Decionis API
Decionis for DevelopersGitHub
HomeAPI ReferenceSDKsContext Plugin
Policies

Declare an organisation invariant every policy release in its scope must refuse

POST
/v1/public/account/workspace/policy-platform/invariants

Account session of the organisation's owner only (POLICY_INVARIANT_OWNER_REQUIRED); same-site JSON and an Idempotency-Key are required. The invariant compiles to one scenario per combination of its varied values, each a copy of input with decision_type set to the invariant's. From the next assurance run on, every candidate of every policy whose runtime scope names the invariant's decision domain and type (or that declares no scope) must REJECT each compiled scenario, or the run fails with INVARIANT_VIOLATED; no dataset disposition, review or approval clears it. One live declaration per invariant id (409 POLICY_INVARIANT_ALREADY_DECLARED); the live set compiles to at most 500 scenarios per environment (422 POLICY_INVARIANT_LIMIT).

Authorization

AccountSessionCookie
decionis_account_session<token>

The signed HttpOnly account session the web app holds after sign-in (also accepted as a Bearer acct_ token).

In: cookie

Header Parameters

Idempotency-Key?string

Request Body

application/json

environment*string

Value in

  • "sandbox"
  • "production"
invariant*

An organisation invariant ("no production administrative port is opened to 0.0.0.0/0"): compiled to one scenario per combination of the vary values, each a copy of input with decision_type set to decisionType and each varied field written at its dotted path. At most 100 scenarios; a field is varied once, never inside another, never decision_type, and never through a prototype name.

reason*string
Length1 <= length <= 4000

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/public/account/workspace/policy-platform/invariants" \  -H "Content-Type: application/json" \  -d '{    "environment": "sandbox",    "invariant": {      "id": "string",      "statement": "string",      "decisionDomain": "string",      "decisionType": "string",      "input": {},      "vary": [        {          "field": "string",          "values": [            "string"          ]        }      ]    },    "reason": "string"  }'
{  "record": {    "schemaVersion": 1,    "kind": "decionis.policy-invariant/v1",    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",    "orgId": "25b2c2d5-a7fc-47d0-89e4-8709a1560bfa",    "environment": "sandbox",    "invariant": {      "id": "string",      "statement": "string",      "decisionDomain": "string",      "decisionType": "string",      "input": {},      "vary": [        {          "field": "string",          "values": [            "string"          ]        }      ]    },    "declaredBy": "0a658536-d524-4ec3-a0d7-6a378ee32fd8",    "declaredAt": "2019-08-24T14:15:22Z",    "reason": "string"  },  "digest": "string",  "retirement": null}

List the organisation's policy invariants, live and retired GET

Account session of any workspace member. Every declaration the organisation's owner made for the environment, newest first, each with its digest and, once retired, its retirement.

Retire an organisation invariant, naming the exact declaration it ends POST

Account session of the organisation's owner only; same-site JSON and an Idempotency-Key are required. `invariantDigest` must be the live declaration's digest (`409 POLICY_INVARIANT_DIGEST_MISMATCH`); a declaration is retired once (`409 POLICY_INVARIANT_ALREADY_RETIRED`). The declaration itself never changes; the retirement is recorded beside it, and the next assurance run no longer reads it.