Get the Default Rule (organization)
The scope’s terminal Default Rule. A virtual default is returned when none is persisted yet; it reflects the baseline posture, not necessarily an enforced snapshot.
Authorizations
API key obtained from the dashboard or GET /user/api-key
Query Parameters
draft, published Response
The Default Rule
A policy-engine rule (the staged draft → publish model). Writes land in the draft; only a publish makes them enforced. Published row ids regenerate on every publish; logicalId is the identity stable across statuses and generations.
project, organization draft, published 0 for the draft working copy; the snapshot number for published rows.
First-match order (lower evaluates first).
True on the scope's terminal Default Rule.
Generation-stable identity; compare rules across draft/published by this, never by id.
custom (user-owned, editable), default (the Default Rule), or system-managed blocklist/equipment rows. Self-hosted deployments that have not cut over to the policy engine may also expose read-only app_permission rows derived from the legacy model.
allow, block minute, hour, day, null A conditions array, a session-policy object ({repositories} / {folders}), or null.