GEgetaxonflow
Decisions & Overrides

Get a policy override

Returns one override by id, tenant-scoped. Another tenant's override returns 404.

get/api/v1/overrides/{id}

Request

Path parameters

idstring required

Override id

Headers

X-Tenant-IDstring required

Tenant identifier scoping the request. The AxonFlow Agent gateway sets this header after authentication; the orchestrator fails closed when it is absent (401 on audit/decision endpoints, 400 on others — see each operation). Clients cannot widen their scope through it: handlers force the tenant filter from this header, never from the request body.

Response

Override detail

idstring required
policy_idstring required

The policy this override applies to.

Its VALUE differs by view, deliberately, and has since before the three views were collapsed onto one shape. GET /api/v1/overrides and GET /api/v1/overrides/{id} return the canonical UUID stored on the row. Before v11.0.0 the create ECHOED THE VALUE SENT IN THE REQUEST and does not resolve it to a UUID — a caller may create an override by slug or name, and the create response hands back what they sent. A client correlating a created override with a later listing must key on id, not on policy_id.

One SHAPE across the views is what issue #3944 asked for and what these three now have; identical values on every member is a different property, and this member does not hold it.

policy_typestring required

static or dynamic. Deliberately NOT declared as an enum: on a RESPONSE property oasdiff reads a newly-declared enum as values being ADDED to a set clients already switch on, and reports four breaking changes for a constraint that tightens nothing.

tenant_idstring

ABSENT on an org-scoped override — the key is omitted, not sent as null. A NULL tenant column is what makes a row org-scoped rather than tenant-scoped, and the platform marshals that as an omitted member. An earlier revision of this description said "null", which no response ever contains and which this schema would reject.

org_idstring required

The organisation that owns this override. This is the canonical spelling on this surface — it is what the column is called and what the agent plane's view of the same table has always emitted.

organization_idstring required

DEPRECATED alias of org_id, always carrying the same value. Read org_id. Retained rather than removed because this is a published endpoint and a shipped client may read it.

Unrelated to the organization_id on the POLICY surface, which is current and not deprecated; the two share a name and nothing else.

action_overridestring

WHAT THE OVERRIDE DOES. Absent from this plane's views before #3944, which is why an operator could not tell one override from another. Every row created before v11.0.0 carries allow.

enabled_overrideboolean

Whether the policy is force-enabled or force-disabled by this override. Absent on a row created before v11.0.0 through POST /api/v1/overrides, which does not set it.

override_reasonstring required

The mandatory ADR-044 justification (max 500 chars).

expires_atstring date-time
tool_signaturestring

Present when the override is restricted to a single tool.

created_bystring required
created_atstring date-time required
revoked_atstring date-time

Present only on revoked overrides

revoked_bystring

Present only on revoked overrides

Changes

No recorded changes to this operation across all 1 revision of this API.