Skip to main content
GET
Get a draft policy rule (organization)

Authorizations

Authorization
string
header
required

API key obtained from the dashboard or GET /user/api-key

Path Parameters

ruleId
string
required

Response

The draft rule

A policy-engine rule (the staged draft → publish model). Writes land in the draft; only a publish makes them enforced. Published row ids regenerate on every publish; logicalId is the identity stable across statuses and generations.

id
string
scope
enum<string>
Available options:
project,
organization
status
enum<string>
Available options:
draft,
published
generation
integer

0 for the draft working copy; the snapshot number for published rows.

priority
integer

First-match order (lower evaluates first).

enabled
boolean
isDefault
boolean

True on the scope's terminal Default Rule.

logicalId
string

Generation-stable identity; compare rules across draft/published by this, never by id.

source
string

custom (user-owned, editable), default (the Default Rule), or system-managed blocklist/equipment rows. Self-hosted deployments that have not cut over to the policy engine may also expose read-only app_permission rows derived from the legacy model.

name
string
description
string | null
action
enum<string>
Available options:
allow,
block
rateLimit
integer | null
rateLimitWindow
enum<string> | null
Available options:
minute,
hour,
day,
null
requireApproval
boolean
conditions
any | null

A conditions array, a session-policy object ({repositories} / {folders}), or null.

identities
object[]
targets
object[]
createdAt
string<date-time>