---
title: "Request policy information"
method: GET
path: "/organizations/{organizationId}/policies"
tags: ["Organizations"]
---

# Request policy information

`GET /organizations/{organizationId}/policies`

## Request

- Base URL: `https://api.xfa.tech`
- URL: `https://api.xfa.tech/organizations/{organizationId}/policies`
- Auth: HTTP bearer

## Path parameters

- `organizationId` string, required

## Response `200`

Returns the policy

- Policies[]
  - `policy_id` string, required: Unique identifier for the policy
  - `organization_id` string, required: Organization identifier
  - `created_by_email` string: Email of the user who created the policy
  - `created_at_epoch_seconds` integer: Unix epoch seconds when the policy was created
  - `updated_by_email` string: Email of the user who last updated the policy
  - `updated_at_epoch_seconds` integer: Unix epoch seconds when the policy was last updated
  - `name` string, required: Policy name
  - `installed` boolean: Require the native application to be installed
  - `unsupported` boolean: Skip unsupported devices automatically
  - `skip` boolean: Allow users to skip the token flow
  - `skip_limit` SkipLimit
    - `max_skips` integer, required
  - `skip_mobile` boolean: Allow users to skip the token flow on mobile
  - `skip_desktop` boolean: Allow users to skip the token flow on desktop
  - `agentless_allowed` boolean: Allow agentless providing of posture
  - `os` VersionPolicy
    - `WarnTime` integer: Warn users if their version is older than this many seconds
    - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `BlockTime` integer: Block users if their version is older than this many seconds
    - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
    - `older_supported_major_versions` MajorVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
      - `dont_block` boolean, required: Do not block users if on older, but supported major version
    - `beta_versions` BetaVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on beta version
      - `dont_block` boolean, required: Do not block users if on beta version
  - `windows_os` VersionPolicy
    - `WarnTime` integer: Warn users if their version is older than this many seconds
    - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `BlockTime` integer: Block users if their version is older than this many seconds
    - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
    - `older_supported_major_versions` MajorVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
      - `dont_block` boolean, required: Do not block users if on older, but supported major version
    - `beta_versions` BetaVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on beta version
      - `dont_block` boolean, required: Do not block users if on beta version
  - `macos_os` VersionPolicy
    - `WarnTime` integer: Warn users if their version is older than this many seconds
    - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `BlockTime` integer: Block users if their version is older than this many seconds
    - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
    - `older_supported_major_versions` MajorVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
      - `dont_block` boolean, required: Do not block users if on older, but supported major version
    - `beta_versions` BetaVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on beta version
      - `dont_block` boolean, required: Do not block users if on beta version
  - `linux_os` VersionPolicy
    - `WarnTime` integer: Warn users if their version is older than this many seconds
    - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `BlockTime` integer: Block users if their version is older than this many seconds
    - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
    - `older_supported_major_versions` MajorVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
      - `dont_block` boolean, required: Do not block users if on older, but supported major version
    - `beta_versions` BetaVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on beta version
      - `dont_block` boolean, required: Do not block users if on beta version
  - `android_os` VersionPolicy
    - `WarnTime` integer: Warn users if their version is older than this many seconds
    - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `BlockTime` integer: Block users if their version is older than this many seconds
    - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
    - `older_supported_major_versions` MajorVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
      - `dont_block` boolean, required: Do not block users if on older, but supported major version
    - `beta_versions` BetaVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on beta version
      - `dont_block` boolean, required: Do not block users if on beta version
  - `ios_os` VersionPolicy
    - `WarnTime` integer: Warn users if their version is older than this many seconds
    - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `BlockTime` integer: Block users if their version is older than this many seconds
    - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
    - `older_supported_major_versions` MajorVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
      - `dont_block` boolean, required: Do not block users if on older, but supported major version
    - `beta_versions` BetaVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on beta version
      - `dont_block` boolean, required: Do not block users if on beta version
  - `ipados_os` VersionPolicy
    - `WarnTime` integer: Warn users if their version is older than this many seconds
    - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `BlockTime` integer: Block users if their version is older than this many seconds
    - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
    - `older_supported_major_versions` MajorVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
      - `dont_block` boolean, required: Do not block users if on older, but supported major version
    - `beta_versions` BetaVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on beta version
      - `dont_block` boolean, required: Do not block users if on beta version
  - `os_autoupdate` object
    - `warn` boolean, required: Warn users if OS auto-update is not enabled
    - `block` boolean, required: Block users if OS auto-update is not enabled
    - `goal` boolean: Goal - whether OS auto-update should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `browser` VersionPolicy
    - `WarnTime` integer: Warn users if their version is older than this many seconds
    - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `BlockTime` integer: Block users if their version is older than this many seconds
    - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
    - `older_supported_major_versions` MajorVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
      - `dont_block` boolean, required: Do not block users if on older, but supported major version
    - `beta_versions` BetaVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on beta version
      - `dont_block` boolean, required: Do not block users if on beta version
  - `pdf_readers` VersionPolicy
    - `WarnTime` integer: Warn users if their version is older than this many seconds
    - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `BlockTime` integer: Block users if their version is older than this many seconds
    - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
    - `older_supported_major_versions` MajorVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
      - `dont_block` boolean, required: Do not block users if on older, but supported major version
    - `beta_versions` BetaVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on beta version
      - `dont_block` boolean, required: Do not block users if on beta version
  - `disk_encryption` object
    - `warn` boolean, required: Warn users if disk is not encrypted
    - `block` boolean, required: Block users if disk is not encrypted
    - `goal` boolean: Goal - whether disk encryption should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `screen_lock` object
    - `warn` boolean, required: Warn users if screen lock is not enabled or timeout exceeds max_timeout
    - `block` boolean, required: Block users if screen lock is not enabled or timeout exceeds max_timeout
    - `goal` boolean: Goal - whether screen lock should be enabled
    - `max_timeout` integer: Maximum allowed screen lock timeout in seconds
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `antivirus` AntivirusPolicy
    - `warn` boolean, required: Warn users if antivirus is not enabled
    - `block` boolean, required: Block users if antivirus is not enabled
    - `goal` boolean: Goal - whether antivirus should be enabled
    - `requirements` AntivirusRequirements, nullable: Missing requirements preserve stored rules on update; null clears all rules. Missing OS fields preserve their rule; null clears it.
      - `windows` AntivirusProductRequirement, nullable
        - `allowed_products` string[], required: One healthy listed product suffices. An empty list allows any supported healthy product. Windows accepts microsoft_defender or wsc followed by a colon and a normalized full registration name; Linux accepts clamav or microsoft_defender_endpoint; macOS accepts apple_xprotect.
      - `linux` AntivirusProductRequirement, nullable
        - `allowed_products` string[], required: One healthy listed product suffices. An empty list allows any supported healthy product. Windows accepts microsoft_defender or wsc followed by a colon and a normalized full registration name; Linux accepts clamav or microsoft_defender_endpoint; macOS accepts apple_xprotect.
      - `macos` AntivirusProductRequirement, nullable
        - `allowed_products` string[], required: One healthy listed product suffices. An empty list allows any supported healthy product. Windows accepts microsoft_defender or wsc followed by a colon and a normalized full registration name; Linux accepts clamav or microsoft_defender_endpoint; macOS accepts apple_xprotect.
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `password_manager` object
    - `warn` boolean, required: Warn users if password manager is not enabled
    - `block` boolean, required: Block users if password manager is not enabled
    - `goal` boolean: Goal - whether password manager should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `biometrics` object
    - `warn` boolean, required: Warn users if biometric is not enabled
    - `block` boolean, required: Block users if biometric is not enabled
    - `goal` boolean: Goal - whether biometric should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `reboot` object
    - `WarnTimeInDays` integer: Warn users if they have not reboot their device more than this many days
    - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `BlockTimeInDays` integer: Block users if they have not reboot their device more than this many days
    - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `GoalTimeInDays` integer: Goal - days that devices are allowed to be without rebooting
  - `windows_recall` object
    - `warn` boolean, required: Warn users if they have not disabled windows recall
    - `block` boolean, required: Block users if they have not disabled windows recall
    - `goal` boolean: Goal - whether windows recall should be disabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `xfa_version` VersionPolicyInDays
    - `WarnTimeInDays` integer: Warn users if their version is older than this many days
    - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `BlockTimeInDays` integer: Block users if their version is older than this many days
    - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
    - `GoalTimeInDays` integer: Goal - days that devices are allowed to be outdated with security updates
    - `older_supported_major_versions` MajorVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
      - `dont_block` boolean, required: Do not block users if on older, but supported major version
    - `beta_versions` BetaVersionsPolicy
      - `dont_warn` boolean, required: Do not warn users if on beta version
      - `dont_block` boolean, required: Do not block users if on beta version
  - `firewall` object
    - `warn` boolean, required: Warn users if firewall is not enabled
    - `block` boolean, required: Block users if firewall is not enabled
    - `goal` boolean: Goal - whether firewall should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `dns` object
    - `dns_servers` string[], required: List of required DNS servers
    - `validation_mode` 'exact_match' | 'exact_with_extra' | 'contains', required: How to validate DNS server configuration
    - `warn` boolean, required: Warn users if requirement is not configured properly
    - `block` boolean, required: Block users if requirement is not configured properly
    - `goal` boolean: Goal - whether dns should be configured properly
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `screen_sharing` object
    - `warn` boolean, required: Warn users if screen sharing is enabled
    - `block` boolean, required: Block users if screen sharing is enabled
    - `goal` boolean: Goal - whether screen sharing should be disabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `remote_login` object
    - `warn` boolean, required: Warn users if remote login is enabled
    - `block` boolean, required: Block users if remote login is enabled
    - `goal` boolean: Goal - whether remote login should be disabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `remote_management` object
    - `warn` boolean, required: Warn users if remote management is enabled
    - `block` boolean, required: Block users if remote management is enabled
    - `goal` boolean: Goal - whether remote management should be disabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `remote_scripting` object
    - `warn` boolean, required: Warn users if remote scripting is enabled
    - `block` boolean, required: Block users if remote scripting is enabled
    - `goal` boolean: Goal - whether remote scripting should be disabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `jailbroken` object
    - `warn` boolean, required: Warn users if device is jailbroken
    - `block` boolean, required: Block users if device is jailbroken
    - `goal` boolean: Goal - whether device should not be jailbroken
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `rooted` object
    - `warn` boolean, required: Warn users if device is rooted
    - `block` boolean, required: Block users if device is rooted
    - `goal` boolean: Goal - whether device should not be rooted
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `developer_mode` object
    - `warn` boolean, required: Warn users if developer mode is enabled
    - `block` boolean, required: Block users if developer mode is enabled
    - `goal` boolean: Goal - whether developer mode should be disabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `secure_boot` object
    - `warn` boolean, required: Warn users if secure boot is not enabled
    - `block` boolean, required: Block users if secure boot is not enabled
    - `goal` boolean: Goal - whether secure boot should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `integrity_protection` object
    - `warn` boolean, required: Warn users if integrity protection is not enabled
    - `block` boolean, required: Block users if integrity protection is not enabled
    - `goal` boolean: Goal - whether integrity protection should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `find_my_device` object
    - `warn` boolean, required: Warn users if find my device is enabled
    - `block` boolean, required: Block users if find my device is enabled
    - `goal` boolean: Goal - whether find my device should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `vanta` object
    - `warn` boolean, required: Warn users if vanta is not enabled
    - `block` boolean, required: Block users if vanta is not enabled
    - `goal` boolean: Goal - whether vanta should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `intune` object
    - `tenant_ids` string[], required: List of allowed Intune tenant IDs
    - `external_enrollment_allowed` boolean: Allow devices to be enrolled with an external organisation
    - `warn` boolean, required: Warn users if intune is not enabled
    - `block` boolean, required: Block users if intune is not enabled
    - `goal` boolean: Goal - whether intune should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `aikido_safe_chain` object
    - `warn` boolean, required: Warn users if Aikido Safe Chain is not installed and active
    - `block` boolean, required: Block users if Aikido Safe Chain is not installed and active
    - `goal` boolean: Goal - whether Aikido Safe Chain should be installed and active
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `aikido_endpoint` object
    - `endpoint_token` string: Aikido Endpoint registration token used for self-installation and tenant association
    - `warn` boolean, required: Warn users if Aikido Endpoint is not installed and active
    - `block` boolean, required: Block users if Aikido Endpoint is not installed and active
    - `goal` boolean: Goal - whether Aikido Endpoint should be installed and active
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `secrets_in_environment` object
    - `warn` boolean, required: Warn users if secrets are detected in environment
    - `block` boolean, required: Block users if secrets are detected in environment
    - `goal` boolean: Goal - whether secrets should not be in environment
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `autonomous_agents_present` object
    - `warn` boolean, required: Warn users if autonomous agents are present
    - `block` boolean, required: Block users if autonomous agents are present
    - `goal` boolean: Goal - whether autonomous agents should not be present
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `unsafe_ai_mode` object
    - `warn` boolean, required: Warn users if unsafe AI configurations are detected
    - `block` boolean, required: Block users if unsafe AI configurations are detected
    - `goal` boolean: Goal - whether unsafe AI configurations should not be present
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `unguarded_elevation` object
    - `warn` boolean, required: Warn users if unguarded elevation is detected
    - `block` boolean, required: Block users if unguarded elevation is detected
    - `goal` boolean: Goal - whether unguarded elevation should not be present
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `chrome_safebrowsing_enabled` object
    - `warn` boolean, required: Warn users if Chrome Safe Browsing is not enabled
    - `block` boolean, required: Block users if Chrome Safe Browsing is not enabled
    - `goal` boolean: Goal - whether Chrome Safe Browsing should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `chrome_safebrowsing_enhanced` object
    - `warn` boolean, required: Warn users if Chrome Enhanced Safe Browsing is not enabled
    - `block` boolean, required: Block users if Chrome Enhanced Safe Browsing is not enabled
    - `goal` boolean: Goal - whether Chrome Enhanced Safe Browsing should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `chrome_do_not_track` object
    - `warn` boolean, required: Warn users if Chrome Do Not Track is not enabled
    - `block` boolean, required: Block users if Chrome Do Not Track is not enabled
    - `goal` boolean: Goal - whether Chrome Do Not Track should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `chrome_dns_over_https` object
    - `warn` boolean, required: Warn users if Chrome DNS over HTTPS is not enabled
    - `block` boolean, required: Block users if Chrome DNS over HTTPS is not enabled
    - `goal` boolean: Goal - whether Chrome DNS over HTTPS should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `firefox_https_only` object
    - `warn` boolean, required: Warn users if Firefox HTTPS-Only mode is not enabled
    - `block` boolean, required: Block users if Firefox HTTPS-Only mode is not enabled
    - `goal` boolean: Goal - whether Firefox HTTPS-Only mode should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `firefox_dns_over_https` object
    - `warn` boolean, required: Warn users if Firefox DNS over HTTPS is not enabled
    - `block` boolean, required: Block users if Firefox DNS over HTTPS is not enabled
    - `goal` boolean: Goal - whether Firefox DNS over HTTPS should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `firefox_enhanced_tracking_protection` object
    - `warn` boolean, required: Warn users if Firefox Enhanced Tracking Protection is not enabled
    - `block` boolean, required: Block users if Firefox Enhanced Tracking Protection is not enabled
    - `goal` boolean: Goal - whether Firefox Enhanced Tracking Protection should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `firefox_enhanced_tracking_protection_strict` object
    - `warn` boolean, required: Warn users if Firefox Enhanced Tracking Protection strict mode is not enabled
    - `block` boolean, required: Block users if Firefox Enhanced Tracking Protection strict mode is not enabled
    - `goal` boolean: Goal - whether Firefox Enhanced Tracking Protection strict mode should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `unattended_remote_access` object
    - `warn` boolean, required: Warn users if unattended remote access tools are configured
    - `block` boolean, required: Block users if unattended remote access tools are configured
    - `goal` boolean: Goal - whether unattended remote access tools should not be configured
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `install_protection` object: Policy for the OS-level install protection guardrail (Gatekeeper on macOS, SmartScreen / Defender PUA on Windows).
    - `warn` boolean, required: Warn users if install protection is not enabled
    - `block` boolean, required: Block users if install protection is not enabled
    - `goal` boolean: Goal - whether install protection should be enabled
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `no_revoked_signature_apps` object: Policy for apps whose code-signing certificate has been revoked by the OS.
    - `warn` boolean, required: Warn users if apps with revoked signatures are present
    - `block` boolean, required: Block users if apps with revoked signatures are present
    - `goal` boolean: Goal - whether apps with revoked signatures should be absent
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `no_tampered_apps` object: Policy for apps whose binary does not match its code signature.
    - `warn` boolean, required: Warn users if tampered apps are present
    - `block` boolean, required: Block users if tampered apps are present
    - `goal` boolean: Goal - whether tampered apps should be absent
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `no_untrusted_signer_apps` object: Policy for apps signed by an untrusted or unknown developer.
    - `warn` boolean, required: Warn users if apps from untrusted signers are present
    - `block` boolean, required: Block users if apps from untrusted signers are present
    - `goal` boolean: Goal - whether apps from untrusted signers should be absent
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `no_unsigned_apps` object: Policy for apps that carry no code signature at all.
    - `warn` boolean, required: Warn users if unsigned apps are present
    - `block` boolean, required: Block users if unsigned apps are present
    - `goal` boolean: Goal - whether unsigned apps should be absent
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `no_adhoc_signed_apps` object: Policy for apps that carry only an ad-hoc (self-issued) signature.
    - `warn` boolean, required: Warn users if ad-hoc signed apps are present
    - `block` boolean, required: Block users if ad-hoc signed apps are present
    - `goal` boolean: Goal - whether ad-hoc signed apps should be absent
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `no_unnotarized_apps` object: Policy for macOS apps signed with a Developer ID but without Apple notarization.
    - `warn` boolean, required: Warn users if apps without notarization are present
    - `block` boolean, required: Block users if apps without notarization are present
    - `goal` boolean: Goal - whether apps without notarization should be absent
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `no_cryptominers` object: Policy for cryptominer applications.
    - `warn` boolean, required: Warn users if cryptominer applications are present
    - `block` boolean, required: Block users if cryptominer applications are present
    - `goal` boolean: Goal - whether cryptominer applications should be absent
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `no_hacking_pentest` object: Policy for hacking and pentest tools.
    - `warn` boolean, required: Warn users if hacking and pentest tools are present
    - `block` boolean, required: Block users if hacking and pentest tools are present
    - `goal` boolean: Goal - whether hacking and pentest tools should be absent
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `no_piracy_p2p` object: Policy for piracy and peer-to-peer applications.
    - `warn` boolean, required: Warn users if piracy and P2P applications are present
    - `block` boolean, required: Block users if piracy and P2P applications are present
    - `goal` boolean: Goal - whether piracy and P2P applications should be absent
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `no_jailbreak_rooting` object: Policy for jailbreak and rooting tools.
    - `warn` boolean, required: Warn users if jailbreak and rooting tools are present
    - `block` boolean, required: Block users if jailbreak and rooting tools are present
    - `goal` boolean: Goal - whether jailbreak and rooting tools should be absent
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `no_vpn_clients` object: Policy for VPN clients.
    - `warn` boolean, required: Warn users if VPN clients are present
    - `block` boolean, required: Block users if VPN clients are present
    - `goal` boolean: Goal - whether VPN clients should be absent
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `no_third_party_ai_coding` object: Policy for third-party AI coding tools.
    - `warn` boolean, required: Warn users if third-party AI coding tools are present
    - `block` boolean, required: Block users if third-party AI coding tools are present
    - `goal` boolean: Goal - whether third-party AI coding tools should be absent
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `no_experimental_browsers` object: Policy for experimental browsers.
    - `warn` boolean, required: Warn users if experimental browsers are present
    - `block` boolean, required: Block users if experimental browsers are present
    - `goal` boolean: Goal - whether experimental browsers should be absent
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `no_virtualization` object: Policy for virtualization software.
    - `warn` boolean, required: Warn users if virtualization software is present
    - `block` boolean, required: Block users if virtualization software is present
    - `goal` boolean: Goal - whether virtualization software should be absent
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `no_games` object: Policy for games and gaming tools.
    - `warn` boolean, required: Warn users if games or gaming tools are present
    - `block` boolean, required: Block users if games or gaming tools are present
    - `goal` boolean: Goal - whether games and gaming tools should be absent
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer
  - `no_permission_hungry` object: Policy for applications that request unusually broad system permissions.
    - `warn` boolean, required: Warn users if permission-hungry applications are present
    - `block` boolean, required: Block users if permission-hungry applications are present
    - `goal` boolean: Goal - whether permission-hungry applications should be absent
    - `escalation` CheckEscalation
      - `mode` 'grace_days', required
      - `block_after_days` integer

---

[API](https://skmtc.dev/xfa/apis/xfa-api.md) · [All operations](https://skmtc.dev/xfa/apis/xfa-api/llms.txt) · [OpenAPI document](https://skmtc.dev/xfa/apis/xfa-api/revisions/1a1be0e8972b?raw)