Get applied policy by IDs

GET

/api/v1/projects/{projectId}/policies/{appliedPolicyId}

curl --request GET \
  --url https://localhost:10001/api/v1/projects/example/policies/example \
  --header 'Authorization: <Authorization>'

Retrieve an applied policy and its controls with computed status by project and policy IDs

Authorizations

• BearerAuth

Parameters

Path Parameters

projectId

required

string

Project ID, UUID (urn:uuid optional), or slug:my-project

appliedPolicyId

required

string

Applied policy ID, slug:my-policy, or urn:cid:bafy…

Responses

200

Applied policy with controls

Media type application/json

An applied policy with its controls, each carrying the status derived from its declarations and reviews

object

controls

Array<object>

A control within an applied policy, with its latest declaration and review state

object

appliedPolicyId

integer

cid

string

controlId

integer

createdAt

string format: date-time

id

integer

indicators

Array<object>

An indicator bound to an applied policy control, defining how and when it is evaluated

object

applicationUuid

Urn:uuid form

string

appliedPolicyControlId

integer

createdAt

string format: date-time

criteria

Custom indicators only

object

declarationProfile

object

emitOn

required

When to emit a declaration

string

Allowed values: pass fail both none

statementTemplate

string

titleTemplate

string

extractionRules

Custom indicators only

object

id

integer

indicatorId

Urn:uuid form

string

lastEvaluatedAt

string format: date-time

parameters

object

status

string

Allowed values: active disabled archived

triggerType

string

Allowed values: event

updatedAt

string format: date-time

status

string

updatedAt

string format: date-time

policy

A policy applied to a project, tracked independently of the library template it came from

object

appliedAt

string format: date-time

appliedBy

string

appliedByDid

Verifiable actor; appliedBy is the label

string

archivedAt

Set via the archive endpoint

string format: date-time

archivedBy

Set via the archive endpoint

string

archivedByDid

Verifiable actor; archivedBy is the label

string

cid

Assigned by the integrity service

string

createdAt

string format: date-time

id

integer

isArchived

Set via the archive endpoint

boolean

isReapplied

boolean

name

string

policyId

Taken from the path on create

integer

projectId

Taken from the path on create

integer

slug

Derived from name

string

status

string

subjectCid

Assigned by the integrity service

string

updatedAt

string format: date-time

Example

{
  "controls": [
    {
      "indicators": [
        {
          "declarationProfile": {
            "emitOn": "pass"
          },
          "status": "active",
          "triggerType": "event"
        }
      ]
    }
  ]
}

400

Bad request - Invalid project ID or applied policy ID

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}

401

Unauthorized - Authentication required

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}

403

Forbidden - No project access

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}

404

Applied policy not found

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}

500

Internal server error

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}