# Create domains

When you create new domains, you specify the following:

- The users that belong to the domain and their role in the domain.
- The governing strategy to apply.
- Roles with read-only access permissions to view different entities in the domain.
- Policies to use in the domain and, if applicable, its subdomains.


All Ripple Custody environments include at least a root domain by default, so you can only create new domains that are a subdomain of the root domain or, if one exists, another subdomain.

## Prerequisites

Before you create your domain, you need the following:

| Prerequisite | Additional information |
|  --- | --- |
| Details of the user roles available for read-only access and user creation | [Get known user roles](/products/custody/v1.15/api/reference/openapi/users/getknownuserroles)You can also use new roles, if required. |
| The following new IDs, in a standard UUID format:A domain IDUser IDsPolicy IDsAn intent ID |  |


## Create a domain

System change process
All new requests to change the system state follow the same process. To familiarize yourself with this process first, follow the [Request a change with an intent](/products/custody/v1.15/resources/tutorials/intent) tutorial.

To create a domain, follow the steps in [Request a change with an intent](/products/custody/v1.15/resources/tutorials/intent), with a payload similar to the following example.

### Payload example


```json
{  
   "payload": {
     "id": "6c460500-5aa9-47cc-b3b0-20264331e995",
     "alias": "Alias for domain with id 6c460500-5aa9-47cc-b3b0-20264331e995",
     "lock": "Unlocked",
     "governingStrategy": null,
     "permissions": {
        "readAccess": {
           "domains": [
              "admin",
              "manager",
              "trader"
           ],
           "users": [
              "admin",
              "manager",
              "trader"
           ],
           "endpoints": [
              "admin",
              "manager",
              "trader"
           ],
           "policies": [
              "admin"
           ],
           "accounts": [
              "admin",
              "manager",
              "trader"
           ],
           "transactions": [
              "admin",
              "manager",
              "trader"
           ],
           "requests": [
              "admin",
              "manager",
              "trader"
           ],
           "events": [
              "admin",
              "manager",
              "trader"
           ]
        }
     },
     "description": "Description for domain with id 6c460500-5aa9-47cc-b3b0-20264331e995",
     "customProperties": {}
     "users": [
        {
           "id": "6ac20654-450e-29e4-65e2-1bdecb7db7c4",
           "alias": "admin1@ripple.com",
           "publicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7ItVC+y2KerttcRjPLDs8QmDVz7yI7ElQA70Sz+cLcBI6041aObPvcNqps8eTYe2jhc2Kb5qgNgoACB3SqpYIA==",
           "lock": "Unlocked",
           "customProperties": {},
           "roles": [
               "admin"
           ],
           "description": "Administrator"
        }
     ],
     "policies": [
        {
           "id": "00000000-0000-0000-0000-000000000000",
           "alias": "Yes policy",
           "rank": 0,
           "intentTypes": null,
           "scope": "SelfAndDescendants",
           "scriptingEngine": "Javascript_v0",
           "condition": {
              "type": "Expression",
              "expression": "context.request.author.id == '6ac20654-450e-29e4-65e2-1bdecb7db7c4'"
           },
           "workflow": [
              {
                "role": "admin",
                "quorum": 1,
                "type": "RoleQuorum"
              }
           ],
           "lock": "Unlocked",
           "description": "For demo purpose.",
           "customProperties": {}
        }
     ],
     "type": "v0_CreateDomain"
   }
},
```

Fields of the `payload` block to note are as follows:

| Field | Description |
|  --- | --- |
| `id` | The ID of the new domain. This field is required, so you need to prepare the ID in a valid UUID format before you run the operation. |
| `lock` | You can set this to `Locked` to create an inactive domain and unlock it later. For more information, see [Update domains](/products/custody/v1.15/api/environment/domain/update). |
| `governingStrategy` | Choose between the following:`ConsiderDescendants`: Consider policies in this domain's subdomains `CoerceDescendants`: Ignore policies in this domain's subdomainsFor more information, see [Governing strategy](/products/custody/v1.15/get-started/deployment/system-setup/setup#governing-strategy). |
| `permissions` | The user roles that can view each entity type in the domain. |
| `users` | A list of users that belong to the domain. |
| `policies` | Policies for the domain. For details of the payload format, see [Create policies](/products/custody/v1.15/api/environment/policy/create#payload-example). |
| `type` | `v0_CreateDomain` |


The domain is created when the domain creation intent is successfully approved and executed.