Decionis API
Decionis for DevelopersGitHub
HomeAPI ReferenceSDKsContext Plugin
Policies

Create a policy, or create it MANAGED from a system scaffold

POST
/v1/policies

Account session of a writing workspace member; same-site JSON and an Idempotency-Key are required. With content, the caller authors revision 1 and holds POLICY_OWNER and AUTHOR. With governance MANAGED and no content, the system writes revision 1 as a scaffold with no author, the caller holds POLICY_OWNER and RELEASE_APPROVER (never AUTHOR), the named desk analysts receive their bounded roles, and MANAGED governance takes the scaffold as its baseline, all in one journaled command. Alias kept on the same handler /v1/public/account/workspace/policy-platform.

Authorization

AccountSessionCookie
decionis_account_session<token>

The signed HttpOnly account session the web app holds after sign-in (also accepted as a Bearer acct_ token).

In: cookie

Header Parameters

Idempotency-Key?string

Request Body

application/json

environment*string

Value in

  • "sandbox"
  • "production"
content*

The revision's content. Of its properties, the contract pins the two a release carries into its signed manifest; the rest are the policy document.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/policies" \  -H "Content-Type: application/json" \  -d '{    "environment": "sandbox",    "content": {}  }'
{}

Evaluate a bound native payment with managed case evidence POST

Default off. Current ordinary workspace API key with decision:read and decision:write; no runtime-key scope expansion. Requires an immutable Commerce attempt, a fresh matching native snapshot, historical Accounts reviewer evidence plus fresh current authority, and the exact active approved policy pin. The whole Protocol policy and P12-P15 checks run. Transport retries retain the original input and expiry; no lease renewal. A policy result is not consent or an ERP write. Missing authority fails closed; HOLD and BLOCK remain stops. On a connection with the permit path on, a request may name the executor and the exact payment line's agent-safe.intent/1 intent; Core then binds one single-use grant to that intent and answers it under grant, with the permit fields a permit-style executor presents. Nothing executes until that permit is claimed, once.

Validate an encoded policy document POST

Next Page