List baseline applied policies

List all baseline policies applied to a specific project

gethttps://localhost:10001/api/v1/projects/{projectId}/policies/baseline

bash

curl --request GET \
  --url 'https://localhost:10001/api/v1/projects/{projectId}/policies/baseline' \
  --header 'Authorization: Bearer <token>'

javascript

const response = await fetch("https://localhost:10001/api/v1/projects/{projectId}/policies/baseline", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <token>"
  }
});

const data = await response.json();

typescript

interface AppliedPolicyDetailsResponse {
  appliedPolicy?: Record<string, unknown>;
  controls?: Record<string, unknown>[];
  credential?: Record<string, unknown>;
}

const response = await fetch("https://localhost:10001/api/v1/projects/{projectId}/policies/baseline", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <token>"
  }
});
if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);

const data: AppliedPolicyDetailsResponse[] = await response.json();

python

import requests

response = requests.get(
    "https://localhost:10001/api/v1/projects/{projectId}/policies/baseline",
    headers={
        "Authorization": "Bearer <token>",
    },
)
response.raise_for_status()
print(response.json())

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://localhost:10001/api/v1/projects/{projectId}/policies/baseline", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer <token>")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.Status, string(data))
}

java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://localhost:10001/api/v1/projects/{projectId}/policies/baseline"))
            .header("Authorization", "Bearer <token>")
            .method("GET", HttpRequest.BodyPublishers.noBody())
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}

csharp

using System.Net.Http.Headers;

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Get, "https://localhost:10001/api/v1/projects/{projectId}/policies/baseline");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "<token>");

using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");

php

<?php

$ch = curl_init('https://localhost:10001/api/v1/projects/{projectId}/policies/baseline');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer <token>',
    ],
    CURLOPT_RETURNTRANSFER => true,
]);

$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
echo $status . " " . $response . PHP_EOL;

ruby

require "net/http"

uri = URI("https://localhost:10001/api/v1/projects/{projectId}/policies/baseline")
request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer <token>"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
  http.request(request)
end
puts "#{response.code} #{response.body}"

rust

// Cargo.toml dependencies: reqwest, tokio (features "full")

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let response = reqwest::Client::new()
        .get("https://localhost:10001/api/v1/projects/{projectId}/policies/baseline")
        .header("Authorization", "Bearer <token>")
        .send()
        .await?;

    println!("{} {}", response.status(), response.text().await?);
    Ok(())
}

Authorizations

BearerAuth · API key in header "Authorization" — Type "Bearer" followed by a space and JWT token.

Parameters

Path parameters

Name	Type	Description
`projectId` required	`string`	Project ID, UUID (urn:uuid optional), or slug:my-project

Responses

200Baseline applied policies

application/json

Array of core.AppliedPolicyDetailsResponse

appliedPolicycore.AppliedPolicy
A policy applied to a project, tracked independently of the library template it came from
Show core.AppliedPolicy
- appliedAtstring<date-time>read-only
- appliedBystringread-only
- appliedByDidstringread-only
  Verifiable actor; appliedBy is the label
- archivedAtstring<date-time>read-only
  Set via the archive endpoint
- archivedBystringread-only
  Set via the archive endpoint
- archivedByDidstringread-only
  Verifiable actor; archivedBy is the label
- cidstringread-only
  Assigned by the Integrity Service
- createdAtstring<date-time>read-only
- idintegerread-only
- isArchivedbooleanread-only
  Set via the archive endpoint
- isReappliedbooleanread-only
- namestring
- policyIdintegerread-only
  Taken from the path on create
- projectIdintegerread-only
  Taken from the path on create
- slugstringread-only
  Derived from name
- statusstringread-only
- subjectCidstringread-only
  Assigned by the Integrity Service
- updatedAtstring<date-time>read-only
controlscore.AppliedPolicyControlDetailsResponse[]
Show properties
Array of core.AppliedPolicyControlDetailsResponse
- activeIndicatorCountinteger
- appliedPolicyControlIdinteger
- cidstring
- citationscore.Citation[]
  Show properties
  Array of core.Citation
  titlestring
  Up to 255 characters; trimmed
  urlstring
  An absolute http or https URL with a hostname, up to 2048 bytes; trimmed
- controlCodestring
- controlIdinteger
- declarationscore.DeclarationDetails[]
  Show properties
  Array of core.DeclarationDetails
  appliedPolicyControlIdinteger
  cidstring
  createdAtstring<date-time>
  fileAttachmentscore.FileAttachment[]
  Show properties
  Array of core.FileAttachment
  assessmentDeclarationIdinteger
  AssessmentDeclarationID is set instead when the file belongs to an agent assessment's declaration
  cidstring
  contentTypestring
  declarationIdinteger
  descriptionstring
  fileNamestring
  idinteger
  isPublicboolean
  retentionExpiresstring<date-time>
  reviewIdinteger
  sizeBytesinteger
  storagePathstring
  uploadedAtstring<date-time>
  uploadedBystring
  uploadedByDidstringread-only
  Verifiable actor; uploadedBy is the label
  idinteger
  isAutomatedboolean
  isReadyForReviewboolean
  statementstring
  subjectLinestring
  submittedAtstring<date-time>
  submittedBystring
  submittedByDidstringread-only
  Verifiable actor; submittedBy is the label
  updatedAtstring<date-time>
- descriptionstring
- indicatorscore.IndicatorApplication[]
  Show properties
  Array of core.IndicatorApplication
  applicationUuidstring
  urn:uuid form
  appliedPolicyControlIdinteger
  createdAtstring<date-time>
  criteriaobject
  Custom indicators only
  declarationProfilecore.DeclarationProfile
  Show core.DeclarationProfile
  emitOnobjectrequired
  When to emit a declaration
  Show properties
  object — When to emit a declaration
  statementTemplatestring
  titleTemplatestring
  extractionRulesobject
  Custom indicators only
  idinteger
  indicatorIdstring
  urn:uuid form
  lastEvaluatedAtstring<date-time>
  parametersobject
  statuscore.ApplicationStatus
  One ofactivedisabledarchived
  triggerTypecore.TriggerType
  One ofevent
  updatedAtstring<date-time>
- reviewscore.ReviewDetails[]
  Show properties
  Array of core.ReviewDetails
  appliedPolicyControlIdinteger
  cidstring
  commentTypestring
  createdAtstring<date-time>
  fileAttachmentscore.FileAttachment[]
  Show properties
  Array of core.FileAttachment
  assessmentDeclarationIdinteger
  AssessmentDeclarationID is set instead when the file belongs to an agent assessment's declaration
  cidstring
  contentTypestring
  declarationIdinteger
  descriptionstring
  fileNamestring
  idinteger
  isPublicboolean
  retentionExpiresstring<date-time>
  reviewIdinteger
  sizeBytesinteger
  storagePathstring
  uploadedAtstring<date-time>
  uploadedBystring
  uploadedByDidstringread-only
  Verifiable actor; uploadedBy is the label
  idinteger
  outcomestring
  statementstring
  subjectLinestring
  submittedAtstring<date-time>
  submittedBystring
  submittedByDidstringread-only
  Verifiable actor; submittedBy is the label
  updatedAtstring<date-time>
- statusstring
- titlestring
credentialcore.AppliedPolicyCredential
A verifiable credential issued over an applied policy, revocable but never deleted
Show core.AppliedPolicyCredential
- appliedPolicyIdintegerread-only
  Taken from the path on create
- credentialobjectread-only
- credentialIdstringread-only
  urn:uuid minted per issuance; identifies the row
- expiresAtstring<date-time>
- idintegerread-only
- issuedAtstring<date-time>read-only
- issuedBystringread-only
- issuedByDidstringread-only
  Verifiable actor; issuedBy is the label
- revokedbooleanread-only
  Set via the revoke endpoint
- revokedAtstring<date-time>read-only
  Set via the revoke endpoint
- revokedBystringread-only
  Set via the revoke endpoint
- revokedByDidstringread-only
  Verifiable actor; revokedBy is the label
- revokedReasonstringread-only
  Set via the revoke endpoint
- sourceCidstringread-only
  Assigned by the Integrity Service

Examplejson

[
  {
    "appliedPolicy": {
      "name": "string"
    },
    "controls": [
      {
        "activeIndicatorCount": 0,
        "appliedPolicyControlId": 0,
        "cid": "string",
        "citations": [
          {
            "title": "string",
            "url": "string"
          }
        ],
        "controlCode": "string",
        "controlId": 0,
        "declarations": [
          {
            "appliedPolicyControlId": 0,
            "cid": "string",
            "createdAt": "2025-01-01T00:00:00Z",
            "fileAttachments": [
              {
                "assessmentDeclarationId": 0,
                "cid": "string",
                "contentType": "string",
                "declarationId": 0,
                "description": "string",
                "fileName": "string",
                "id": 0,
                "isPublic": true,
                "retentionExpires": "2025-01-01T00:00:00Z",
                "reviewId": 0,
                "sizeBytes": 0,
                "storagePath": "string",
                "uploadedAt": "2025-01-01T00:00:00Z",
                "uploadedBy": "string"
              }
            ],
            "id": 0,
            "isAutomated": true,
            "isReadyForReview": true,
            "statement": "string",
            "subjectLine": "string",
            "submittedAt": "2025-01-01T00:00:00Z",
            "submittedBy": "string",
            "updatedAt": "2025-01-01T00:00:00Z"
          }
        ],
        "description": "string",
        "indicators": [
          {
            "applicationUuid": "string",
            "appliedPolicyControlId": 0,
            "createdAt": "2025-01-01T00:00:00Z",
            "criteria": {},
            "declarationProfile": {
              "emitOn": {},
              "statementTemplate": "string",
              "titleTemplate": "string"
            },
            "extractionRules": {},
            "id": 0,
            "indicatorId": "string",
            "lastEvaluatedAt": "2025-01-01T00:00:00Z",
            "parameters": {},
            "status": "active",
            "triggerType": "event",
            "updatedAt": "2025-01-01T00:00:00Z"
          }
        ],
        "reviews": [
          {
            "appliedPolicyControlId": 0,
            "cid": "string",
            "commentType": "string",
            "createdAt": "2025-01-01T00:00:00Z",
            "fileAttachments": [
              {
                "assessmentDeclarationId": 0,
                "cid": "string",
                "contentType": "string",
                "declarationId": 0,
                "description": "string",
                "fileName": "string",
                "id": 0,
                "isPublic": true,
                "retentionExpires": "2025-01-01T00:00:00Z",
                "reviewId": 0,
                "sizeBytes": 0,
                "storagePath": "string",
                "uploadedAt": "2025-01-01T00:00:00Z",
                "uploadedBy": "string"
              }
            ],
            "id": 0,
            "outcome": "string",
            "statement": "string",
            "subjectLine": "string",
            "submittedAt": "2025-01-01T00:00:00Z",
            "submittedBy": "string",
            "updatedAt": "2025-01-01T00:00:00Z"
          }
        ],
        "status": "string",
        "title": "string"
      }
    ],
    "credential": {
      "expiresAt": "2025-01-01T00:00:00Z"
    }
  }
]

400Bad request - Invalid project ID

application/json

errorstring

Examplejson

{
  "error": "Invalid request body"
}

401Unauthorized - Authentication required

application/json

errorstring

Examplejson

{
  "error": "Invalid request body"
}

403Forbidden - No project access

application/json

errorstring

Examplejson

{
  "error": "Invalid request body"
}

404Project not found

application/json

errorstring

Examplejson

{
  "error": "Invalid request body"
}

500Internal server error

application/json

errorstring

Examplejson

{
  "error": "Invalid request body"
}