---
title: "Get a detection policy"
method: GET
path: "/api/policies/v2/deployments/{deploymentId}/detection-policy/{product}"
tags: ["PoliciesV2Service"]
---

# Get a detection policy

`GET /api/policies/v2/deployments/{deploymentId}/detection-policy/{product}`

## Request

- The document declares no server URL.
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/semgrep/apis/semgrep-web-app/docs/api/policies/v2/deployments/:deploymentId/detection-policy/:product/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns the detection policy bundle for one product (`code` or `secrets`), including its exceptions, plus the state_version required to apply changes. Returns 404 with code PRODUCT_NOT_ENABLED when the requested product is not enabled for the deployment.

## Path parameters

- `deploymentId` integer, required: The unique numerical identifier for the deployment.
- `product` string, required: The product to read the detection policy for. One of: `code`, `secrets`.

## Response `200`

OK

- ProtosPoliciesV2GetDetectionPolicyResponse
  - `bundle` ProtosPoliciesV2DetectionPolicyBundle: The full declared detection state for one product. A strict apply replaces the entire bundle: rule selection is overwritten and exceptions absent from the bundle are deleted.
    - `deployment_slug` string: Output only. The slug of the deployment the bundle belongs to. Ignored when sent in a request body.
    - `product` string: The product the bundle applies to. One of: `code`, `secrets`. Optional in request bodies; when present it must match the product in the URL.
    - `rulesets` string[]: Registry ruleset paths that run deployment-wide, for example `p/owasp-top-10`. Must be empty when product is `secrets`.
    - `rules` string[]: Registry rule paths added individually, on top of the selected rulesets.
    - `disabled` string[]: Registry rule paths from the selected rulesets that are explicitly turned off.
    - `exceptions` ProtosPoliciesV2DetectionPolicyException[]: Per-project or per-tag include/exclude exceptions to the deployment-wide rule selection.
      - `exception_type` string, required: Whether the exception forces the rule to run (`include`) or skips it (`exclude`) on the targeted scope.
      - `project` string: The name of the project the exception targets. Mutually exclusive with project_tag_name.
      - `project_tag_name` string: The name of the project tag the exception targets. Treat tag names as opaque strings: they may contain spaces and special characters. Mutually exclusive with project.
      - `rule` string, required: The registry path of the rule or rule pack the exception applies to.
      - `rule_type` string, required: Whether rule refers to a single rule (`rule`) or a rule pack (`pack`).
  - `state_version` string: A content-only fingerprint of the bundle. It changes only when the bundle's content changes. Send it as the If-Match header on PUT.

---

[API](https://skmtc.dev/semgrep/apis/semgrep-web-app.md) - [All operations](https://skmtc.dev/semgrep/apis/semgrep-web-app/llms.txt) - [OpenAPI document](https://skmtc.dev/semgrep/apis/semgrep-web-app/revisions/6483eeecd582?raw)