--- title: "GetAgentHookPolicyDefinition" method: GET path: "/v1/namespaces/{tenant_meta.namespace}/agent-hook-policy-definitions/{uuid}" tags: ["AgentHookPolicyDefinitionService"] --- # GetAgentHookPolicyDefinition `GET /v1/namespaces/{tenant_meta.namespace}/agent-hook-policy-definitions/{uuid}` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/agent-hook-policy-definitions/{uuid}` - Auth: none declared Fetches an AgentHookPolicyDefinition specified by its UUID. ## Path parameters - `tenant_meta.namespace` string, required - `uuid` string, required ## Query parameters - `get_parameters.mask` string ## Response `200` A successful response. - V1AgentHookPolicyDefinition: AgentHookPolicyDefinition is a top-level CRUD object that stores a single AgentHookPolicy alongside standard metadata. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `propagate` boolean: Object can be propagated to child namespaces. Global objects are visible to all namespaces. - `spec` V1AgentHookPolicyDefinitionSpec - `policy` V1AgentHookPolicy: AgentHookPolicy describes a policy to apply when agent hook events match a given activity. When the activity matches, the action (e.g. feedback, block, alert) is applied. - `action` V1AgentHookAction: Action describes how to match the activity with the policy and what to do when it matches. - `alert` V1AlertAction: AlertAction records an alert with a message (e.g. for audit). - `feedback_message` string: Feedback message shown to the user when the alert is raised. - `message` string - `ask` V1AskAction: AskAction allows asking the user with a message. - `feedback_message` string: Feedback message shown to the user when asking for confirmation. - `message` string - `auto` V1AutoAction: AutoAction hands the decision on a matched command to the LLM judge: the command is judged on its own security intent and effect, and the label that comes back is the decision — benign allows, review asks, suspicious blocks. It carries no message on purpose. The agent sees the model's own reason, naming the concrete thing it saw, and a policy-authored string would either be ignored or contradict it. The evaluator converts a matched AUTO policy into a plain ask or block carrying that reason before the verdict is computed, so the verdict is still read off ordinary action kinds. Valid only on cmd_line activities, with either match type, and never on a POLICY_INTENT_GOVERNANCE policy. On an ALLOWLIST the permitted set acts as a prefilter: a listed command never reaches the judge, and one outside it is judged rather than refused outright. Requires an endorctl new enough to know the field. An older client drops it (maniprest unmarshals with DiscardUnknown), is left with an empty action kind, and allows — so switching a policy to AUTO silently loses enforcement of that policy on clients below the minimum version. - `block` V1BlockAction: BlockAction blocks the activity and shows a message. - `feedback_message` string: Feedback message shown to the user when the action is blocked. - `message` string - `feedback` V1FeedbackAction: FeedbackAction prompts the user with a message without blocking. - `feedback_message` string - `message` string - `match_type` 'MATCH_TYPE_UNSPECIFIED' | 'MATCH_TYPE_BLOCKLIST' | 'MATCH_TYPE_ALLOWLIST': We may want to trigger when the activity matches the patterns in the policy (blocklist) or alternatively when the activity does not match the patterns in the policy (allowlist). - `activity` V1AgentHookActivity: Activity describes what kind of hook activity the policy applies to. - `auto_mode` V1AutoModeActivity: AutoModeActivity turns LLM command judging on for a namespace and says which commands reach the judge. It is an activity kind rather than a resource of its own so that it inherits the AgentHookPolicyDefinition machinery: namespace propagation, name-based deduplication, the JSONL policy-file cache, enabled, and scope. It never produces a match of its own. It is read before the per-policy loop to decide which commands are judged, and a match the judge raises is a CMD_LINE match attributed to this policy. The model stays server-owned: the policy carries no model name and no prompt, only deployment_context. EXACTLY ONE applies to an event — the most specifically scoped candidate, with the policy name breaking an equal rank — and it supplies the whole configuration. They are not unioned, unlike secrets_check or malware_check, because a mode is not a finding: OR is monotone, so nothing at a narrower scope could ever turn a setting back off. A policy that loses is named in a warning, stays enabled and listed, and does nothing. - `deployment_context` string[]: Free-text lines describing the local deployment: which hosts are the organisation's own, which registries are sanctioned, that ENDOR_TOKEN is expected on this machine. These fill the trust anchors the rubric names as deployment-supplied and ships empty; until they are set the rubric over-escalates on ordinary internal traffic. They are appended AFTER the rubric, so the rubric stays a byte-identical prefix the provider can serve from its cache. The bounds below are per entry. ValidatePolicy bounds the SUM at 8 KiB, the point past which the judge stops reading, so a tenant cannot store context that would be dropped unread on every call — nor a policy line long enough to break the JSONL reader that distributes the set to hooks. - `judge_scope` 'JUDGE_SCOPE_UNSPECIFIED' | 'JUDGE_SCOPE_MATCHED_COMMANDS' | 'JUDGE_SCOPE_ALL_COMMANDS': JudgeScope says which commands reach the judge. It is one selector rather than a set of booleans so that no two modes can be in force at once. - JUDGE_SCOPE_UNSPECIFIED: Judge nothing. The policy still supplies deployment_context to the cmd_line policies that carry the AUTO action and judge on their own. This is also what an endorctl too old to know a value added later reads, so every future value fails safe. - JUDGE_SCOPE_MATCHED_COMMANDS: Judge the commands a RISK command policy already matched, treating the action of each matched policy as AUTO. This overrides an explicit customer decision in BOTH directions: a policy that says block stops blocking and asks the judge, and one that says alert or feedback can escalate to a block on a suspicious label. The override lasts only as long as the judge answers — with no label each policy keeps its own action, so an outage degrades to the enforcement the tenant had. A GOVERNANCE policy is never overridden, and a command that only a governance policy matched is not judged at all. - JUDGE_SCOPE_ALL_COMMANDS: Judge every command and stand the RISK command policies down. The malware and secrets checks are untouched: they carry real detections rather than regular expressions. The patterns are still evaluated. They are stood down by a label coming back rather than by this scope alone, which is what lets a judge that cannot be reached fall back to the verdict they produced. An allowlist stands down on the same terms as a blocklist, so a command absent from the set a tenant permitted runs anyway if the judge finds nothing wrong with it. Mark a command policy GOVERNANCE to keep its action final: a governance match keeps its own action under every label. The judge still rules on the command itself, so a review or suspicious label also raises an ask or a block against the auto-mode policy, next to the governance match. - `cmd_line` V1CmdLineActivity: CmdLineActivity matches command-line execution by regex patterns. - `command_risk_category` 'COMMAND_RISK_CATEGORY_UNSPECIFIED' | 'COMMAND_RISK_CATEGORY_DESTRUCTIVE_FILESYSTEM' | 'COMMAND_RISK_CATEGORY_PRIVILEGE_ESCALATION' | 'COMMAND_RISK_CATEGORY_INLINE_CODE_EXECUTION' | 'COMMAND_RISK_CATEGORY_DOWNLOAD_AND_EXECUTE' | 'COMMAND_RISK_CATEGORY_DANGEROUS_GIT_OPERATION' | 'COMMAND_RISK_CATEGORY_FORCE_PUSH' | 'COMMAND_RISK_CATEGORY_PACKAGE_PUBLISH' | 'COMMAND_RISK_CATEGORY_NETWORK_EXFILTRATION' | 'COMMAND_RISK_CATEGORY_SECRET_FILE_READ' | 'COMMAND_RISK_CATEGORY_SHELL_PROFILE_WRITE' | 'COMMAND_RISK_CATEGORY_NETWORK_ACCESS' | 'COMMAND_RISK_CATEGORY_RECURSIVE_GREP' | 'COMMAND_RISK_CATEGORY_ENV_VAR_EXPORT' | 'COMMAND_RISK_CATEGORY_PUSH_TO_MAIN' | 'COMMAND_RISK_CATEGORY_PACKAGE_INSTALL' | 'COMMAND_RISK_CATEGORY_PACKAGE_MANAGER_BYPASS' | 'COMMAND_RISK_CATEGORY_PUBLIC_GITHUB_PUBLISHING' | 'COMMAND_RISK_CATEGORY_CREDENTIAL_DISCOVERY': CommandRiskCategory identifies the system command-policy family that matched. Values are permanent classifier keys and do not depend on policy names. - COMMAND_RISK_CATEGORY_UNSPECIFIED: No risk classification was performed. - COMMAND_RISK_CATEGORY_DESTRUCTIVE_FILESYSTEM: Destructive filesystem operations, such as recursive root deletion. - COMMAND_RISK_CATEGORY_PRIVILEGE_ESCALATION: Privilege escalation or broad permission and ownership changes. - COMMAND_RISK_CATEGORY_INLINE_CODE_EXECUTION: Interpreter one-liners that expose dangerous execution capabilities. - COMMAND_RISK_CATEGORY_DOWNLOAD_AND_EXECUTE: Remote content that runs directly in a shell. - COMMAND_RISK_CATEGORY_DANGEROUS_GIT_OPERATION: Git operations that discard work or skip local safeguards. - COMMAND_RISK_CATEGORY_FORCE_PUSH: Force pushes that rewrite remote history. - COMMAND_RISK_CATEGORY_PACKAGE_PUBLISH: Package or artifact publication to a registry. - COMMAND_RISK_CATEGORY_NETWORK_EXFILTRATION: Raw network transfer tools used against remote endpoints. - COMMAND_RISK_CATEGORY_SECRET_FILE_READ: Shell reads of credential, key, or secret files. - COMMAND_RISK_CATEGORY_SHELL_PROFILE_WRITE: Shell writes to startup files that can establish persistence. - COMMAND_RISK_CATEGORY_NETWORK_ACCESS: Network download or remote access commands. - COMMAND_RISK_CATEGORY_RECURSIVE_GREP: Recursive searches that can expose secrets in transcripts. - COMMAND_RISK_CATEGORY_ENV_VAR_EXPORT: Export of credential-shaped environment variables. - COMMAND_RISK_CATEGORY_PUSH_TO_MAIN: Direct pushes to main or master branches. - COMMAND_RISK_CATEGORY_PACKAGE_INSTALL: Package installation or container run and pull commands. - COMMAND_RISK_CATEGORY_PACKAGE_MANAGER_BYPASS: Commands that bypass the package firewall. - COMMAND_RISK_CATEGORY_PUBLIC_GITHUB_PUBLISHING: Content publication to a public GitHub repository, gist, or release. - COMMAND_RISK_CATEGORY_CREDENTIAL_DISCOVERY: Discovery or staging of credentials and related secret material. - `patterns` string[]: Patterns to match against the command (e.g. "rm -rf /.*", "curl .* \\| bash"). - `dependency_risk` V1DependencyRiskActivity: DependencyRiskActivity checks the dependencies an event introduces (from an install command or a manifest/lockfile edit) against Endor's vulnerability data. Matching the activity means running the check; the verdict comes from the lookup, not from the policy config. - `ecosystems` string[]: Ecosystems to check (e.g. "npm", "pypi"). Empty means all ecosystems. - `exclude_file_patterns` string[]: Skip files whose path matches one of these regexes. Applied after include_file_patterns. - `include_file_patterns` string[]: Only check files whose path matches one of these regexes. Empty means every manifest/lockfile name the check recognizes. - `include_transitives` boolean: Also check the packages the new dependency pulls in. - `min_cvss_severity` 'SEVERITY_UNSPECIFIED' | 'SEVERITY_LOW' | 'SEVERITY_MEDIUM' | 'SEVERITY_HIGH' | 'SEVERITY_CRITICAL': Severity levels, mirroring Vuln.Spec.CVSSV3Severity.Level. - SEVERITY_UNSPECIFIED: Unset. min_cvss_severity treats this as HIGH. - SEVERITY_LOW: CVSS low (0.1 - 3.9). - SEVERITY_MEDIUM: CVSS medium (4.0 - 6.9). - SEVERITY_HIGH: CVSS high (7.0 - 8.9). - SEVERITY_CRITICAL: CVSS critical (9.0 - 10.0). - `file_access` V1FileAccessActivity: FileAccessActivity matches file access by operation and path patterns. - `file_name_patterns` string[]: Regex file patterns (e.g. "\\.env$", "secrets/.*", ".*\\.key$"). - `file_operation` 'FILE_OPERATION_UNSPECIFIED' | 'FILE_OPERATION_READ' | 'FILE_OPERATION_WRITE' | 'FILE_OPERATION_DELETE' | 'FILE_OPERATION_EDIT': FileOperation identifies the type of file access. - `malware_check` V1MalwareCheckActivity: MalwareCheckActivity runs Endor's malware lookup against the packages in a package-install command (a cmd_line event). It carries no regex matchers: matching the activity means running the check, and the block/allow verdict comes from the malware feed (MALWARE-status, non-contested records), not from the policy config. - `ecosystems` string[]: Ecosystems to check (e.g. "npm", "pypi", "cargo"). Empty means all ecosystems. - `mcp_server` V1McpServerActivity: McpServerActivity matches MCP servers by name patterns and/or score thresholds. Match logic: configured branches are AND'd — when both server_name_matchers and score predicates are set, both must hold; when only one is set, only that one must hold; if neither is set, the activity never matches. Within the score branch, score_at_or_below and every set field of dimension_at_or_below are OR'd: any single satisfied threshold fires the branch. This is server-level matching; for per-tool-call matching, use McpToolCallActivity. - `dimension_at_or_below` V1McpDimensionThresholds: McpDimensionThresholds holds per-dimension score thresholds for McpServerActivity. Each field is optional; an unset dimension is ignored. Set dimensions are OR'd among themselves and with score_at_or_below: any single dimension at or below its threshold fires the predicate. Dimension names mirror AgenticInventory.McpScoreDimensions. - `authentication_authorization` number, float: Threshold for authentication & authorization (credential-less network access, hardcoded secrets). - `input_validation_injection` number, float: Threshold for input validation & injection (shell/SQL/code injection, prompt-poisoning patterns). - `operational_hygiene` number, float: Threshold for operational hygiene (spec conformance, destructive tool labeling). - `supply_chain_provenance` number, float: Threshold for supply chain & provenance (malicious packages, CVEs, unverified publishers, unpinned deps). - `score_at_or_below` number, float: Match when the overall score is at or below this threshold (scores are 1-10, higher = safer). OR'd with dimension_at_or_below. - `server_name_matchers` string[]: Regex matchers for MCP server name (e.g. "untrusted-.*", "remote-.*"). AND'd with the score-predicate branch when both are configured. - `mcp_tool_call` V1McpToolCallActivity: McpToolCallActivity matches tool calls to a specific MCP server and tool. - `mcp_server_name` string: MCP server name (e.g. "jira"). - `server_name_matchers` string[]: Optional regex matchers for MCP server name. - `tool_input_matchers` string[]: Optional regex matchers for tool input (e.g. ".*AI.*"). - `tool_name` string: Tool name (e.g. "open bug"). - `tool_name_matchers` string[]: Optional regex matchers for tool name. - `secrets_check` V1SecretsCheckActivity: SecretsCheckActivity runs Endor's secret detection over file content (the proposed content of a write/edit, or a file read scanned from disk). Matching the activity means running the scan; the verdict comes from the findings, not from the policy config. - `exclude_file_patterns` string[]: Skip files whose path matches one of these regexes (e.g. test fixtures, "*.example" files, vendored dirs). Applied after include_file_patterns. - `exclude_rule_ids` string[]: Rule IDs whose findings this policy ignores. Matched as for include_rule_ids, and applied after it, so an id in both is ignored. - `file_operations` V1FileAccessActivityFileOperation[]: File operations to scan. Empty means write and edit; scanning a read means reading the file from disk, so reads are opt-in. - `include_file_patterns` string[]: Only scan files whose path matches one of these regexes. Empty means all files the event covers. - `include_rule_ids` string[]: Rule IDs whose findings this policy acts on, compared exactly and case-sensitively against the rule id on each finding (SecretRule.spec.rule_id, e.g. "aws-access-token"). Empty means every rule in the tenant's effective ruleset. - `session` V1SessionActivity: SessionActivity matches sessions by posture predicates over SessionHook fields and the captured AgentConfigSnapshot. Sessions have no stable name, so matching uses field predicates instead of name regexes. Each sub-message is optional; if set, all its predicates are AND'd. Sub-messages are also AND'd with each other. Predicates that target AgentConfigSnapshot evaluate across repository / user / enterprise levels (any-level satisfies). MCP-server-related criteria intentionally live on McpServerActivity, not here. - `hook` V1SessionHookCriteria: SessionHookCriteria matches against AgentHookConfig entries at any AgentConfigLevel. Each field is optional. - `command_matchers` string[]: Regex matchers for hook command strings (e.g. "curl .* \\| bash"). - `event_name_matchers` string[]: Regex matchers for hook event_name (e.g. "PostToolUse"). - `model` V1SessionModelCriteria: SessionModelCriteria matches against default_model and available_models at any AgentConfigLevel. Each field is optional. - `available_model_matchers` string[]: Regex matchers for entries in available_models. - `default_model_matchers` string[]: Regex matchers for default_model. - `permissions` V1SessionPermissionsCriteria: SessionPermissionsCriteria matches against AgentPermissionsConfig at any AgentConfigLevel. Each field is optional. - `allowed_command_matchers` string[]: Regex matchers for entries in permissions.allowed_commands. - `bypass_disabled` boolean: If set, match when permissions.bypass_disabled equals this value (e.g. false ⇒ "bypass is allowed"). - `default_mode_matchers` string[]: Regex matchers for permissions.default_mode (e.g. "bypassPermissions"). - `denied_command_matchers` string[]: Regex matchers for entries in permissions.denied_commands. - `sandbox` V1SessionSandboxCriteria: SessionSandboxCriteria matches against AgentSandboxConfig at any AgentConfigLevel, and against the session's resolved sandbox posture. Each field is optional. - `allowed_host_matchers` string[]: Regex matchers for entries in sandbox.allowed_network_hosts (catches overly permissive host rules like ".*"). - `enabled` boolean: If set, match when sandbox.enabled equals this value at any level (e.g. false ⇒ "sandbox is explicitly off at some level"). A level that does not set sandbox.enabled never matches. To match a session that runs unsandboxed, use `postures`. - `fail_if_unavailable` boolean: If set, match when sandbox.fail_if_unavailable equals this value. - `postures` V1SessionSandboxPosture[]: If set, match when the session's resolved sandbox posture (SessionHook.sandbox_config_posture) is one of these values. This is the posture that the agent's resolver derives from its own rules, such as defaults, precedence, and (where the resolver checks it) whether the sandbox can start on the host. It is not the raw config, which `enabled` reads. Blocklist policies only. Must be the only session criterion in the policy. - `top_level` V1SessionTopLevelCriteria: SessionTopLevelCriteria matches against SessionHook top-level fields (composer_mode, source, is_background_agent) and the per-session user identity carried on AgentHookEvent.Spec.user. - `composer_mode_matchers` string[]: Regex matchers for composer_mode (e.g. "agent", "ask", "edit"). - `group_matchers` string[]: Regex matchers against the resolved org groups in AgentHookEvent.Spec.identity.groups. A match fires when any group matches any matcher (e.g. "platform", "security"). - `is_background_agent` boolean: If set, match when is_background_agent equals this value. - `role_matchers` string[]: Regex matchers against the resolved org roles in AgentHookEvent.Spec.identity.roles. A match fires when any role matches any matcher (e.g. "contractor", "admin"). - `source_matchers` string[]: Regex matchers for source (e.g. "startup", "resume", "clear"). - `user_name_matchers` string[]: Regex matchers for the user name from AgentHookEvent.Spec.user (e.g. "alice", "svc-.*", ".*@example\\.com"). - `skill` V1SkillActivity: SkillActivity matches skills by name patterns and/or score thresholds. Match logic: configured branches are AND'd — when both name_matchers and score predicates are set, both must hold for the match to fire; when only one is set, only that one must hold; if neither is set, the activity never matches. Within the score branch, score_at_or_below and every set field of dimension_at_or_below are OR'd: any single satisfied threshold fires the branch. When score predicates are set but no SkillMeta is available for the skill, the score branch is configured-but-cannot-fire, failing the AND with the name branch (fail-safe). - `dimension_at_or_below` V1SkillDimensionThresholds: SkillDimensionThresholds holds per-dimension score thresholds for SkillActivity. Each field is optional; an unset dimension is ignored. Set dimensions are OR'd among themselves and with score_at_or_below: any single dimension at or below its threshold fires the predicate. Dimension names mirror AgenticInventory.SkillScoreDimensions. - `data_protection` number, float: Threshold for data protection (credential access, exfiltration). - `external_dependencies` number, float: Threshold for external dependencies (untrusted sources, remote code). - `instruction_integrity` number, float: Threshold for instruction integrity (prompt injection, boundary violations). - `permission_boundaries` number, float: Threshold for permission boundaries (privilege claims, tool misuse). - `name_matchers` string[]: Regex matchers for skill name (e.g. "untrusted-.*", "experimental-.*"). AND'd with the score-predicate branch when both are configured. - `score_at_or_below` number, float: Match when the overall score is at or below this threshold (scores are 1-10, higher = safer). OR'd with dimension_at_or_below. - `tool_sandbox` V1ToolSandboxActivity: ToolSandboxActivity matches runtime sandbox state on a tool-call event. Values in each repeated field are OR'd. Configured fields are AND'd, and an excluded reason vetoes a match. Exclusions alone and empty activities never match. Unspecified and not-applicable postures do not satisfy posture matches. - `excluded_reasons` V1CallSandboxReason[]: Reasons that veto an otherwise successful match. - `override_requested` boolean: If set, the event's override request must equal this value. - `postures` V1CallSandboxPosture[]: Runtime postures to match. An empty list accepts any posture. - `reasons` V1CallSandboxReason[]: Unsandboxed or unresolved outcome reasons to match. An empty list accepts any reason. - `enabled` boolean: Whether this policy is active. - `intent` 'POLICY_INTENT_UNSPECIFIED' | 'POLICY_INTENT_RISK' | 'POLICY_INTENT_GOVERNANCE': PolicyIntent says what kind of rule a policy encodes, and so whether the LLM command judge may rule on its matches. Only cmd_line policies are judged, so today the intent changes behavior only on a cmd_line policy. - POLICY_INTENT_UNSPECIFIED: Read as POLICY_INTENT_RISK, so a policy that never sets the field keeps the behavior it had before the field existed. - POLICY_INTENT_RISK: The policy is a risk assessment. A judge scope may hand its matches to the judge, and the label can release, ask about, or block the command. - POLICY_INTENT_GOVERNANCE: The policy is an organisational rule, for example "installs go through the package firewall". A verdict on how risky the command is answers a question the rule does not ask, so no judge scope hands its matches to the judge. Its own action is final: no label releases it, and no label escalates it. Not valid with the AUTO action, which hands the decision to the judge. - `inventory_classification` 'INVENTORY_CLASSIFICATION_UNSPECIFIED' | 'INVENTORY_CLASSIFICATION_ALLOW' | 'INVENTORY_CLASSIFICATION_BLOCK' | 'INVENTORY_CLASSIFICATION_SUSPICIOUS' | 'INVENTORY_CLASSIFICATION_MALICIOUS': InventoryClassification declares the classification a policy assigns to a matched MCP server or skill when it fires. UNSPECIFIED means the policy plays no role in inventory classification (e.g. a session, file-access, or cmd-line policy, or an MCP/skill policy whose author only wants the per-event action). - `name` string: Name of the policy. - `scope` V1AgentHookPolicyScope: AgentHookPolicyScope restricts a policy to a subset of events by matching against per-event identity carried on AgentHookEvent.Spec (repository, user). Scope is evaluated once, before activity-kind matching, so it applies uniformly to all activity kinds. Match logic: an unset scope (or a scope with no matchers set) applies to every event. When set, configured matcher branches are AND'd — every set branch must produce a hit; within a branch the regexes are OR'd (any one matching satisfies the branch); an empty branch is ignored. A scope miss makes the policy a no-op for the event for both blocklist and allowlist match types (the policy simply does not apply). - `repository_matchers` string[]: Regex matchers for the repository from AgentHookEvent.Spec.repository (e.g. "github\\.com/acme/.*", ".*-infra$"). OR'd among themselves. - `user_matchers` string[]: Regex matchers for the user/account from AgentHookEvent.Spec.user (e.g. "alice", "svc-.*", ".*@example\\.com"). "Account" in the ticket maps to this per-session user identity; there is no separate account entity. OR'd among themselves. - `system` boolean: Whether this is a system-defined policy (vs user-defined). - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of an AgentHookPolicyDefinition. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:tenant_meta.namespace/agent-hook-policy-definitions/:uuid/get.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)