@PostMapping(OAuth20Constants.BASE_OAUTH20_URL + "/{resourceId}/" + OAuth20Constants.UMA_POLICY_URL)
    @Operation(summary = "Create policy for resource set", description = "Creates a policy for the specified resource set",
        parameters = @Parameter(name = "resourceId", required = true, in = ParameterIn.PATH, description = "Resource ID"))
    public ResponseEntity createPolicyForResourceSet(
        @PathVariable("resourceId")
        final long resourceId,
        @RequestBody
        final String body,
        final HttpServletRequest request,
        final HttpServletResponse response) {
        try {
            val profileResult = getAuthenticatedProfile(request, response, OAuth20Constants.UMA_PROTECTION_SCOPE);
            val resourceSetResult = getUmaConfigurationContext().getUmaResourceSetRepository().getById(resourceId);
            if (resourceSetResult.isEmpty()) {
                val model = buildResponseEntityErrorModel(HttpStatus.NOT_FOUND, "Requested resource-set cannot be found");
                return new ResponseEntity(model, model, HttpStatus.BAD_REQUEST);
            }
            val resourceSet = resourceSetResult.get();
            resourceSet.validate(profileResult);

            val umaRequest = MAPPER.readValue(JsonValue.readHjson(body).toString(), ResourceSetPolicy.class);
            resourceSet.getPolicies().add(umaRequest);
            val saved = Objects.requireNonNull(getUmaConfigurationContext().getUmaResourceSetRepository().save(resourceSet));

            val model = CollectionUtils.wrap("entity", saved, "code", HttpStatus.CREATED);
            return new ResponseEntity(model, HttpStatus.OK);
        } catch (final Exception e) {
            LoggingUtils.error(LOGGER, e);
        }
        return new ResponseEntity("Unable to save policy for resource-set.", HttpStatus.BAD_REQUEST);
    }
Gets policy for resource set.

@param resourceId the resource id
@param body       the body
@param request    the request
@param response   the response
@return the policy for resource set
support/cas-server-support-oauth-uma-core/src/main/java/org/apereo/cas/uma/web/controllers/policy/UmaCreatePolicyForResourceSetEndpointController.java