DSAR

API

Policies API

These endpoints expose the policy catalog plus upgrade and custom-policy workflows.

GET /policies

List policy packs visible to the current request context.

Response (200):

[
	{
		"jurisdiction": "eu",
		"name": "EU GDPR baseline",
		"packId": "gdpr-eu",
		"publishedAt": "2026-01-01T00:00:00.000Z",
		"version": "1.2.0"
	}
]

POST /policies/upgrades/propose

Create a policy-upgrade proposal.

The current OpenAPI contract does not declare a required request body for this endpoint. Treat it as a workflow trigger that creates a new proposal and returns the proposal ID and status.

Response (202):

{
	"proposalId": "proposal-123",
	"status": "pending_approval"
}

POST /policies/upgrades/:proposalId/approve

Approve a pending policy-upgrade proposal.

Response (202):

{
	"proposalId": "proposal-123",
	"status": "approved"
}

POST /policies/upgrades/:proposalId/apply

Apply an approved policy-upgrade proposal.

Response (202):

{
	"proposalId": "proposal-123",
	"status": "applied"
}

POST /policies/custom/register

Register a custom policy pack.

Request body:

  • jurisdiction (string, required)
  • name (string, required)
  • version (string, required)
  • pack (unknown, required): policy pack payload
  • publishedAt (string, optional)
  • metadata (object, required)
  • metadata.changelog (string, required)
  • metadata.compatibilityNotes (string, required)
  • metadata.releaseType (string, required): "major" | "minor" | "patch"

Response (202):

{
	"jurisdiction": "eu",
	"name": "Internal Policy",
	"status": "registered",
	"version": "1.0.0"
}

POST /policies/custom/activate

Activate a registered custom policy pack for a tenant or workspace scope.

Request body:

  • jurisdiction (string, required)
  • tenantId (string, required)
  • version (string, required)
  • workspaceId (string, optional)

Response (202):

{
	"jurisdiction": "eu",
	"status": "activated",
	"tenantId": "tenant-1",
	"version": "1.0.0",
	"workspaceId": "workspace-1"
}

POST /policies/custom/deactivate

Deactivate a scoped custom policy assignment.

Request body:

  • tenantId (string, required)
  • workspaceId (string, optional)

Response (202):

{
	"status": "deactivated",
	"tenantId": "tenant-1",
	"workspaceId": "workspace-1"
}

Related surfaces: