--- title: "Preview a detection policy apply" method: POST path: "/api/policies/v2/deployments/{deploymentId}/detection-policy/{product}:dryRun" tags: ["PoliciesV2Service"] --- # Preview a detection policy apply `POST /api/policies/v2/deployments/{deploymentId}/detection-policy/{product}:dryRun` ## Request - The document declares no server URL. - Auth: HTTP bearer - TypeScript: (a function with typed inputs; its response is checked against the schema) Validates a candidate detection policy bundle and returns the diff a strict apply would produce, without changing anything. The response includes the state_version the diff was computed against; send that exact value as If-Match on the follow-up PUT to guarantee you apply the diff you previewed. ## Path parameters - `deploymentId` integer, required: The unique numerical identifier for the deployment. - `product` string, required: The product the candidate bundle applies to. One of: `code`, `secrets`. ## Request body - ProtosPoliciesV2DryRunDetectionPolicyRequest - `bundle` ProtosPoliciesV2DetectionPolicyBundle, required: The full declared detection state for one product. A strict apply replaces the entire bundle: rule selection is overwritten and exceptions absent from the bundle are deleted. - `deployment_slug` string: Output only. The slug of the deployment the bundle belongs to. Ignored when sent in a request body. - `product` string: The product the bundle applies to. One of: `code`, `secrets`. Optional in request bodies; when present it must match the product in the URL. - `rulesets` string[]: Registry ruleset paths that run deployment-wide, for example `p/owasp-top-10`. Must be empty when product is `secrets`. - `rules` string[]: Registry rule paths added individually, on top of the selected rulesets. - `disabled` string[]: Registry rule paths from the selected rulesets that are explicitly turned off. - `exceptions` ProtosPoliciesV2DetectionPolicyException[]: Per-project or per-tag include/exclude exceptions to the deployment-wide rule selection. - `exception_type` string, required: Whether the exception forces the rule to run (`include`) or skips it (`exclude`) on the targeted scope. - `project` string: The name of the project the exception targets. Mutually exclusive with project_tag_name. - `project_tag_name` string: The name of the project tag the exception targets. Treat tag names as opaque strings: they may contain spaces and special characters. Mutually exclusive with project. - `rule` string, required: The registry path of the rule or rule pack the exception applies to. - `rule_type` string, required: Whether rule refers to a single rule (`rule`) or a rule pack (`pack`). ## Response `200` OK - ProtosPoliciesV2DryRunDetectionPolicyResponse - `creates` ProtosPoliciesV2DetectionPolicyDiffEntry[]: Exceptions that the apply would create. - `kind` string: The resource the entry refers to. One of: `DetectionPolicy`, `DetectionPolicyException`. - `key` ProtosPoliciesV2DetectionPolicyDiffKey: The stable identity of a resource in a detection policy diff. For kind "DetectionPolicy" only product is set; for kind "DetectionPolicyException" the scope, rule, and rule_type fields are set. - `product` string: Set for kind `DetectionPolicy`: the product the policy applies to. - `scope_type` string: Set for kind `DetectionPolicyException`. One of: `project`, `project_tag`. - `scope_target` string: Set for kind `DetectionPolicyException`: the project name or project tag name the exception targets. - `rule` string: Set for kind `DetectionPolicyException`: the registry path of the rule or rule pack. - `rule_type` string: Set for kind `DetectionPolicyException`. One of: `rule`, `pack`. - `before` ProtosPoliciesV2DetectionPolicyDiffContent: The content of a resource in a detection policy diff. For kind "DetectionPolicy" the rule selection fields are set; for kind "DetectionPolicyException" only exception_type is set. - `rulesets` string[]: Populated only for kind `DetectionPolicy`: the ruleset selection. Empty for exception entries. - `rules` string[]: Populated only for kind `DetectionPolicy`: the individually added rules. Empty for exception entries. - `disabled` string[]: Populated only for kind `DetectionPolicy`: the explicitly disabled rules. Empty for exception entries. - `exception_type` string: Set for kind `DetectionPolicyException`. One of: `include`, `exclude`. - `after` ProtosPoliciesV2DetectionPolicyDiffContent: The content of a resource in a detection policy diff. For kind "DetectionPolicy" the rule selection fields are set; for kind "DetectionPolicyException" only exception_type is set. - `rulesets` string[]: Populated only for kind `DetectionPolicy`: the ruleset selection. Empty for exception entries. - `rules` string[]: Populated only for kind `DetectionPolicy`: the individually added rules. Empty for exception entries. - `disabled` string[]: Populated only for kind `DetectionPolicy`: the explicitly disabled rules. Empty for exception entries. - `exception_type` string: Set for kind `DetectionPolicyException`. One of: `include`, `exclude`. - `updates` ProtosPoliciesV2DetectionPolicyDiffEntry[]: The detection policy and exceptions that the apply would update. - `kind` string: The resource the entry refers to. One of: `DetectionPolicy`, `DetectionPolicyException`. - `key` ProtosPoliciesV2DetectionPolicyDiffKey: The stable identity of a resource in a detection policy diff. For kind "DetectionPolicy" only product is set; for kind "DetectionPolicyException" the scope, rule, and rule_type fields are set. - `product` string: Set for kind `DetectionPolicy`: the product the policy applies to. - `scope_type` string: Set for kind `DetectionPolicyException`. One of: `project`, `project_tag`. - `scope_target` string: Set for kind `DetectionPolicyException`: the project name or project tag name the exception targets. - `rule` string: Set for kind `DetectionPolicyException`: the registry path of the rule or rule pack. - `rule_type` string: Set for kind `DetectionPolicyException`. One of: `rule`, `pack`. - `before` ProtosPoliciesV2DetectionPolicyDiffContent: The content of a resource in a detection policy diff. For kind "DetectionPolicy" the rule selection fields are set; for kind "DetectionPolicyException" only exception_type is set. - `rulesets` string[]: Populated only for kind `DetectionPolicy`: the ruleset selection. Empty for exception entries. - `rules` string[]: Populated only for kind `DetectionPolicy`: the individually added rules. Empty for exception entries. - `disabled` string[]: Populated only for kind `DetectionPolicy`: the explicitly disabled rules. Empty for exception entries. - `exception_type` string: Set for kind `DetectionPolicyException`. One of: `include`, `exclude`. - `after` ProtosPoliciesV2DetectionPolicyDiffContent: The content of a resource in a detection policy diff. For kind "DetectionPolicy" the rule selection fields are set; for kind "DetectionPolicyException" only exception_type is set. - `rulesets` string[]: Populated only for kind `DetectionPolicy`: the ruleset selection. Empty for exception entries. - `rules` string[]: Populated only for kind `DetectionPolicy`: the individually added rules. Empty for exception entries. - `disabled` string[]: Populated only for kind `DetectionPolicy`: the explicitly disabled rules. Empty for exception entries. - `exception_type` string: Set for kind `DetectionPolicyException`. One of: `include`, `exclude`. - `deletes` ProtosPoliciesV2DetectionPolicyDiffEntry[]: Exceptions that the apply would delete. - `kind` string: The resource the entry refers to. One of: `DetectionPolicy`, `DetectionPolicyException`. - `key` ProtosPoliciesV2DetectionPolicyDiffKey: The stable identity of a resource in a detection policy diff. For kind "DetectionPolicy" only product is set; for kind "DetectionPolicyException" the scope, rule, and rule_type fields are set. - `product` string: Set for kind `DetectionPolicy`: the product the policy applies to. - `scope_type` string: Set for kind `DetectionPolicyException`. One of: `project`, `project_tag`. - `scope_target` string: Set for kind `DetectionPolicyException`: the project name or project tag name the exception targets. - `rule` string: Set for kind `DetectionPolicyException`: the registry path of the rule or rule pack. - `rule_type` string: Set for kind `DetectionPolicyException`. One of: `rule`, `pack`. - `before` ProtosPoliciesV2DetectionPolicyDiffContent: The content of a resource in a detection policy diff. For kind "DetectionPolicy" the rule selection fields are set; for kind "DetectionPolicyException" only exception_type is set. - `rulesets` string[]: Populated only for kind `DetectionPolicy`: the ruleset selection. Empty for exception entries. - `rules` string[]: Populated only for kind `DetectionPolicy`: the individually added rules. Empty for exception entries. - `disabled` string[]: Populated only for kind `DetectionPolicy`: the explicitly disabled rules. Empty for exception entries. - `exception_type` string: Set for kind `DetectionPolicyException`. One of: `include`, `exclude`. - `after` ProtosPoliciesV2DetectionPolicyDiffContent: The content of a resource in a detection policy diff. For kind "DetectionPolicy" the rule selection fields are set; for kind "DetectionPolicyException" only exception_type is set. - `rulesets` string[]: Populated only for kind `DetectionPolicy`: the ruleset selection. Empty for exception entries. - `rules` string[]: Populated only for kind `DetectionPolicy`: the individually added rules. Empty for exception entries. - `disabled` string[]: Populated only for kind `DetectionPolicy`: the explicitly disabled rules. Empty for exception entries. - `exception_type` string: Set for kind `DetectionPolicyException`. One of: `include`, `exclude`. - `state_version` string: The state_version the diff was computed against. Send this exact value as the If-Match header on the follow-up PUT. - `validation_errors` ProtosPoliciesV2BundleValidationError[]: Validation problems with the candidate bundle. When non-empty, the diff fields are empty and a strict apply would be rejected. - `code` string: A stable, machine-readable error code, for example `UNSUPPORTED_ACTION_TYPE` or `UNKNOWN_REFERENCE`. - `message` string: A human-readable explanation of the problem. - `policy_slug` string: The slug of the remediation policy the error applies to, when scoped to a single policy. Empty for bundle-wide errors. - `context` object: Structured detail for the error; the keys present depend on `code` (for example `action_type`, `missing_companion`, `condition_type`, `value`). --- [API](https://skmtc.dev/semgrep/apis/semgrep-web-app.md) - [All operations](https://skmtc.dev/semgrep/apis/semgrep-web-app/llms.txt) - [OpenAPI document](https://skmtc.dev/semgrep/apis/semgrep-web-app/revisions/6483eeecd582?raw)