---
title: "Submit a versioned policy bundle artifact for Decionis encoding"
method: POST
path: "/v1/protocol/policies/bundles"
---

# Submit a versioned policy bundle artifact for Decionis encoding

`POST /v1/protocol/policies/bundles`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/protocol/policies/bundles`
- Auth: HTTP bearer

Use this endpoint only when an integration participates in policy
authoring. The SDK submits a reviewed policy bundle artifact to
Decionis; it does not evaluate or enforce policy rules locally.

## Headers

- `X-Correlation-ID` string
- `Idempotency-Key` string

## Request body

- PolicyBundle
  - `protocol_version` string, required
  - `bundle_id` string, uuid, required
  - `org_id` string, required
  - `version` string, required
  - `effective_from` string, date-time, required
  - `effective_to` string, date-time
  - `rules` PolicyRule[], required
    - `rule_id` string, required
    - `name` string, required
    - `decision_domain` string, required
    - `when` object, required
    - `then` object, required
      - `action` 'REQUIRE_REVIEW' | 'AUTO_APPROVE' | 'AUTO_REJECT' | 'ESCALATE' | 'REQUEST_INFO', required
      - `severity` 'routine' | 'elevated' | 'urgent'
      - `assignee_role` string
      - `sla_minutes` integer
      - `authority` object
        - `reason_codes` string[], required
        - `selector` union, required
          - object
            - `kind` 'ROLE', required
            - `role_id` string, required
            - `principal_id` string: Optional exact-human narrowing for managed role selection. The selected principal must still hold the trusted human role.
          - object
            - `kind` 'PRINCIPAL', required
            - `principal_id` string, required
            - `role_id` string: Trusted effective human approval role. Optional for DIRECT requirements and required when orchestration.mode is MANAGED.
        - `verification_requirements` AuthorityVerificationRequirements, required
          - `level` 'STANDARD' | 'HIGH_CONFIDENCE', required
          - `methods` string[], required: WEBAUTHN, MOBILE_DEVICE and ACTIVE_LIVENESS are ceremonies Decionis Presence runs. CARD_TAP is the cardholder tapping the physical card on their own phone inside the issuer's app, proved by a third-party presence provider named in `provider`; a requirement never mixes the two kinds.
          - `hardware_pki_required` boolean, required
          - `disallow_virtual_cameras` boolean, required
          - `mobile_device_policy` 'WEB_OR_JIT_DEVICE' | 'MANAGED_DEVICE_REQUIRED'
          - `trusted_ip_regions` string[]
          - `provider` string: Who proves the person. Absent, or `decionis`, Decionis Presence runs the ceremony. Any other id names a presence provider from the directory (GET /v1/presence-providers) that the organisation admitted; its signed presence attestation (`evidence.humanApproval` of provider `attestation`, `presence.method` `card_tap`) is the proof. `presence` is reserved and refused.
        - `resolution` AuthorityResolutionPolicy, required
          - `quorum` 1, required
          - `delegation` 'DISALLOWED' | 'REQUIREMENT_REFRESH', required
          - `fallback_role_ids` string[], required
        - `expires_in_seconds` integer, required
    - `priority` integer, required
    - `enabled` boolean, required
    - `rationale` string
  - `metadata` object
    - `author` string
    - `source` string
    - `change_ticket` string
    - `signal_admission` SemanticSignalAdmissionPolicy: Deterministic trust gate for typed semantic evidence.
      - `allowed_producers` string[]
      - `allowed_detector_versions` string[]
      - `require_evidence_digest` boolean
      - `minimum_confidence_basis_points` integer
      - `required_signal_paths` string[]
      - `on_failure` 'ESCALATE' | 'AUTO_REJECT'
  - `signature` object
    - `algo` string
    - `digest` string
    - `signed_at` string, date-time
    - `signed_by` string
  - `commerce_preflight` object
    - `version` 'commerce-preflight-v2', required
    - `max_fact_age_seconds` integer, required
    - `allowed_sources` string[], required
    - `checks` object, required
      - `P01` union
        - object
          - `enabled` false, required
        - object
          - `enabled` true, required
          - `floor_percent` number, required
      - `P02` union
        - object
          - `enabled` false, required
        - object
          - `enabled` true, required
          - `tolerance_percent` number, required
      - `P03` union
        - object
          - `enabled` false, required
        - object
          - `enabled` true, required
          - `minimum_available` integer, required
      - `P04` union
        - object
          - `enabled` false, required
        - object
          - `enabled` true, required
          - `mode` 'allow' | 'block', required
          - `countries` string[], required
      - `P05` union
        - object
          - `enabled` false, required
        - object
          - `enabled` true, required
          - `max_concurrent_discounts` integer, required
      - `P06` union
        - object
          - `enabled` false, required
        - object
          - `enabled` true, required
          - `tolerance_percent` number, required
      - `P07` union
        - object
          - `enabled` false, required
        - object
          - `enabled` true, required
          - `max_redemptions` integer, required
          - `new_account_age_days` number, required
      - `P08` union
        - object
          - `enabled` false, required
        - object
          - `enabled` true, required
      - `P09` union
        - object
          - `enabled` false, required
        - object
          - `enabled` true, required
          - `amount` number, required
          - `currency` string, required
      - `P10` union
        - object
          - `enabled` false, required
        - object
          - `enabled` true, required
          - `max_prior_refunds` integer, required
      - `P11` union
        - object
          - `enabled` false, required
        - object
          - `enabled` true, required
          - `return_window_days` integer, required
      - `P12` union
        - object
          - `enabled` false, required
        - object
          - `enabled` true, required
          - `unattended_limit` object, required
            - `amount` number, required
            - `currency` string, required
      - `P13` union
        - object
          - `enabled` false, required
        - object
          - `enabled` true, required
      - `P14` union
        - object
          - `enabled` false, required
        - object
          - `enabled` true, required
          - `window_days` integer, required
      - `P15` union
        - object
          - `enabled` false, required
        - object
          - `enabled` true, required
          - `floor` object, required
            - `amount` number, required
            - `currency` string, required
      - `P16` union
        - object
          - `enabled` false, required
        - object
          - `enabled` true, required
          - `minimum_annualized_yield_percent` number, required
  - `commerce_history` object
    - `version` 'commerce-marketplace-history-policy-v1', required
    - `price_reference` object, required
      - `kind` 'recorded_order_original_price', required
      - `max_markdown_percent` number, required

## Response `202`

Policy bundle accepted for encoding

- ArtifactAcceptedResponse
  - `accepted` boolean, required
  - `service` string, required
  - `protocol_version` string, required
  - `artifact` 'policy_bundle' | 'signal_envelope', required
  - `artifact_id` string, required
  - `org_id` string, required
  - `received_at` string, date-time, required

## Other responses

- `400`: Structured API error
- `401`: Structured API error

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)