Switch off the shadow policy

POST

/v1/policies/{id}/versions/{v}/deactivate

const url = 'http://127.0.0.1:8080/v1/policies/example/versions/example/deactivate';
const options = {
  method: 'POST',
  headers: {
    'Deedglass-Version': '2026-10-01',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: '{"reason":"Shadow run finished; v3 matched the review."}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url http://127.0.0.1:8080/v1/policies/example/versions/example/deactivate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Deedglass-Version: 2026-10-01' \
  --data '{ "reason": "Shadow run finished; v3 matched the review." }'

Ends the version’s shadow activation and seals an admin deed. Only the shadow version can be switched off: the enforced one is 409 conflict (activate another version instead), and a version that isn’t the shadow policy is 409 conflict. The reason is required (3 to 280 characters). An admin+ Console session (with the Deedglass-CSRF header) or an org admin key; agent keys get 403 insufficient_scope (“Agents cannot read or test policies. Use the Console or an admin key.”).

Authorizations

bearerAuth
sessionCookie

Parameters

Path Parameters

required

string

A pol_ id or the policy’s name.

required

string

A version number, like 3, or a pv_ id.

Header Parameters

Deedglass-Version

string

/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/

The API version (YYYY-MM-DD). Leave it out to use your org’s pinned version (public routes use the latest). An unknown version is 400 api_version_invalid.

Deedglass-CSRF

string

Needed when the request uses a Console session (it changes state); without it the answer is 403 csrf_failed. Not sent with an API key.

Idempotency-Key

string

>= 1 characters <= 255 characters

1 to 255 printable ASCII characters. A retry with the same key and body returns the stored response with Deedglass-Idempotent-Replayed: true for 24 hours.

Request Body^required

application/json

object

reason

required

One line

string

>= 3 characters <= 280 characters

Example

{
  "reason": "Shadow run finished; v3 matched the review."
}

Responses

200

The activation, now ended, with the deed.

application/json

One activation of a version, as enforce or shadow, with the deeds that sealed it. deeds is in seal order: one deed, or two for a promote from shadow (the shadow ending, then the version enforced).

object

object

required

string

Allowed value: policy_activation

required

string

/^pa_[0-7][0-9a-hjkmnp-tv-z]{25}$/

policy

required

string

/^pol_[0-7][0-9a-hjkmnp-tv-z]{25}$/

name

required

string

mode

required

string

Allowed values: enforce shadow

version

required

object

required

string

/^pv_[0-7][0-9a-hjkmnp-tv-z]{25}$/

version

required

integer

>= 1

version_hash

required

“sha256:” + lowercase hex of SHA-256.

string

/^sha256:[0-9a-f]{64}$/

previous

required

The activation this one replaced in the same mode; null when there was none.

object

policy

required

string

name

required

string

version

required

integer

>= 1

promoted_from_shadow

required

True when the version was the shadow policy and is now enforced.

boolean

acknowledged_warnings

required

The warning codes accepted for this activation, sorted.

Array<string>

reason

required

string

>= 3 characters <= 280 characters

activated_by

required

Who acted, as a person, an API key, or the system (whose id is null).

object

object

required

string

Allowed values: user api_key system

required

usr_… or key_…; null for the system.

string | null

activated_at

required

string format: date-time

deactivated_at

required

string | null format: date-time

deactivated_by

required

Any of:

object
null

Who acted, as a person, an API key, or the system (whose id is null).

object

object

required

string

Allowed values: user api_key system

required

usr_… or key_…; null for the system.

string | null

deeds

required

Array<string>

>= 1 items

Example

{
  "object": "policy_activation",
  "id": "pa_01jb8p0z2b4d6f8h0k2n4q6s8v",
  "policy": "pol_01jb8m2x7k4q9r3t5v6w8y0z1a",
  "name": "postgres-safe",
  "mode": "enforce",
  "version": {
    "id": "pv_01jb8m3c0d2f4g6h8j0k2m4n6p",
    "version": 3,
    "version_hash": "sha256:3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"
  },
  "previous": {
    "policy": "pol_01jb8m2x7k4q9r3t5v6w8y0z1a",
    "name": "postgres-safe",
    "version": 2
  },
  "promoted_from_shadow": true,
  "acknowledged_warnings": [],
  "reason": "Guard the orders database before the pilot.",
  "activated_by": {
    "object": "user",
    "id": "usr_01k6c9kb2zcjsyn7b8g2k1vqvp"
  },
  "activated_at": "2026-10-06T11:40:02.000Z",
  "deactivated_at": null,
  "deactivated_by": null,
  "deeds": [
    "deed_01jb8p0y1a3c5e7g9j1m3p5r7t",
    "deed_01k6vrddq2atgb2023qvhhct3g"
  ]
}

Headers

Deedglass-Request-Id

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

Deedglass-Idempotent-Replayed

string

Allowed values: true

Present, and true, when the response is a stored one replayed for an Idempotency-Key.

default

An error. Every error has this envelope; doc_url explains the code.

application/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error policy_error rate_limit_error api_error

code

required

string

Allowed values: invalid_api_key api_key_revoked api_key_expired agent_suspended agent_stopped org_stopped insufficient_scope policy_denied approval_required approval_expired budget_exceeded intent_required intent_invalid intent_replay tool_unknown connector_unavailable upstream_error timeout rate_limited idempotency_conflict validation_failed not_found conflict internal_error authentication_required method_not_allowed request_too_large unsupported_media_type invalid_json api_version_invalid idempotency_key_invalid idempotency_key_in_use service_unavailable session_expired csrf_failed insufficient_role login_link_invalid login_code_invalid last_owner policy_unavailable policy_invalid credentials_missing destination_blocked vault_unavailable upstream_auth_failed upstream_not_found upstream_rate_limited response_too_large statement_refused row_limit_exceeded database_role_unsafe database_not_ready witness_not_configured approval_decided already_countersigned approver_not_eligible self_approval approval_needs_person context_changed approval_unsatisfiable approval_link_invalid approval_link_review_only approver_unmapped stripe_live_key_refused stripe_livemode_detected upstream_approval_pending schedule_needs_approval action_executing from_denied undo_unavailable undo_plan_stale already_undone undo_conflict replay_too_large replay_window_invalid suggestion_stale shadow_slot_taken suggestion_decided observe_not_enabled pro_required

message

required

One or more calm sentences with the next step.

string

param

required

The request field, query parameter or header the error is about.

string | null

request_id

required

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

doc_url

required

string format: uri

diagnostics

On policy_invalid only. Each problem with its line, code and hint.

Array<object>

One finding about a policy file, with its position and the next step. Codes are stable and listed in docs/POLICY_ERRORS.md. In the policy_invalid error envelope each diagnostic also carries object: policy_diagnostic. The full PolicyDiagnostic schema is in openapi.yaml.

object

action

One agent action. Its sections mirror the deed’s. status is the one field an agent needs; state is the exact lifecycle state (docs/GATE.md). The Gate’s own responses (POST /v1/actions and its result report) add execution.result and witness.reasons; lists leave both out. The full Action schema is in openapi.yaml.

object

checks

On undo_unavailable only. Every check of the undo, each with its fix. Additive (S23).

Array<object>

One of the twelve safety checks (S23 §3.3). Available means no check failed. The full UndoCheck schema is in openapi.yaml.

object

Example

{
  "error": {
    "type": "invalid_request_error",
    "code": "not_found",
    "message": "There's no endpoint at GET /v1/helth. Did you mean /v1/health?",
    "param": null,
    "request_id": "req_01j9zr3m5k8q2w7x4t6v0b1c9d",
    "doc_url": "https://docs.deedglass.com/errors/not_found"
  }
}

Headers

Deedglass-Request-Id

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

Deedglass-Version

string

The API version this response follows.

Switch off the shadow policy

Authorizations

Parameters

Path Parameters

Header Parameters

Request Bodyrequired

Example

Responses

200

Example

Headers

default

Example

Headers

Request Body^required