> ## Documentation Index > Fetch the complete documentation index at: https://onecli.sh/docs/llms.txt > Use this file to discover all available pages before exploring further. # Get the Default Rule (project) > The scope's terminal Default Rule. A virtual default is returned when none is persisted yet; it reflects the baseline posture, not necessarily an enforced snapshot. ## OpenAPI ````yaml /openapi.yaml get /policy/default openapi: 3.1.0 info: title: OneCLI API version: '1.0' description: > The OneCLI API lets you manage agents, secrets, policy rules, app connections, and user settings programmatically. **Base URL:** `https://api.onecli.sh/v1` (Cloud) or `http://localhost:10254/v1` (self-hosted) ## Authentication All endpoints require authentication via one of: - **API Key** — `Authorization: Bearer ` header. Generate keys in the dashboard or via `GET /v1/user/api-key`. - **Session** — Cookie-based session from the web dashboard. For organization-scoped API keys, include the `X-Project-Id` header to specify which project to operate on. servers: - url: https://api.onecli.sh/v1 description: OneCLI Cloud - url: http://localhost:10254/v1 description: Self-hosted (Docker) security: - bearerAuth: [] tags: - name: Agents description: Manage agents and their access tokens, secrets, and configuration. - name: Secrets description: Manage credentials that the gateway injects into outbound requests. - name: Policy description: >- Author project policy-engine rules that control how agents interact with external services (staged draft → publish). - name: Approvals description: >- Long-poll for pending manual-approval requests and submit approve/deny decisions. - name: User description: Manage your user profile and API keys. - name: Projects description: >- Manage projects within your organization. Requires admin role for create/update and owner role for delete. Cloud only. - name: Team description: Provision team members programmatically. Requires admin role. Cloud only. - name: Apps description: >- Manage app connections (OAuth and direct credentials), BYOC configuration, permission catalogs, and blocklists. - name: Connections description: App connections as a top-level resource. - name: Utility description: Health check and project resource summaries. - name: Agent Setup description: >- Endpoints agents and orchestrators use to bootstrap gateway access (container config, credential stubs, gateway skill). - name: Migration description: Migrate data from a self-hosted instance to OneCLI Cloud. - name: Organization Settings description: >- Organization-wide policy settings. Available on OneCLI Cloud and self-hosted Enterprise. - name: Organization Secrets description: >- Manage secrets at the organization level. Organization secrets apply across all projects. Available on OneCLI Cloud and self-hosted Enterprise. - name: Organization Policy description: >- Author policy-engine rules at the organization level. Organization rules apply across all projects. Available on OneCLI Cloud and self-hosted Enterprise. - name: Organization Connections description: >- Manage app connections at the organization level. Available on OneCLI Cloud and self-hosted Enterprise. - name: Organization App Config description: >- Connect apps (OAuth and direct credentials) and manage BYOC app configuration at the organization level. Available on OneCLI Cloud and self-hosted Enterprise. - name: Organization Approvals description: >- Long-poll for manual-approval requests across every project in the organization. Available on OneCLI Cloud and self-hosted Enterprise. - name: Partner Organizations description: >- Create and manage customer organizations as a partner. Requires a Partner API key. Cloud only. - name: Partner Projects description: Manage projects within an unclaimed partner organization. Cloud only. - name: Partner Secrets description: >- Manage partner-level secrets inherited by every organization you manage. Cloud only. - name: Partner Budgets description: >- Cap how much an organization can spend on a partner LLM key. Owner or admin only. Cloud only. - name: Partner Members description: >- Manage who can sign in to your partner portal. Owner or admin only. Cloud only. - name: Organization Partner description: Inspect and detach an organization's partner relationship. Cloud only. paths: /policy/default: get: tags: - Policy summary: Get the Default Rule (project) description: > The scope's terminal Default Rule. A virtual default is returned when none is persisted yet; it reflects the baseline posture, not necessarily an enforced snapshot. operationId: getPolicyDefault parameters: - name: status in: query schema: type: string enum: - draft - published default: draft responses: '200': description: The Default Rule content: application/json: schema: $ref: '#/components/schemas/PolicyRule' components: schemas: PolicyRule: type: object description: >- A policy-engine rule (the staged draft → publish model). Writes land in the draft; only a publish makes them enforced. Published row `id`s regenerate on every publish; `logicalId` is the identity stable across statuses and generations. properties: id: type: string scope: type: string enum: - project - organization status: type: string enum: - draft - published generation: type: integer description: >- 0 for the draft working copy; the snapshot number for published rows. priority: type: integer description: First-match order (lower evaluates first). enabled: type: boolean isDefault: type: boolean description: True on the scope's terminal Default Rule. logicalId: type: string description: >- Generation-stable identity; compare rules across draft/published by this, never by `id`. source: type: string description: >- `custom` (user-owned, editable), `default` (the Default Rule), or system-managed `blocklist`/`equipment` rows. Self-hosted deployments that have not cut over to the policy engine may also expose read-only `app_permission` rows derived from the legacy model. name: type: string description: type: string nullable: true action: type: string enum: - allow - block rateLimit: type: integer nullable: true rateLimitWindow: type: string nullable: true enum: - minute - hour - day - null requireApproval: type: boolean conditions: description: >- A conditions array, a session-policy object (`{repositories}` / `{folders}`), or null. nullable: true identities: type: array items: $ref: '#/components/schemas/PolicyRuleIdentity' targets: type: array items: $ref: '#/components/schemas/PolicyRuleTarget' createdAt: type: string format: date-time PolicyRuleIdentity: type: object description: >- A principal the rule applies to. Project rules take `agent` identities only; organization rules take `agentGroup`/`user`/`group`. An empty identity list means the rule applies to everyone. required: - type - id properties: type: type: string enum: - agent - agentGroup - user - group id: type: string PolicyRuleTarget: type: object description: >- One destination the rule matches, a discriminated union on `kind`: an `app` target (provider, optionally narrowed by `tools`), a `connection` target (`connectionId`, optional `tools`), a `secret` target (a specific `secretId` XOR a `secretScope` level), or a `network` target (host/path/method patterns). A rule needs at least one target. required: - kind properties: kind: type: string enum: - app - connection - secret - network provider: type: string description: '`app` targets: the provider id (e.g. `gmail`).' tools: type: array items: type: string description: >- `app`/`connection` targets: narrow matching to these catalog tool ids; empty = the whole app. connectionScope: type: string enum: - organization - project description: >- `app` targets: present = inject all the agent's connections of the provider at that level; absent = a block/allow layer with no injection. connectionId: type: string description: '`connection` targets: the connection id.' secretId: type: string description: >- `secret` targets: a specific secret (mutually exclusive with `secretScope`). secretScope: type: string enum: - organization - project description: '`secret` targets: all the agent''s secrets at that level.' hostPattern: type: string description: '`network` targets.' pathPattern: type: string nullable: true method: type: string nullable: true enum: - GET - POST - PUT - PATCH - DELETE - null securitySchemes: bearerAuth: type: http scheme: bearer description: API key obtained from the dashboard or `GET /user/api-key` ````