---
title: "Preview Route"
method: GET
path: "/api/v1/nova/discovery/onboarding-plans/{agent_id}/protection"
tags: ["nova"]
---

# Preview Route

`GET /api/v1/nova/discovery/onboarding-plans/{agent_id}/protection`

## Path parameters

- `agent_id` string, uuid, required

## Query parameters

- `provider_id` string, uuid, nullable

## Headers

- `Authorization` string, nullable

## Response `200`

Successful Response

- ProtectionPreview
  - `agent_id` string, uuid, required
  - `name` string, required
  - `entry_file` string, required
  - `entry_line` integer, nullable, required
  - `findings` JobFindingRead[], required
    - `id` string, uuid, required
    - `type` string, required
    - `severity` string, required
    - `file` string, required
    - `line` integer, nullable, required
    - `excerpt` string, nullable, required
  - `assessment` OnboardingPlanRead, required
    - `agent_id` string, uuid, required
    - `repository_id` string, uuid, required
    - `scan_job_id` string, uuid, nullable, required
    - `head_sha` string, nullable, required
    - `recorded_by` string, required
    - `recorded_by_ref` string, nullable, required
    - `observed` object, required
    - `plan` AgentOnboardingPlan, required — The whole plan, as the model records it.
      - `summary` string, required
      - `intent` string, required
      - `tools_observed` ObservedTool[]
        - `name` string, required
        - `source` string, required — The evidence line or finding id this comes from.
        - `risk` 'none' | 'elevated' | 'dangerous'
      - `scope_instructions` string, required — Instructions for a scope guardrail: permitted activities and boundaries.
      - `policies` PlannedPolicy[]
        - `template` string, required — Policy template id.
        - `parameter_values` object
        - `reason` string, required
        - `finding_ids` string[]
      - `guardrails` PlannedGuardrails
        - `daily_token_budget` integer, nullable
        - `per_request_cost_cap_usd` number, nullable
        - `output_token_cap` integer, nullable
      - `agent` PlannedAgent, required — The governed agent the plan reuses or creates.
        - `action` 'reuse' | 'create', required
        - `agent_id` string, uuid, nullable
        - `name` string, nullable
        - `provider_id` string, uuid, nullable
      - `coverage` PlannedCoverage, required
        - `scan_truncated` boolean
        - `confidence` 'low' | 'medium' | 'high', required
        - `open_questions` string[]
    - `status` string, required
    - `planner_plan` AgentOnboardingPlan, required — The whole plan, as the model records it.
      - `summary` string, required
      - `intent` string, required
      - `tools_observed` ObservedTool[]
        - `name` string, required
        - `source` string, required — The evidence line or finding id this comes from.
        - `risk` 'none' | 'elevated' | 'dangerous'
      - `scope_instructions` string, required — Instructions for a scope guardrail: permitted activities and boundaries.
      - `policies` PlannedPolicy[]
        - `template` string, required — Policy template id.
        - `parameter_values` object
        - `reason` string, required
        - `finding_ids` string[]
      - `guardrails` PlannedGuardrails
        - `daily_token_budget` integer, nullable
        - `per_request_cost_cap_usd` number, nullable
        - `output_token_cap` integer, nullable
      - `agent` PlannedAgent, required — The governed agent the plan reuses or creates.
        - `action` 'reuse' | 'create', required
        - `agent_id` string, uuid, nullable
        - `name` string, nullable
        - `provider_id` string, uuid, nullable
      - `coverage` PlannedCoverage, required
        - `scan_truncated` boolean
        - `confidence` 'low' | 'medium' | 'high', required
        - `open_questions` string[]
    - `planner_head_sha` string, nullable, required
    - `applied_resources` object, nullable, required
    - `apply_complete` boolean, required
    - `applied_at` string, date-time, nullable, required
    - `changed_since_onboarded` boolean, required
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
  - `providers` ProtectionProvider[], required
    - `id` string, uuid, required
    - `name` string, required
    - `provider` string, required
    - `model` string, nullable, required
  - `provider_id` string, uuid, nullable, required
  - `policies` ProtectionPolicy[], required
    - `template` string, required
    - `title` string, required
    - `stage` string, required
    - `parameter_values` object, required
    - `reason` string, required
    - `finding_ids` string[], required
  - `revision` string, required
  - `blockers` string[], required
  - `limitations` string[], required
  - `governed_agent_id` string, uuid, nullable, required
  - `agent_url` string, nullable, required
  - `configured` boolean, required
  - `configured_at` string, date-time, nullable, required

## Other responses

- `422` — Validation Error

## Changes

- **2026-09-27** `b20a3bdd6219` — 4 breaking, 4 info
  - removed the required property `assessment/plan/proxy` from the response with the `200` status
  - removed the required property `assessment/planner_plan/anyOf[subschema #1: AgentOnboardingPlan]/proxy` from the response with the `200` status
  - removed the required property `proxy_id` from the response with the `200` status
  - removed the required property `proxy_url` from the response with the `200` status
  - …4 more
- **2026-09-22** `66575c8854c1` — 4 warning, 2 info
  - removed the optional property `assessment/plan/capabilities` from the response with the `200` status
  - removed the optional property `assessment/plan/guardrails/rate_limit_rpm` from the response with the `200` status
  - removed the optional property `assessment/planner_plan/anyOf[subschema #1: AgentOnboardingPlan]/capabilities` from the response with the `200` status
  - removed the optional property `assessment/planner_plan/anyOf[subschema #1: AgentOnboardingPlan]/guardrails/rate_limit_rpm` from the response with the `200` status
  - …2 more
- **2026-09-11** `3bf37c9d2784` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/xenovia/apis/controlplane/changes/api/v1/nova/discovery/onboarding-plans/:agent_id/protection/get.md)

---

[API](https://skmtc.dev/xenovia/apis/controlplane.md) · [All operations](https://skmtc.dev/xenovia/apis/controlplane/llms.txt) · [OpenAPI document](https://skmtc.dev/xenovia/apis/controlplane/revisions/b20a3bdd6219?raw)