---
title: "Issue the organization's active policy bundle, signed for the edge evaluator"
method: GET
path: "/v1/edge/policy-bundles/current"
---

# Issue the organization's active policy bundle, signed for the edge evaluator

`GET /v1/edge/policy-bundles/current`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/edge/policy-bundles/current`
- Auth: HTTP bearer

Signs the bundle hosted evaluation would run on right now and returns it
as a compact JWS for the Decionis edge evaluator (the WebAssembly policy
core a deployment runs inside its own network). The edge evaluator
evaluates only bundles Decionis signed: it verifies the signature
against the keys its release pins (published at
`/.well-known/decionis-policy-bundle-jwks.json`), the audience against
its organization, the validity window against the time its host
supplies, and the bundle against `bundle_digest`.

Selection is hosted evaluation's own: the newest active bundle whose
effective window contains now and that passes the maker-checker gate,
or, when `policy_version` is given, exactly that version among them. An
unapproved, historical, not-yet-effective or expired bundle is never
signed; like hosted evaluation, it is treated as not active and the
answer is `404 POLICY_BUNDLE_NOT_FOUND` with the policy guard's reason.

The signed bundle lives `ttl_seconds` (default 7 days, at most 30 days
and at most the organization's plan maximum), never past the bundle's
own `effective_to`. Every issuance is recorded before it is returned
(see `GET /v1/edge/policy-bundles/issuances`); one that cannot be
recorded is not issued. Requires an organization API key with
`policy:read` (or `policy:*` / `org:*`); keys without explicit scopes
are refused.

Only organizations licensed for the edge evaluator receive bundles:
Enterprise and self-managed plans include it, Premium with the edge
add-on, and an operator may list an organization for a pilot. Any
other organization is answered `403 EDGE_EVALUATOR_NOT_ENTITLED`
(its signed entitlement, `GET /v1/edge/entitlement`, says why).

The bundle is `core_abi: 3`: it also carries what hosted would decide
differently for this organization, resolved with hosted's own code —
`vertical_pack` (its configured pack, or the operator's pack
override, else null) and `max_mode` / `max_mode_reason` (SHADOW with
hosted's 403 code for an unclaimed provisional or AWS service
workspace, else ENFORCEMENT). An edge module older than ABI 3 refuses
such a bundle rather than decide without them.

## Query parameters

- `decision_domain` string
- `policy_version` string
- `ttl_seconds` integer

## Response `200`

The signed bundle; private and not cacheable

- SignedPolicyBundleResponse
  - `signed_bundle` string, required: Compact JWS. Protected header `{"alg":"EdDSA","typ":"decionis-policy-bundle+jwt","kid":"<kid>"}`; payload `SignedPolicyBundleClaims`.
  - `bundle_id` string, required
  - `policy_version` string, required
  - `kid` string, required
  - `issued_at` string, date-time, required
  - `not_before` string, date-time, required
  - `expires_at` string, date-time, required

## Other responses

- `400`: Structured API error
- `401`: Not authenticated with an organization API key (`ORG_API_KEY_REQUIRED`)
- `403`: Missing `policy:read` (`FORBIDDEN`), or the organization is not licensed for the edge evaluator (`EDGE_EVALUATOR_NOT_ENTITLED`)
- `404`: The organization has no active, approved bundle (of the requested version)
- `409`: `POLICY_BUNDLE_VALIDITY_WINDOW_EMPTY`: the active bundle's effective window ends before a signed bundle could become valid
- `502`: `POLICY_BUNDLE_RESOLUTION_FAILED`: the active bundle could not be resolved
- `503`: `POLICY_BUNDLE_SIGNING_NOT_CONFIGURED`, `POLICY_BUNDLE_ORG_MODE_UNAVAILABLE` (the organization's enforcement mode could not be resolved, so nothing was signed), or `POLICY_BUNDLE_ISSUANCE_UNAVAILABLE` (the issuance could not be recorded, so nothing was issued)

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)