Policies Endpoint

List All Policies

List all of an organization's policies.

Parameters

Sorting

• name—Sort the records by policy name alphabetically in ascending or descending order.
  Examples: /api/v2/policies?order=-name (lists records descending.)
  /api/v2/policies?order=name (lists records ascending.)
• created_at—Sort the results by ascending or descending order from the date the policy was created.
  Example: /api/v2/policies?order=created_at (lists results ascending from the date each policy was created).
• updated_at—Sort the results by ascending or descending order from the date the policy was updated.

Filtering

• created_before—limit results to policies created before a specified date.
  Example: /api/v2/policies?where={"created_before": "2020-09-15"} (lists records
  with policies whose creation date is before "2020-09-15".)
• created_after—limit results to policies created after a specified date.
• updated_before—limit results to policies updated before a specified date.
• updated_after—limit results to policies updated after a specified date.
• state—limit results to policies with a specific state (active or inactive).
  Example: /api/v2/policies?where={"state": "ACTIVE"} (lists records with policies
  whose state is "ACTIVE".)
• name—limit results to policies with a specific name.

Limiting

• limit—limit results to a specific number. The maximum number of results is 100,000.
  Example: GET /api/v2/policies?limit=100
• offset—Limit the number of policies that must be skipped. For example, if offset=0, all policies will be returned from the beginning. If offset=10000, all policies starting from the 10001st will be returned.

default page size = 50
max_record per page = 100

Make the Request

GET /api/v2/policies

{
	"results": 2,
	"items": [{
			"id": "bO4QNWaxLp",
			"name": "custom regex testing",
			"description": null,
			"state": "INACTIVE",
			"policy_type": "Custom Regex",
			"actions_attached": false,
			"created_at": "2019-01-04T09:51:16.308938+00:00",
			"updated_at": "2020-05-15T14:21:56.875521+00:00",
			"severity": "ALERT",
			"extra": {}
		},
		{
			"id": "RBzXZNY42Y",
			"name": "cvt-738",
			"description": null,
			"state": "INACTIVE",
			"policy_type": "Context Only",
			"actions_attached": false,
			"created_at": "2018-02-19T13:19:24.077503+00:00",
			"updated_at": "2020-05-15T14:21:56.875521+00:00",
			"severity": "WARNING",
			"extra": {}
		}
	],
	"count_capped": true
}

Fields Returned

The following fields are returned in the API JSON.

List Policies with Full Content

List policies with configuration content for each policy.

Parameters

Sorting

• name—Sort the records by policy name alphabetically in ascending or descending order.
  Examples: /api/v2/detailed_policies?order=-name (lists records descending.)
  /api/v2/detailed_policies?order=name (lists records ascending.)
• created_at—Sort the results by ascending or descending order from the date the policy was created.
  Example: /api/v2/detailed_policies?order=created_at (lists results ascending from the date each policy was created).
• updated_at—Sort the results by ascending or descending order from the date the policy was updated.

Filtering

• created_before—limit results to policies created before a specified date.
  Example: /api/v2/detailed_policies?where={"created_before": "2020-09-15"} (lists records
  with policies whose creation date is before "2020-09-15".)
• created_after—limit results to policies created after a specified date.
• updated_before—limit results to policies updated before a specified date.
• updated_after—limit results to policies updated after a specified date.
• state—limit results to policies with a specific state (active or inactive).
  Example: /api/v2/detailed_policies?where={"state": "ACTIVE"} (lists records with policies whose state is "ACTIVE".)
• name—limit results to policies with a specific name.

Limiting

• limit—limit results to a specific number. The maximum number of results is 100,000.
  Example: GET /api/v2/detailed_policies?limit=100
• offset—Limit the number of policies that must be skipped. For example, if offset=0, all policies will be returned from the beginning. If offset=10000, all policies starting from the 10001st will be returned.

default page size = 50
max_record per page = 100

Make the Request

/api/v2/detailed_policies

{
    "results": 1,
    "items": [
        {
            "id": "ORxAwMe3aY",
            "name": "ykryvun-test",
            "description": null,
            "state": "INACTIVE",
            "policy_type": "Custom Regex",
            "created_at": "2017-12-22T10:35:02.178230+00:00",
            "updated_at": "2020-05-15T14:21:56.875521+00:00",
            "severity": "ALERT",
            "criteria": [
                {
                    "logic": "and",
                    "group": [
                        {
                            "conditions": {
                                "strictness": "medium",
                                "filename_only": false,
                                "proximity": "",
                                "exceptions": [],
                                "threshold": 1,
                                "expression": "DerekTest",
                                "scanner_type": "REGEX"
                            }
                        }
                    ]
                },
                {
                    "logic": "or",
                    "group": [
                        {
                            "conditions": {
                                "vendor_type": "document",
                                "vendor": "office365"
                            }
                        }
                    ]
                }
            ]
        }
    ],
    "count_capped": false
}

List Policies with Full Content Based on a Policy Identifier

Make the Request

/api/v2/policies/<policy_id>

{
    "id": "ORxAwMe3aY",
    "name": "ykryvun-test",
    "description": null,
    "state": "INACTIVE",
    "policy_type": "Custom Regex",
    "created_at": "2017-12-22T10:35:02.178230+00:00",
    "updated_at": "2020-05-15T14:21:56.875521+00:00",
    "severity": "ALERT",
    "criteria": [
        {
            "logic": "and",
            "group": [
                {
                    "conditions": {
                        "strictness": "medium",
                        "filename_only": false,
                        "proximity": "",
                        "exceptions": [],
                        "threshold": 1,
                        "expression": "DerekTest",
                        "scanner_type": "REGEX"
                    }
                }
            ]
        },
        {
            "logic": "or",
            "group": [
                {
                    "conditions": {
                        "vendor_type": "document",
                        "vendor": "office365"
                    }
                }
            ]
        }
    ]
}

Criteria Fields Returned for Policy Content