Issue the organization's active policy bundle, signed for the edge evaluator
Signs the bundle hosted evaluation would run on right now and returns it
as a compact JWS for the Decionis edge evaluator (the WebAssembly policy
core a deployment runs inside its own network). The edge evaluator
evaluates only bundles Decionis signed: it verifies the signature
against the keys its release pins (published at
/.well-known/decionis-policy-bundle-jwks.json), the audience against
its organization, the validity window against the time its host
supplies, and the bundle against bundle_digest.
Selection is hosted evaluation's own: the newest active bundle whose
effective window contains now and that passes the maker-checker gate,
or, when policy_version is given, exactly that version among them. An
unapproved, historical, not-yet-effective or expired bundle is never
signed; like hosted evaluation, it is treated as not active and the
answer is 404 POLICY_BUNDLE_NOT_FOUND with the policy guard's reason.
The signed bundle lives ttl_seconds (default 7 days, at most 30 days
and at most the organization's plan maximum), never past the bundle's
own effective_to. Every issuance is recorded before it is returned
(see GET /v1/edge/policy-bundles/issuances); one that cannot be
recorded is not issued. Requires an organization API key with
policy:read (or policy:* / org:*); keys without explicit scopes
are refused.
Only organizations licensed for the edge evaluator receive bundles:
Enterprise and self-managed plans include it, Premium with the edge
add-on, and an operator may list an organization for a pilot. Any
other organization is answered 403 EDGE_EVALUATOR_NOT_ENTITLED
(its signed entitlement, GET /v1/edge/entitlement, says why).
The bundle is core_abi: 3: it also carries what hosted would decide
differently for this organization, resolved with hosted's own code —
vertical_pack (its configured pack, or the operator's pack
override, else null) and max_mode / max_mode_reason (SHADOW with
hosted's 403 code for an unclaimed provisional or AWS service
workspace, else ENFORCEMENT). An edge module older than ABI 3 refuses
such a bundle rather than decide without them. A bundle whose rules
compare two facts (EQ_FACT, NEQ_FACT) is core_abi: 7, which an
edge module older than ABI 7 refuses the same way, and one that
declares allowed_transitions is core_abi: 8, which an edge module
older than ABI 8 refuses.
A bundle with a rule that draws on a held allowance (then.allowance)
is never signed for an edge: only hosted Decionis holds an allowance,
and an edge module would approve such a rule with nothing reserved.
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Query Parameters
Recorded with the issuance. The bundle carries the rules of every decision domain; the domain is chosen per evaluation, so it does not change which bundle is signed.
^[A-Za-z0-9_.:-]+$1 <= length <= 100Sign exactly this version; it must be active and approved.
1 <= length <= 20060 <= value <= 2592000604800Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/edge/policy-bundles/current"{ "signed_bundle": "string", "bundle_id": "string", "policy_version": "string", "kid": "string", "issued_at": "2019-08-24T14:15:22Z", "not_before": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z"}Read a governed plan's state and each step's status GET
The plan as registered, its state and each step's status, derived now from the claim records of every grant issued for one of its steps: `COMMITTED` only with a confirmed effect. `PARTIAL` (a step failed after others committed) stays so once reached and maps to the SCITT execution profile's `partially_completed`; `SUSPENDED` (a step's outcome is unknown) lasts until reconciliation settles it.
List the signed policy bundles issued to the organization GET
The record of every signed policy bundle issued to the authenticated organization, newest first: its `jti`, bundle, version, digest, signing key, validity window and the API key that requested it. Requires an organization API key with `policy:read` (or `policy:*` / `org:*`).