# Regional policy (/api-v2/regional-policy)



A regional policy constrains where a project's requests may execute. When a resolved region is not on the allow-list, inference is denied with `region_not_allowed` (403) before any provider call. A policy with no concrete allow-list (e.g. `global`) imposes no restriction. Policy ids are prefixed `rgn_`. See the [regional policy guide](/guides/regional-policy) and [GDPR and CCPA](/security/gdpr-ccpa).

All requests require a bearer API key. See [authentication](/api-reference/authentication).

## Set the policy [#set-the-policy]

`POST /v2/regional-policy`

Installs (or replaces) the project's regional policy.

<ParamField body="region_policy" type="string">
  The policy shorthand, e.g. `us_only`, `eu_only`, or `global`. Combined with `allowed_regions` to form the effective allow-list.
</ParamField>

<ParamField body="allowed_regions" type="array">
  Explicit regions to allow, e.g. `["us", "eu"]`. Defaults to an empty list.
</ParamField>

<ParamField body="data_boundary" type="string" default="project">
  The data-boundary scope the policy enforces.
</ParamField>

```bash
curl https://api.zumik.ai/v2/regional-policy \
  -H "Authorization: Bearer $ZUMIK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "region_policy": "eu_only",
    "allowed_regions": ["eu"],
    "data_boundary": "project"
  }'
```

```json
{
  "id": "rgn_01jy7npq89s1t2u3v4w5x6y7z0",
  "object": "regional_policy",
  "project_id": "prj_01jy7n0a4c8m2t6v9q3wrxk7bd",
  "region_policy": "eu_only",
  "allowed_regions": ["eu"],
  "data_boundary": "project",
  "updated_at": "2026-06-15T16:36:02Z"
}
```

<ResponseField name="id" type="string">
  Opaque policy id, prefixed `rgn_`.
</ResponseField>

<ResponseField name="object" type="string">
  Always `regional_policy`.
</ResponseField>

<ResponseField name="project_id" type="string">
  The owning project.
</ResponseField>

<ResponseField name="region_policy" type="string">
  The policy shorthand.
</ResponseField>

<ResponseField name="allowed_regions" type="array">
  The explicit allow-list.
</ResponseField>

<ResponseField name="data_boundary" type="string">
  The enforced data boundary.
</ResponseField>

<ResponseField name="updated_at" type="string">
  RFC 3339 update timestamp.
</ResponseField>

## Read the policy [#read-the-policy]

`GET /v2/regional-policy`

```bash
curl https://api.zumik.ai/v2/regional-policy \
  -H "Authorization: Bearer $ZUMIK_API_KEY"
```

Returns the policy object, or `404` when no policy is configured.

## Errors [#errors]

| Status | Code                    | When                                               |
| ------ | ----------------------- | -------------------------------------------------- |
| 401    | `invalid_api_key`       | Missing or invalid API key.                        |
| 404    | `invalid_request_error` | No regional policy is configured for this project. |

A denied generation returns `403 region_not_allowed`. See the full table on [errors](/api-reference/errors).