Get Policy

Get policy for a scope. **Query Parameters**: - `version`: Specific version number (default: active version) - `resolved`: If true, return fully resolved policy with defaults merged **Returns**: - If `resolved=true`: Merged policy (default + tenant overrides) - If `resolved=false`: Raw policy for this scope only

Bearer token or X-API-Keyscope: org memberoperation_id: policies.get

Authentication

Send either Authorization: Bearer <token> or X-API-Key: <token>. Any org token with sufficient scope. Create tokens from the console or the /v1/orgs/{org_id}/tokens endpoints. Requests without a valid credential are rejected with 401.

SDK install

pip install znyx-sdknpm install @znyx/sdk

Code samples

Request

curl -X GET "$ZNYX_API_URL/v1/policies/00000000-0000-0000-0000-000000000000/00000000-0000-0000-0000-000000000000/00000000-0000-0000-0000-000000000000/prod?resolved=false" \
  -H "Authorization: Bearer $ZNYX_TOKEN"

Response

application/json

Successful Response

null

Schema: any

Path parameters

Name	Type	Required	Description
tenant_id#path	string	required	-
app_id#path	string	required	-
agent_id#path	string	required	-
env#path	string	required	-

Query parameters

Name	Type	Required	Description
version#query	integer \| null	optional	-
resolved#query	boolean	optional	-

Responses

Status	Description
200	Successful Response
422	Validation Error

Response schema

any

Errors & what triggers them

Code	Trigger	Fix
401	Missing or expired Authorization header.	-
403	Token does not have org access (wrong org_id, or insufficient role).	-
404	Resource does not exist in this org.	-

Notes & examples

`resolved=true` vs default

Without ?resolved=true, you get the raw policy stored for that exact scope — meaning overrides, not the merged result. If a detector isn't mentioned, it's absent from the response.

With ?resolved=true, the server walks up the scope hierarchy (env → agent → app → tenant → global default) and merges each layer in. The response is what the runtime actually enforces.

Use resolved=true when you're debugging "why didn't my policy fire?" and use the raw version when you're editing.

Versioning

The response includes version_number. Every PUT creates a new version; only the most recent is active unless you rolled back. Pass ?version=N to read a historical version.

PUT /v1/policies/{tenant}/{app}/{agent}/{env} — upsert a new full policy.
PATCH .../detector/{name} — change just one detector without touching the rest.
GET .../history — list every version.
POST .../rollback/{version} — promote an older version to active.