Submit a versioned policy bundle artifact for Decionis encoding
Use this endpoint only when an integration participates in policy authoring. The SDK submits a reviewed policy bundle artifact to Decionis; it does not evaluate or enforce policy rules locally.
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Header Parameters
Request Body
application/json
^1\.[0-9]+(\.[0-9]+)?$uuid1 <= length <= 100date-timedate-time1 <= itemsWhich states a decision type's target may move between, checked before any rule. For a decision of decision_type, the move from the state at the fact path from (typically agent_safe.precondition.state) to the state at to must be one of allowed, exactly as written, or the evaluation resolves transition_not_allowed and the outcome is REJECT. No value at to asks for no state, and to equal to from is no transition. A from or to that is not a string fails safe to ESCALATE as missing_required_signals. A bundle declaring any is signed for the edge as core_abi: 8.
items <= 50Response Body
application/json
application/json
application/json
curl -X POST "https://example.com/v1/protocol/policies/bundles" \ -H "Content-Type: application/json" \ -d '{ "protocol_version": "string", "bundle_id": "fc6f5a67-caa1-4339-9c14-a67826143b60", "org_id": "string", "version": "string", "effective_from": "2019-08-24T14:15:22Z", "rules": [ { "rule_id": "string", "name": "string", "decision_domain": "string", "when": {}, "then": { "action": "REQUIRE_REVIEW" }, "priority": 0, "enabled": true } ] }'{ "accepted": true, "service": "string", "protocol_version": "string", "artifact": "policy_bundle", "artifact_id": "string", "org_id": "string", "received_at": "2019-08-24T14:15:22Z"}Retire an organisation invariant, naming the exact declaration it ends POST
Account session of the organisation's owner only; same-site JSON and an Idempotency-Key are required. `invariantDigest` must be the live declaration's digest (`409 POLICY_INVARIANT_DIGEST_MISMATCH`); a declaration is retired once (`409 POLICY_INVARIANT_ALREADY_RETIRED`). The declaration itself never changes; the retirement is recorded beside it, and the next assurance run no longer reads it.
Draft a reviewable policy strategy from unstructured sources POST
Turns scattered policy material — pasted text and uploaded files (PDF, XLSX, XML, HTML, JSON, plain text such as transaction or audit logs) plus optional live policy-source connectors (Jira, Confluence, Notion, Google Drive, Git repository, SAP) — into a strategy-shaped Decionis draft with clauses bucketed for automatic execution, escalation, and blocking. The draft is not persisted: review it, then encode the accepted version. Drafting is LLM-assisted when a provider is configured and falls back to deterministic extraction otherwise; `used_llm` reports which path ran. Requires an org API key with the ADMIN role and the `autonomous:manage` or `org:*` scope.