--- title: "Get a policy override" method: GET path: "/api/v1/overrides/{id}" tags: ["Decisions & Overrides"] --- # Get a policy override `GET /api/v1/overrides/{id}` ## Request - Base URL: `https://orchestrator.getaxonflow.com` - URL: `https://orchestrator.getaxonflow.com/api/v1/overrides/{id}` - Auth: none declared. Required headers: `X-Tenant-ID` - TypeScript: (a function with typed inputs; its response is checked against the schema) Returns one override by id, tenant-scoped. Another tenant's override returns 404. ## Path parameters - `id` string, required ## Headers - `X-Tenant-ID` string, required ## Response `200` Override detail - OverrideDetail: THE element shape for `policy_overrides`. One shape behind all three of this plane's views — list, by-id and create. It is NOT member-for-member identical to the agent plane's view of the same table (`PolicyOverride`), and saying so precisely matters: this shape adds the deprecated `organization_id` alias and does not carry `updated_by` / `updated_at`. What it does carry is everything an integrator was missing — `action_override` and `enabled_override` above all. Issue #3944: these were three different shapes. The list view omitted `org_id`, `tool_signature`, `created_by` and — the two that matter — `action_override` and `enabled_override`, which are what an override DOES; the by-id view omitted the same two and spelled the organisation key `organization_id`; and the create response echoed no `override_reason`, the mandatory ADR-044 justification the caller had just supplied. Listing overrides through this plane could not tell an operator what any of them was. The three schema NAMES below are retained and each is now this one shape, so a client generated from an earlier revision keeps its type. - `id` string, required - `policy_id` string, required: The policy this override applies to. **Its VALUE differs by view, deliberately, and has since before the three views were collapsed onto one shape.** `GET /api/v1/overrides` and `GET /api/v1/overrides/{id}` return the canonical UUID stored on the row. Before v11.0.0 the create ECHOED THE VALUE SENT IN THE REQUEST and does not resolve it to a UUID — a caller may create an override by slug or name, and the create response hands back what they sent. A client correlating a created override with a later listing must key on `id`, not on `policy_id`. One SHAPE across the views is what issue #3944 asked for and what these three now have; identical values on every member is a different property, and this member does not hold it. - `policy_type` string, required: `static` or `dynamic`. Deliberately NOT declared as an `enum`: on a RESPONSE property oasdiff reads a newly-declared enum as values being ADDED to a set clients already switch on, and reports four breaking changes for a constraint that tightens nothing. - `tenant_id` string: ABSENT on an org-scoped override — the key is omitted, not sent as `null`. A NULL tenant column is what makes a row org-scoped rather than tenant-scoped, and the platform marshals that as an omitted member. An earlier revision of this description said "null", which no response ever contains and which this schema would reject. - `org_id` string, required: The organisation that owns this override. This is the canonical spelling on this surface — it is what the column is called and what the agent plane's view of the same table has always emitted. - `organization_id` string, required: DEPRECATED alias of `org_id`, always carrying the same value. Read `org_id`. Retained rather than removed because this is a published endpoint and a shipped client may read it. Unrelated to the `organization_id` on the POLICY surface, which is current and not deprecated; the two share a name and nothing else. - `action_override` string: WHAT THE OVERRIDE DOES. Absent from this plane's views before #3944, which is why an operator could not tell one override from another. Every row created before v11.0.0 carries `allow`. - `enabled_override` boolean: Whether the policy is force-enabled or force-disabled by this override. Absent on a row created before v11.0.0 through `POST /api/v1/overrides`, which does not set it. - `override_reason` string, required: The mandatory ADR-044 justification (max 500 chars). - `expires_at` string, date-time - `tool_signature` string: Present when the override is restricted to a single tool. - `created_by` string, required - `created_at` string, date-time, required - `revoked_at` string, date-time: Present only on revoked overrides - `revoked_by` string: Present only on revoked overrides ## Other responses - `400`: Missing override id or missing X-Tenant-ID header - `404`: Override not found — also returned when the override exists but was created by another user and the caller is scoped to `own-rows`. Same body in both cases (non-oracle); `X-Axonflow-Read-Scope` distinguishes them. - `500`: Internal error --- [API](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api.md) - [All operations](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/revisions/f408ef3ec9dd?raw)