Skip to main content

Runtime API

GET/v1/bundles/latest

Fetch the active bundle for the runtime token's scope

Runtime-facing endpoint: returns the active bundle scoped by the runtime token's project and environment. Supports ETag/If-None-Match for efficient polling.

Bearer token or X-API-Keyscope: org memberoperation_id: runtime.getLatestBundle

Authentication

Send either Authorization: Bearer <token> or X-API-Key: <token>. Runtime token — create via POST /v1/orgs/{org_id}/tokens/runtime. Scoped to one project and environment. Requests without a valid credential are rejected with 401.

SDK install

pip install znyx-sdknpm install @znyx/sdk

Code samples

Request

curl -X GET "$ZNYX_API_URL/v1/bundles/latest" \
  -H "Authorization: Bearer $ZNYX_TOKEN"

Response

application/json

Successful Response

null

Schema: any

Header parameters

NameTypeRequiredDescription
X-API-Key#headerstring | nulloptional-
authorization#headerstring | nulloptional-

Responses

StatusDescription
200Successful Response
422Validation Error

Response schema

any

Errors & what triggers them

CodeTriggerFix
304If-None-Match matches the active bundle hash - no changes.-
401Missing or invalid runtime token.-
404No active bundle for the token's scope.Publish one first: POST /v1/orgs/{org_id}/projects/{p}/envs/{env}/bundles/publish.

Notes & examples

Why you probably want this

For latency-sensitive workloads, don't hit /v1/evaluate/* on every call — fetch the bundle once, cache it in-process, and run evaluation locally. The bundle contains the resolved policy and signature.

ETag polling

Send If-None-Match: <previous_policy_hash> on subsequent calls:

GET /v1/bundles/latest
If-None-Match: sha256:abc123...
  • If the bundle hasn't changed, the server returns 304 Not Modified with no body — cheap.
  • If it has, the server returns the new bundle and a new ETag.

Run this poll every 30-60 seconds. The bundle itself is signed, so even a replay attack can't slip in a tampered policy.

Scope resolution

The returned bundle is scoped to the runtime token's project + environment. You cannot fetch a bundle for a different env without a different token.

Typical cache stack

1. In-process LRU keyed by policy_hash. 2. Shared Redis if your fleet is large (reduces CP load). 3. Periodic refresh thread — not synchronous on each eval.

Related

  • POST /v1/orgs/{org_id}/projects/{p}/envs/{env}/bundles/publish — creates a new version.
  • POST /v1/orgs/{org_id}/projects/{p}/envs/{env}/bundles/{v}/activate — flips the active pointer.