GEgetaxonflow
Tenant Policies

List dynamic policies

Retrieve a paginated list of the caller's policies, whatever their category: with no category parameter no category filter is applied, so rows categorised otherwise, or not at all (written through /api/v1/policies), are returned too. A category parameter must start with dynamic- or media-, and any other value is refused 400. When type=media is passed without a category, results are filtered to media-* categories.

limit is the preferred pagination parameter; page_size is deprecated but still accepted.

get/api/v1/tenant-policies

Request

Query parameters

type'content' | 'user' | 'risk' | 'cost' | 'context_aware' | 'media' | 'rate-limit' | 'budget' | 'time-access' | 'role-access' | 'mcp' | 'connector'

Policy type determines evaluation context:

  • content: Evaluates request/response content
  • user: Evaluates user attributes
  • risk: Evaluates risk scores
  • cost: Evaluates cost estimates
  • context_aware: Context-aware controls (tenant isolation, debug restriction, sensitive-data control)
  • media: Media governance policies (multimodal image governance)
  • rate-limit, budget, time-access: MCP rate/budget controls
  • role-access, mcp, connector: MCP access controls

Filter by policy type

categorystring

Filter by category. Must start with dynamic- or media- (e.g., dynamic-risk, media-safety); other values are rejected with a validation error.

enabledboolean

Filter by enabled status

searchstring

Search in policy name and description

pageinteger

Page number (1-indexed)

limitinteger

Items per page (preferred over the deprecated page_size)

page_sizeinteger

Items per page (deprecated - use limit instead)

sort_by'name' | 'created_at' | 'updated_at' | 'priority'

Sort field

sort_dir'asc' | 'desc'

Sort direction

Headers

X-Tenant-IDstring required
Example:tenant_abc123

Tenant identifier for multi-tenancy isolation. When calling through the Agent (recommended), this header is stamped automatically from the authenticated client — you do not set it yourself. Required only on direct Orchestrator calls (internal deployments).

Response

List of dynamic policies

Example response

{
  "policies": [
    {
      "id": "pol_abc123def456",
      "name": "Block PII Access",
      "description": "Prevent unauthorized access to personally identifiable information",
      "category": "dynamic-risk",
      "actions": [
        {
          "config": {
            "message": "Request blocked by policy",
            "channel": "security-alerts"
          }
        }
      ]
    }
  ],
  "pagination": {
    "page": 1,
    "page_size": 20,
    "total_items": 45,
    "total_pages": 3
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.