# (NEW!) Create Security Template

Create a security, rights, or access template for the authenticated customer.


Business Rules:
- name must be trimmed, non-empty, and unique per customer.
- type is set only at creation and is immutable thereafter.
- Every groups[].id and permissionIds[] entry must be a well-formed UUID and must exist for the customer (groups) or in the permission catalog (permissions). Unknown ids are rejected with 422, not silently dropped.
- Duplicate group ids in the same request are rejected.

Defaults:
- type defaults to security-template.
- groups defaults to [].

The response body is returned in the same shape as GET /security/templates/{id}, so the UI can render the created template with no follow-up read.

The user submitting the request must have the Security Template Management admin privilege.

Endpoint: POST /security/templates
Version: 1.5
Security: ApiKeyAuth, BasicAuth

## Header parameters:

  - `X-API-Key` (string, required)
    Customer-specific API key required to invoke API.

  - `Authorization` (string, required)
    Provided by Authentication Token creation operation.

  - `Content-Type` (string, required)
    Enum: "application/json"

## Request fields (application/json):

  - `name` (string, required)
    Display name of the template. Trimmed, non-empty, maximum 75 characters. Must be unique per customer.
    Example: "Confidential"

  - `type` (string)
    Template classification. Defaults to security-template. Set only at creation; immutable thereafter.
    Enum: "security-template", "rights-template", "access-template"

  - `groups` (array)
    Groups to assign to the template, each with the permissions granted to it. Defaults to []. Duplicate group IDs are rejected.

  - `groups.id` (string, required)
    Group ID. Must exist for the authenticated customer.
    Example: "f22dccbc-6032-4279-9f19-d5dc91d9757e"

  - `groups.permissionIds` (array)
    IDs of the permissions granted to this group. An empty array means the group is present but grants nothing. Defaults to [].
    Example: ["31bdde6b-1a2c-4d5e-8f90-1234567890ab","9e187a4e-cfe4-419e-8c6c-2509e4bf400b"]

## Response 201 fields (application/json):

  - `id` (string)
    Unique ID of the template.
    Example: "a9380047-07d7-48aa-b4b7-474d00f0f428"

  - `name` (string)
    Display name of the template.
    Example: "Confidential"

  - `type` (string)
    Template classification. Set at creation and immutable thereafter.
    Enum: "security-template", "rights-template", "access-template"

  - `groupCount` (integer)
    Total number of groups on the template, across all pages.
    Example: 2

  - `permissionCount` (integer)
    Total number of permissions granted across all groups, including the watermark permission.
    Example: 3

  - `createdBy` (string)
    User ID of the template's creator.
    Example: "dc63db1b-1e63-43bc-877e-418931b6895c"

  - `createdEpoch` (integer)
    Unix timestamp (ms) of creation.
    Example: 1773070355217

  - `createdDate` (string)
    ISO 8601 creation date.
    Example: "2026-03-09T15:32:35.217Z"

  - `lastUpdatedBy` (string)
    User ID of the user who last updated the template.
    Example: "dc63db1b-1e63-43bc-877e-418931b6895c"

  - `lastUpdatedEpoch` (integer)
    Unix timestamp (ms) of the last update. Pass this value back as expectedLastUpdatedEpoch on PATCH to guard against concurrent edits.
    Example: 1773070355217

  - `lastUpdatedDate` (string)
    ISO 8601 last updated date.
    Example: "2026-03-09T15:32:35.217Z"

  - `groups` (object)
    Page of groups assigned to the template.

  - `groups.totalCount` (integer)
    Total number of groups on the template, across all pages.
    Example: 2

  - `groups.items` (array)
    Groups on this page.

  - `groups.items.id` (string)
    Unique ID of the group.
    Example: "f22dccbc-6032-4279-9f19-d5dc91d9757e"

  - `groups.items.name` (string)
    Display name of the group.
    Example: "Marketing"

  - `groups.items.permissions` (array)
    Permissions evaluated against this group. Present only when includePermissions is true.

  - `groups.items.permissions.id` (string)
    Example: "31bdde6b-1a2c-4d5e-8f90-1234567890ab"

  - `groups.items.permissions.name` (string)
    Example: "View"

  - `groups.items.permissions.isPermitted` (boolean)
    Whether this group is granted the permission.
    Example: true

  - `groups.pageInfo` (object)
    Pagination metadata for groups.items.

  - `groups.pageInfo.hasNextPage` (boolean)
    Whether more groups exist beyond this page.

  - `groups.pageInfo.nextCursor` (string,null)
    Cursor for the next page of groups. Pass as groupCursor on the next request. Null if no more pages.

## Response 400 fields (application/json):

  - `message` (string)

  - `detail` (string)

## Response 401 fields (application/json):

  - `message` (string)

  - `detail` (string)

## Response 403 fields (application/json):

  - `message` (string)

  - `detail` (string)

## Response 409 fields (application/json):

  - `message` (string)

  - `existingTemplateId` (string)
    ID of the existing template with the conflicting name.

## Response 422 fields (application/json):

  - `message` (string)

  - `invalidGroupIds` (array)

  - `invalidPermissionIds` (array)