINE message: You do not have permission to manage business policies '422': description: >- `BAD_REQUEST` — A path parameter or the body is invalid; `fields` lists each problem. `POLICY_GENERATION_CONTEXT_UNSUPPORTED` — `context` is `TRAVEL`. `POLICY_GENERATION_UNPROCESSABLE` — No valid policy could be drafted from the prompt; rephrase it more specifically. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - BAD_REQUEST - POLICY_GENERATION_CONTEXT_UNSUPPORTED - POLICY_GENERATION_UNPROCESSABLE description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - RULE_ENGINE description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. fields: type: array description: >- One entry per invalid request field (validation errors only). items: type: object properties: field: type: string description: >- Path of the invalid field, e.g. `label` or `values[0].value`. example: label message: type: string description: Why the field was rejected. example: label is required code: type: string description: >- `_` — e.g. `LABEL_REQUIRED`, `TYPE_ONE_OF`, `VALUES_VALUE_TYPE_ERROR`. example: LABEL_REQUIRED values: type: array items: type: string description: >- The accepted values, when the field is an enumeration. required: - field - message - code required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: BAD_REQUEST origin: RULE_ENGINE message: >- Bad Request: Your request is invalid or incomplete. Please make sure you are requesting with the right fields. fields: - field: context message: >- Invalid option: expected one of "PAYMENT"|"SPEND_REVIEW"|"TRAVEL" code: CONTEXT_ONE_OF values: - PAYMENT - SPEND_REVIEW - TRAVEL '500': description: >- `POLICY_GENERATION_FAILED` — The draft could not be generated right now; try again. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - POLICY_GENERATION_FAILED description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - RULE_ENGINE description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: POLICY_GENERATION_FAILED origin: RULE_ENGINE message: Policy generation failed ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.