> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-nhi-visibility-draft.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Save Egress Policy > SaveEgressPolicy validates every rule against the instance's latest discovery snapshot (principal/scope/destination/posture/credential must all be names discovery actually reported), bumps generation, and stores the result. Used by both the authoring UI (stage 3) and any direct API caller. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples put /api/v1/tb-control-plane/egress-policy openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/tb-control-plane/egress-policy: put: tags: - Time Bandit Control Plane summary: Save Egress Policy description: |- SaveEgressPolicy validates every rule against the instance's latest discovery snapshot (principal/scope/destination/posture/credential must all be names discovery actually reported), bumps generation, and stores the result. Used by both the authoring UI (stage 3) and any direct API caller. operationId: c1.api.tbcontrolplane.v1.TBControlPlaneService.SaveEgressPolicy requestBody: content: application/json: schema: $ref: >- #/components/schemas/c1.api.tbcontrolplane.v1.TBControlPlaneServiceSaveEgressPolicyRequest responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.tbcontrolplane.v1.TBControlPlaneServiceSaveEgressPolicyResponse description: Successful response components: schemas: c1.api.tbcontrolplane.v1.TBControlPlaneServiceSaveEgressPolicyRequest: description: The TBControlPlaneServiceSaveEgressPolicyRequest message. properties: defaultDenyReason: description: The defaultDenyReason field. type: string defaultOutcome: description: The defaultOutcome field. enum: - TB_EGRESS_OUTCOME_UNSPECIFIED - TB_EGRESS_OUTCOME_ALLOWED - TB_EGRESS_OUTCOME_DENIED type: string x-speakeasy-unknown-values: allow rules: description: The rules field. items: $ref: '#/components/schemas/c1.models.tbcontrolplane.v1.TBEgressRule' type: - array - 'null' tbInstanceId: description: The tbInstanceId field. type: string title: Tb Control Plane Service Save Egress Policy Request type: object x-speakeasy-name-override: TBControlPlaneServiceSaveEgressPolicyRequest c1.api.tbcontrolplane.v1.TBControlPlaneServiceSaveEgressPolicyResponse: description: The TBControlPlaneServiceSaveEgressPolicyResponse message. properties: policy: oneOf: - $ref: '#/components/schemas/c1.models.tbcontrolplane.v1.TBEgressPolicy' - type: 'null' title: Tb Control Plane Service Save Egress Policy Response type: object x-speakeasy-name-override: TBControlPlaneServiceSaveEgressPolicyResponse c1.models.tbcontrolplane.v1.TBEgressRule: description: |- TBEgressRule is one typed rule. Deliberately smaller than AgentGuardrailRule: no celCondition (TB's matcher is typed, not an expression evaluator), no hook ids (TB has no hook model -- posture and review routes are the nearest analogues, unmapped here). `hard_allow` and inline `consider` are deliberately unrepresentable: no field here names either, and protojson's default unknown-field behavior already rejects a request naming either key -- DiscardUnknown is never set on the apigw decoder, so this is genuinely "rejected at decode" via the REST route, and structurally absent for any gRPC caller (no stub has an equivalent field to set). properties: credentialId: description: The credentialId field. type: string denyReason: description: The denyReason field. type: string description: description: The description field. type: string destinations: description: The destinations field. items: type: string type: - array - 'null' displayName: description: The displayName field. type: string id: description: The id field. type: string ingressScopes: description: The ingressScopes field. items: type: string type: - array - 'null' methods: description: The methods field. items: type: string type: - array - 'null' mode: description: The mode field. enum: - TB_EGRESS_MODE_UNSPECIFIED - TB_EGRESS_MODE_ENFORCE - TB_EGRESS_MODE_OBSERVE - TB_EGRESS_MODE_DISABLED type: string x-speakeasy-unknown-values: allow outcome: description: The outcome field. enum: - TB_EGRESS_OUTCOME_UNSPECIFIED - TB_EGRESS_OUTCOME_ALLOWED - TB_EGRESS_OUTCOME_DENIED type: string x-speakeasy-unknown-values: allow paths: description: The paths field. items: type: string type: - array - 'null' postureId: description: The postureId field. type: string principals: description: |- Selector, discovery-driven picker fields. Every non-empty value here must name something the latest TBDiscoverySnapshot for the target instance actually reported. items: type: string type: - array - 'null' priority: description: >- Explicit order; TB evaluates policy rows first-match, so rules compile in ascending priority order. format: int32 type: integer sourceTemplateId: description: The sourceTemplateId field. type: string systemManaged: description: The systemManaged field. type: boolean title: Tb Egress Rule type: object x-speakeasy-name-override: TBEgressRule c1.models.tbcontrolplane.v1.TBEgressPolicy: description: |- TBEgressPolicy is the typed policy document for one TB instance. Binds per-instance, not per-tenant-across-instances, keyed by tb_instance_id exactly as discovery reports it. properties: createdAt: format: date-time type: - string - 'null' defaultDenyReason: description: The defaultDenyReason field. type: string defaultOutcome: description: The defaultOutcome field. enum: - TB_EGRESS_OUTCOME_UNSPECIFIED - TB_EGRESS_OUTCOME_ALLOWED - TB_EGRESS_OUTCOME_DENIED type: string x-speakeasy-unknown-values: allow generation: description: |- Opaque, bumped on every successful save -- TB's change detector. Stamped as "c1-gen-". type: string rules: description: The rules field. items: $ref: '#/components/schemas/c1.models.tbcontrolplane.v1.TBEgressRule' type: - array - 'null' tbInstanceId: description: The tbInstanceId field. type: string tenantId: description: The tenantId field. type: string updatedAt: format: date-time type: - string - 'null' title: Tb Egress Policy type: object x-speakeasy-name-override: TBEgressPolicy securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````