Skip to content
deedglassdocs

Push a new version of a policy

POST
/v1/policies/{id}/versions
curl --request POST \
  --url http://127.0.0.1:8080/v1/policies/example/versions \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Deedglass-Version: 2026-10-01' \
  --data '{ "source": "deedglass: policy/v1\nname: postgres-safe\n…", "notes": "Allow-list writes to public.orders for the pilot." }'

201 with the new version, which is not active until you activate it. Versions never change. Content identical to an existing version (the same version_hash) saves nothing: the answer is 200 with that version. The YAML’s name must be the policy’s name; another name is 400 validation_failed on source (push it as a new policy). A source that doesn’t compile is 400 policy_invalid with diagnostics. Bodies up to 1 MiB. An admin+ Console session (with the Deedglass-CSRF header) or an org admin key; agent keys get 403 insufficient_scope (“Agents cannot read or test policies. Use the Console or an admin key.”).

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string

A pol_ id or the policy’s name.

Header Parameters

Section titled “Header Parameters”
Deedglass-Version
string
/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/

The API version (YYYY-MM-DD). Leave it out to use your org’s pinned version (public routes use the latest). An unknown version is 400 api_version_invalid.

Deedglass-CSRF
string

Needed when the request uses a Console session (it changes state); without it the answer is 403 csrf_failed. Not sent with an API key.

Idempotency-Key
string
>= 1 characters <= 255 characters

1 to 255 printable ASCII characters. A retry with the same key and body returns the stored response with Deedglass-Idempotent-Replayed: true for 24 hours.

Request Bodyrequired

Section titled “Request Bodyrequired”

The policy YAML, and optional notes kept with the version.

Media typeapplication/json
object
source
required

The policy YAML (deedglass policy/v1)

string
notes

Why this version exists. Kept with the version.

string
<= 2000 characters
Example
{
  "source": "deedglass: policy/v1\nname: postgres-safe\n…",
  "notes": "Allow-list writes to public.orders for the pilot."
}

Responses

Section titled “Responses”

200

Section titled “200”

The content is identical to this existing version; nothing was saved.

Media typeapplication/json

One immutable version of a policy. source is present on a single get only. version_hash is the hash of the normalized policy, so formatting and comments don’t change it; source_hash is the hash of the exact bytes pushed.

object
object
required
string
Allowed value: policy_version
id
required
string
/^pv_[0-7][0-9a-hjkmnp-tv-z]{25}$/
policy
required
string
/^pol_[0-7][0-9a-hjkmnp-tv-z]{25}$/
version
required
integer
>= 1
name
required
string
status
required
string
Allowed values: enforced shadow inactive
version_hash
required

“sha256:” + lowercase hex of SHA-256.

string
/^sha256:[0-9a-f]{64}$/
source_hash
required

“sha256:” + lowercase hex of SHA-256.

string
/^sha256:[0-9a-f]{64}$/
lang
required
string
Allowed value: deedglass.policy/v1
origin
required

Where the version came from. A person or an admin key pushing it is manual.

string
Allowed values: manual suggestion starter onboarding
author
required

Who acted, as a person, an API key, or the system (whose id is null).

object
object
required
string
Allowed values: user api_key system
id
required

usr_… or key_…; null for the system.

string | null
notes
required
string | null
<= 2000 characters
rules
required
integer
budgets
required
integer
warnings
required
Array<object>

One finding about a policy file, with its position and the next step. Codes are stable and listed in docs/POLICY_ERRORS.md. In the policy_invalid error envelope each diagnostic also carries object: policy_diagnostic. The full PolicyDiagnostic schema is in openapi.yaml.

object
source

The YAML exactly as pushed (single get only).

string
created_at
required
string format: date-time
Example
{
  "object": "policy_version",
  "id": "pv_01jb8m3c0d2f4g6h8j0k2m4n6p",
  "policy": "pol_01jb8m2x7k4q9r3t5v6w8y0z1a",
  "version": 3,
  "name": "postgres-safe",
  "status": "enforced",
  "version_hash": "sha256:3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d",
  "source_hash": "sha256:2e7d2c03a9507ae265ecf5b5356885a53393a2029d241394997265a1a25aefc6",
  "lang": "deedglass.policy/v1",
  "origin": "manual",
  "author": {
    "object": "user",
    "id": "usr_01k6c9kb2zcjsyn7b8g2k1vqvp"
  },
  "notes": "Allow-list writes to public.orders for the pilot.",
  "rules": 12,
  "budgets": 2,
  "warnings": [],
  "created_at": "2026-10-06T11:38:15.000Z"
}

Headers

Section titled “Headers”
Deedglass-Request-Id
string
/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

201

Section titled “201”

The new version.

Media typeapplication/json

One immutable version of a policy. source is present on a single get only. version_hash is the hash of the normalized policy, so formatting and comments don’t change it; source_hash is the hash of the exact bytes pushed.

object
object
required
string
Allowed value: policy_version
id
required
string
/^pv_[0-7][0-9a-hjkmnp-tv-z]{25}$/
policy
required
string
/^pol_[0-7][0-9a-hjkmnp-tv-z]{25}$/
version
required
integer
>= 1
name
required
string
status
required
string
Allowed values: enforced shadow inactive
version_hash
required

“sha256:” + lowercase hex of SHA-256.

string
/^sha256:[0-9a-f]{64}$/
source_hash
required

“sha256:” + lowercase hex of SHA-256.

string
/^sha256:[0-9a-f]{64}$/
lang
required
string
Allowed value: deedglass.policy/v1
origin
required

Where the version came from. A person or an admin key pushing it is manual.

string
Allowed values: manual suggestion starter onboarding
author
required

Who acted, as a person, an API key, or the system (whose id is null).

object
object
required
string
Allowed values: user api_key system
id
required

usr_… or key_…; null for the system.

string | null
notes
required
string | null
<= 2000 characters
rules
required
integer
budgets
required
integer
warnings
required
Array<object>

One finding about a policy file, with its position and the next step. Codes are stable and listed in docs/POLICY_ERRORS.md. In the policy_invalid error envelope each diagnostic also carries object: policy_diagnostic. The full PolicyDiagnostic schema is in openapi.yaml.

object
source

The YAML exactly as pushed (single get only).

string
created_at
required
string format: date-time
Example
{
  "object": "policy_version",
  "id": "pv_01jb8m3c0d2f4g6h8j0k2m4n6p",
  "policy": "pol_01jb8m2x7k4q9r3t5v6w8y0z1a",
  "version": 3,
  "name": "postgres-safe",
  "status": "enforced",
  "version_hash": "sha256:3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d",
  "source_hash": "sha256:2e7d2c03a9507ae265ecf5b5356885a53393a2029d241394997265a1a25aefc6",
  "lang": "deedglass.policy/v1",
  "origin": "manual",
  "author": {
    "object": "user",
    "id": "usr_01k6c9kb2zcjsyn7b8g2k1vqvp"
  },
  "notes": "Allow-list writes to public.orders for the pilot.",
  "rules": 12,
  "budgets": 2,
  "warnings": [],
  "created_at": "2026-10-06T11:38:15.000Z"
}

Headers

Section titled “Headers”
Deedglass-Request-Id
string
/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

Deedglass-Idempotent-Replayed
string
Allowed values: true

Present, and true, when the response is a stored one replayed for an Idempotency-Key.

default

Section titled “default”

An error. Every error has this envelope; doc_url explains the code.

Media typeapplication/json
object
error
required
object
type
required
string
Allowed values: invalid_request_error authentication_error permission_error policy_error rate_limit_error api_error
code
required
string
Allowed values: invalid_api_key api_key_revoked api_key_expired agent_suspended agent_stopped org_stopped insufficient_scope policy_denied approval_required approval_expired budget_exceeded intent_required intent_invalid intent_replay tool_unknown connector_unavailable upstream_error timeout rate_limited idempotency_conflict validation_failed not_found conflict internal_error authentication_required method_not_allowed request_too_large unsupported_media_type invalid_json api_version_invalid idempotency_key_invalid idempotency_key_in_use service_unavailable session_expired csrf_failed insufficient_role login_link_invalid login_code_invalid last_owner policy_unavailable policy_invalid credentials_missing destination_blocked vault_unavailable upstream_auth_failed upstream_not_found upstream_rate_limited response_too_large statement_refused row_limit_exceeded database_role_unsafe database_not_ready witness_not_configured approval_decided already_countersigned approver_not_eligible self_approval approval_needs_person context_changed approval_unsatisfiable approval_link_invalid approval_link_review_only approver_unmapped stripe_live_key_refused stripe_livemode_detected upstream_approval_pending schedule_needs_approval action_executing from_denied undo_unavailable undo_plan_stale already_undone undo_conflict replay_too_large replay_window_invalid suggestion_stale shadow_slot_taken suggestion_decided observe_not_enabled pro_required
message
required

One or more calm sentences with the next step.

string
param
required

The request field, query parameter or header the error is about.

string | null
request_id
required
string
/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/
doc_url
required
string format: uri
diagnostics

On policy_invalid only. Each problem with its line, code and hint.

Array<object>

One finding about a policy file, with its position and the next step. Codes are stable and listed in docs/POLICY_ERRORS.md. In the policy_invalid error envelope each diagnostic also carries object: policy_diagnostic. The full PolicyDiagnostic schema is in openapi.yaml.

object
action

One agent action. Its sections mirror the deed’s. status is the one field an agent needs; state is the exact lifecycle state (docs/GATE.md). The Gate’s own responses (POST /v1/actions and its result report) add execution.result and witness.reasons; lists leave both out. The full Action schema is in openapi.yaml.

object
checks

On undo_unavailable only. Every check of the undo, each with its fix. Additive (S23).

Array<object>

One of the twelve safety checks (S23 §3.3). Available means no check failed. The full UndoCheck schema is in openapi.yaml.

object
Example
{
  "error": {
    "type": "invalid_request_error",
    "code": "not_found",
    "message": "There's no endpoint at GET /v1/helth. Did you mean /v1/health?",
    "param": null,
    "request_id": "req_01j9zr3m5k8q2w7x4t6v0b1c9d",
    "doc_url": "https://docs.deedglass.com/errors/not_found"
  }
}

Headers

Section titled “Headers”
Deedglass-Request-Id
string
/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

Deedglass-Version
string

The API version this response follows.