---
title: "Create a policy plugin"
slug: "dpo-api-server-plugins-create-a-policy-plugin"
updated: 2026-10-27T20:13:21Z
published: 2026-10-27T20:13:21Z
canonical: "docs.onespan.com/dpo-api-server-plugins-create-a-policy-plugin"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a policy plugin

## Introduction

The policy plugin stored in com.noknok.gateway.plugin.policy.DefaultPolicyManager is used in the API Server default configuration. A user-written custom policy manager plugin must implement the IPolicyManager interface.

For information about building and deploying custom API Server plugins, see [Create a plugin](/dpoa/docs/s3suite94-create-a-custom-api-server-plugin-1).

## Interface

```java
package com.noknok.gateway.sdk;
        /**
        * Implement this interface to create a Policy Plugin.
        * This interface defines a single method to get the policy name.
        * Implementations should have a single constructor with the following
        * signature:
        * public MyPolicyManager (IConfigurationManager configurationManager,
        * String tenantID, String objectType);
        */
        public interface IPolicyManager {
        /**
        * Called when REST APIs, which require authorization, are accessed,
        * such as at registration and step-up auth APIs.Implementation class
        * may want to use either input jsonRequest or any other retrieved data
        * from HttpServletRequest instance.
        * Parameters:
        * request - HTTP request from client.
        * jsonRequest - REST request for Authentication Server.
        * Returns:
        * Policy name to be used for the operation on the
        * DigipassONE Authentication server.
        * Throws:
        * BadRequestException - if request is invalid.
        * InternalErrorException - if other errors occur.
        */
        String getPolicyName(javax.servlet.http.HttpServletRequest request,
        com.google.gson.JsonObject jsonRequest);
        }
```