Authentication and Shared Request Contracts
Authenticate callers and distinguish command authority, policy grants, draft validators, and ownership preconditions.
Use the Policy application programming interface (API) to author and govern policies. Track delivery separately from approval and target protection. Approval establishes a governed revision: the approved version of policy intent. A draft snapshot records saved proposal content, not another approved revision. Compilation produces target output. Publication and target activation happen separately. Begin with authentication and shared contracts.
Choose the API reference that matches your task:
Choose the reference for the operation you need:
The API base normally uses /pty/policy/v1.0, independently of the application version.
Your deployed /swagger page and /doc document expose its schema.
Use the endpoint-specific runtime rules here when conditional-header descriptions differ.
An entity tag (ETag) is a server-issued resource validator.
Draft commands use Draft-ETag. Archive uses the policy ETag.
Copy the required token unchanged into If-Match to pin the command to inspected state.
Do not substitute the governed policy validator for a current draft token.
Authenticate callers and distinguish command authority, policy grants, draft validators, and ownership preconditions.
Find canonical operation families and retain links to earlier endpoint references.
Follow a separate-user API handoff using current draft validators and independent delivery evidence.
Interpret Policy API failures without confusing stale drafts, unavailable evidence, and retryable delivery work.
Reference the request, response, and failure contracts for this operation family.
Reference the request, response, and failure contracts for this operation family.
Reference policy reads, server-validated draft creation, saved snapshots, rollback, and cancellation.
Reference lifecycle decisions, exact draft preconditions, authenticated actors, and asynchronous delivery boundaries.
Reference policy grants, legacy versions, bounded lifecycle history, and restricted audit exports.
Reference consumer output retrieval and distinguish compatibility deployment from governed publication.
Reference the request, response, and failure contracts for this operation family.
Reference nine operations for restricted diagnostics, retained delivery recovery, archive evidence, and native ownership reconciliation.
Was this page helpful?