Validate an encoded policy document
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Header Parameters
Request Body
application/json
Response Body
application/json
curl -X POST "https://example.com/v1/policies/validate" \ -H "Content-Type: application/json" \ -d '{}'{ "valid": true, "errors": [ "string" ], "warnings": [ "string" ]}Create a policy, or create it MANAGED from a system scaffold POST
Account session of a writing workspace member; same-site JSON and an Idempotency-Key are required. With content, the caller authors revision 1 and holds POLICY_OWNER and AUTHOR. With governance MANAGED and no content, the system writes revision 1 as a scaffold with no author, the caller holds POLICY_OWNER and RELEASE_APPROVER (never AUTHOR), the named desk analysts receive their bounded roles, and MANAGED governance takes the scaffold as its baseline, all in one journaled command. Alias kept on the same handler /v1/public/account/workspace/policy-platform.
Upload transaction, event or audit records to a policy POST
The owner's door into the central policy intake. Account session of the policy's POLICY_OWNER or SOURCE_CUSTODIAN; same-site JSON and an Idempotency-Key are required. The records are assessed and signed exactly as on /v1/assessments/{assessmentId}/records, and the upload is recorded on the policy's access chain. The findings stay with this policy, and its authors (the desk on a MANAGED policy) receive the findings case. Uploading changes no revision, so the uploader never becomes an author. A policy_id in the body must name this policy.