Skip to content

AI Defense Policy GraphQL API

Manage AI Defense policies and get the sanctioning status they give AI applications over GraphQL.

See the guide for a narrative walkthrough of this API.

This is a GraphQL API: every request is a POST carrying a query (or mutation) document, rather than one endpoint per operation. See the guide above for the request shape and authentication.

Queries

  • appSanctioning
    Batch sanctioning status for a list of AI applications. Returns scope-agnostic status (APPROVED/BLOCKED/WARNED/NOT_COVERED) derived from the tenant's policies. Apps not covered by any policy rule are NOT_COVERED.
  • policies
    List policies with optional filtering and cursor-based pagination.
  • policy
    Fetch a single policy by ID. Returns null if not found.
  • previewPolicyImpact
    Evaluate a hypothetical ordered ruleset against the catalog and report per-action totals. Rules are walked top-to-bottom; the first matching rule wins per app. V1 evaluates against the full catalog (tenant-agnostic) — the response shape is stable so a future revision can scope to apps observed in the tenant's activity window without breaking callers.
  • previewRuleTarget
    Preview which applications match target conditions with a given action. For policy authoring — works with unsaved rules. Single-rule variant: warnings do not consider any other rules. For a cross-rule aware preview, use previewRuleTargets. Single rule in isolation: advisories are not narrowed for rules above it and effectiveCount is null. Use previewRuleTargets for sequence-aware advisories.
  • previewRuleTargets
    Preview an ordered rule sequence as a unit, with each rule's advisories narrowed to the applications it will actually act on. Rules are walked top-to-bottom under first-match-wins: an application claimed by an earlier in-effect rule — whatever that rule's action — is excluded from every later rule's effective reach. Returns exactly one preview per input rule, in input order: result[i] describes rules[i]. Only the supplied rules are considered; other policies never affect the result. For policy authoring — works with unsaved rules and in-progress edits. Use previewRuleTarget for a single rule in isolation or for the full matched-app list.
  • secureAIPolicyActivityMetrics
    Which enabled policies had activity in the time frame. Defaults to SINCE_BEGINNING_OF_WEEK_SUNDAY when timeFrame is omitted or empty.
  • starterTemplate
    Fetch a single starter template by key. Returns null if the key is unknown.
  • starterTemplates
    List all persona-based starter templates. Tenant-agnostic — the registry ships with every deployment.
  • supportedEnforcementMechanisms
    Compiled enforcement mechanisms supported by this API.

Mutations

  • clonePolicy
    Clone an existing policy. Creates a deep copy of rules, the base rule, sensors, scope, and tags under a new policy with a fresh ID. The clone is created DISABLED so the admin can review and edit before enforcing. The clone's name is the source name suffixed with " - cloned", with a numeric counter on collision (e.g. " - cloned (2)"). Partner-managed policies cannot be cloned.
  • createPolicy
    Create a policy. TENANT_BASE is pinned last and creation is idempotent; ordinary tenant policies are inserted at the top.
  • deletePolicy
    Soft-delete a policy. Triggers tear-down on all sensors.
  • disablePolicy
    Set policy state to DISABLED and trigger tear-down on all sensors.
  • enablePolicy
    Set policy state to ENABLED and trigger distribution to all configured sensors.
  • movePolicy
    Move a policy relative to an anchor. afterId = null moves to top (highest priority). afterId = some ID places the policy immediately after that anchor in priority order. Uses fractional indexing — only the moved policy's row is updated (O(1) writes).
  • reorderPolicies
    Bulk reorder — provide the complete ordered list of reorderable policy IDs. Exclude PARTNER and TENANT_BASE policies; the base policy is pinned to the bottom. Returns the IDs in their confirmed new order.
  • updatePolicy
    Partial update. Requires version for optimistic concurrency.

Types

Download