permission-match and either permits or denies the call (permission-mode).* or admin-only, and the rule is filed under the resolved policy's domain. Requires Office Manager scope or higher for a policy the domain owns; a Reseller needs the domain in its territory. A shared policy, one filed under * or admin-only, changes dialing for every domain, so any write to it requires Super User scope.permission-match, permission-mode and permission-reason. In permission-match, ? matches one character and * matches any run of characters. A 202 means the rule was published, not yet applied. Add synchronous=yes to wait up to 2 seconds for this server to show the rule: the answer is then 200 with the rule, or still 202.404.Authorization: Bearer ********************202 when synchronous=yes and the rule appeared within 2 seconds: the new rule.curl --location 'https://awqacore01.crexendocloud.com/ns-api/v2/domains//dialpolicy//permission' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data-raw '{
"permission-match": "sip:+1900???????@*",
"permission-mode": "deny",
"permission-reason": "Premium rate",
"synchronous": "yes"
}'synchronous=yes.{
"dialpolicy": "No Premium",
"domain": "example.com",
"permission-match": "sip:+1900???????@*",
"permission-mode": "deny",
"permission-reason": "Premium rate",
"created-datetime": "2026-09-01T14:30:00Z",
"permission-id": "c2lwOisxOTAwPz8_Pz8_P0Aq"
}