enterprise_ai.policy

Source: sdks/python/src/enterprise_ai/policy/__init__.py. Back to the Python SDK reference index.

note

This page is generated by tools/docs/gen_sdk_reference.py from the SDK sources and the OpenAPI text folders. Do not edit it by hand: change the source and regenerate.

Class PoliciesClient

/v1/policies.

Resource

PoliciesClient.create

create(policy: dict[str, Any]) -> Any

Create a policy. Creates a policy of the tenant and appends its first revision. An opa policy needs rego (422 validation_error) and, unless OPA loads signed bundles, is pushed to OPA at once (503 policy_engine_unavailable when OPA cannot be reached). A name already used answers 409 conflict. Needs tenant_admin or security_officer. Writes the audit event policy.create.

Route: /v1/policies (POST).

Name	Type	Default	Required	Description
policy	dict[str, Any]		yes	Policy Contract document of the new policy.

Returns: Any. Decoded JSON answer of the operation "Create a policy".

Raises: the typed errors of the transport (Errors).

PoliciesClient.create_bundle

create_bundle(revision: str | None = None, data: dict[str, Any] | None = None) -> Any

Publish an OPA bundle. Packs the opa policies of the tenant into a signed OPA bundle and stores it as the new current revision. Active policies are decided by OPA; draft ones ship as libraries; disabled ones are left out. No opa policy answers 409 policy_bundle_empty; no signing key in production 503 policy_bundle_signing_unavailable. Needs tenant_admin or security_officer. Writes the audit event policy.bundle_publish. Answers 201 with the bundle record.

Route: /v1/policies/bundles (POST).

Name	Type	Default	Required	Description
revision	str | None	None	no	Revision of the bundle, or current for the latest published one.
data	dict[str, Any] | None	None	no	Optional revision name and data.json content. An empty body generates the revision.

Returns: Any. Decoded JSON answer of the operation "Publish an OPA bundle".

Raises: the typed errors of the transport (Errors).

PoliciesClient.decisions

decisions(**page: Any) -> Any

List the policy decisions. Lists the decisions of the tenant, newest first, paginated: subject, action, resource, context, allow, policy and version, reasons, obligations, engine and date. Needs tenant_admin, security_officer or auditor.

Route: /v1/policies/decisions (GET).

Name	Type	Default	Required	Description
**page	Any		no	Pagination options passed to the listing: limit (maximum number of items per page) and cursor (the next_cursor of the previous page). Iterating the returned page follows every cursor.

Returns: Any. Decoded JSON answer of the operation "List the policy decisions".

Raises: the typed errors of the transport (Errors).

PoliciesClient.delete

delete(policy_id: str) -> Any

Delete a policy. Deletes the policy and appends a delete revision. An OPA policy pushed directly to OPA is removed from it too (503 policy_engine_unavailable when OPA cannot be reached). Needs tenant_admin or security_officer. Writes the audit event policy.delete. Answers 204, or 404 not_found.

Route: /v1/policies/{policy_id} (DELETE).

Name	Type	Default	Required	Description
policy_id	str		yes	Identifier (UUID) of the policy.

Returns: Any. Decoded JSON answer of the operation "Delete a policy".

Raises: the typed errors of the transport (Errors).

PoliciesClient.diff

diff(policy_id: str, from_revision: int | None = None, to_revision: int | None = None) -> Any

Compare two revisions of a policy. Returns the differences between two revisions of the policy. Defaults: the previous revision against the latest one. The policy is looked up first (404 not_found), then the revisions (404 not_found). Needs tenant_admin, security_officer, auditor or developer.

Route: /v1/policies/{policy_id}/revisions/diff (GET).

Name	Type	Default	Required	Description
policy_id	str		yes	Identifier (UUID) of the policy.
from_revision	int | None	None	no	Older revision number (1 or more). Default: the one before to_revision.
to_revision	int | None	None	no	Newer revision number (1 or more). Default: the latest.

Returns: Any. Decoded JSON answer of the operation "Compare two revisions of a policy".

Raises: the typed errors of the transport (Errors).

PoliciesClient.download_bundle

download_bundle(revision: str) -> Any

Download an OPA bundle. Returns the bundle OPA polls, as application/gzip: Rego modules, optional data.json, .manifest and .signatures.json (RS256 JWT over the SHA-256 of every file). The ETag header is its SHA-256 and X-Bundle-Revision its revision. Needs tenant_admin, security_officer or auditor. Answers 404 not_found for an unknown revision.

Route: /v1/policies/bundles/{revision}/bundle.tar.gz (GET).

Name	Type	Default	Required	Description
revision	str		yes	Revision of the bundle, or current for the latest published one.

Returns: Any. Decoded JSON answer of the operation "Download an OPA bundle".

Raises: the typed errors of the transport (Errors).

PoliciesClient.engines

engines() -> Any

Get the policy engines status. Returns the policy services (builtin engine, OPA, OpenFGA) and the policy version or bundle revision each one really runs, read from the engine itself. Needs tenant_admin, security_officer or auditor.

Route: /v1/policies/engines (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "Get the policy engines status".

Raises: the typed errors of the transport (Errors).

PoliciesClient.evaluate

evaluate(request: dict[str, Any]) -> Any

Evaluate a policy request. Returns the decision for a Policy Contract request. The body is a Policy Contract ({schema_version, request}) or just its request object (subject, action, resource, context); it is validated against the policy-contract contract (422 validation_error).

Route: /v1/policies/evaluate (POST).

Name	Type	Default	Required	Description
request	dict[str, Any]		yes	Policy Contract document, or its request object alone.

Returns: Any. Decoded JSON answer of the operation "Evaluate a policy request".

Raises: the typed errors of the transport (Errors).

PoliciesClient.get

get(policy_id: str) -> Any

Get a policy. Returns one policy. Open to any member of the tenant. Answers 404 not_found.

Route: /v1/policies/{policy_id} (GET).

Name	Type	Default	Required	Description
policy_id	str		yes	Identifier (UUID) of the policy.

Returns: Any. Decoded JSON answer of the operation "Get a policy".

Raises: the typed errors of the transport (Errors).

PoliciesClient.list

list(**page: Any) -> Any

List the policies. Lists the policies of the tenant in evaluation order (priority, then name), with their rules or Rego. Open to any member of the tenant. next_cursor is always null.

Route: /v1/policies (GET).

Name	Type	Default	Required	Description
**page	Any		no	Pagination options passed to the listing: limit (maximum number of items per page) and cursor (the next_cursor of the previous page). Iterating the returned page follows every cursor.

Returns: Any. Decoded JSON answer of the operation "List the policies".

Raises: the typed errors of the transport (Errors).

PoliciesClient.list_bundles

list_bundles() -> Any

List the OPA bundles. Lists the OPA bundles published for the tenant: revision, SHA-256, signature state, policies included and date. Needs tenant_admin, security_officer or auditor.

Route: /v1/policies/bundles (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the OPA bundles".

Raises: the typed errors of the transport (Errors).

PoliciesClient.replace

replace(policy_id: str, policy: dict[str, Any]) -> Any

Replace a policy. Replaces every field of the policy and appends an update revision. Same validation as at creation (rego for opa, unique name). An opa policy is pushed to OPA unless OPA loads bundles. Needs tenant_admin or security_officer. Writes the audit event policy.update. Answers 404 not_found for an unknown policy.

Route: /v1/policies/{policy_id} (PUT).

Name	Type	Default	Required	Description
policy_id	str		yes	Identifier (UUID) of the policy.
policy	dict[str, Any]		yes	Full Policy Contract document replacing the current one.

Returns: Any. Decoded JSON answer of the operation "Replace a policy".

Raises: the typed errors of the transport (Errors).

PoliciesClient.revisions

revisions(policy_id: str) -> Any

List the revisions of a policy. Lists the immutable revisions of the policy (one per create, update and delete, written in the same transaction), with their number, operation, author, date and content. Needs tenant_admin, security_officer, auditor or developer. Answers 404 not_found.

Route: /v1/policies/{policy_id}/revisions (GET).

Name	Type	Default	Required	Description
policy_id	str		yes	Identifier (UUID) of the policy.

Returns: Any. Decoded JSON answer of the operation "List the revisions of a policy".

Raises: the typed errors of the transport (Errors).

PoliciesClient.simulate

simulate(candidate: dict[str, Any], policy_id: str | None = None, inputs: list[dict[str, Any]] | None = None, recorded: bool | None = None) -> Any

Simulate a candidate policy. Compares, input by input, the decisions of the active policies with those of the same set where the candidate replaces policy_id (or is added). Nothing is changed.

Route: /v1/policies/simulate (POST).

Name	Type	Default	Required	Description
candidate	dict[str, Any]		yes	Candidate policy, engine builtin.
policy_id	str | None	None	no	Policy the candidate replaces; null to add it to the active set.
inputs	list[dict[str, Any]] | None	None	no	Policy Contract requests {subject, action, resource, context} to decide, at most 200. Without subject, the caller is used.
recorded	bool | None	None	no	Also replay the last N recorded decisions, 0 to 500 (default 0).

Returns: Any. Decoded JSON answer of the operation "Simulate a candidate policy".

Raises: the typed errors of the transport (Errors).

Class RiskClient

/v1/risk: assessments, controls, exceptions, evidence.

Resource

RiskClient.create_assessment

create_assessment(assessment: dict[str, Any]) -> Any

Assess the risk of an AI system. Classifies the target under the EU AI Act and records the assessment. Needs tenant_admin, security_officer, developer or ai_governance_officer; the status approved needs tenant_admin, security_officer or ai_governance_officer (403 forbidden).

Route: /v1/risk/assessments (POST).

Name	Type	Default	Required	Description
assessment	dict[str, Any]		yes	Risk assessment to create, sent as the request body.

Returns: Any. Decoded JSON answer of the operation "Assess the risk of an AI system".

Raises: the typed errors of the transport (Errors).

RiskClient.create_control

create_control(control: dict[str, Any]) -> Any

Adopt or update a control. Creates or updates the control of the given code. For a catalogue code, the title and frameworks default to the catalogue ones. Needs tenant_admin or security_officer. Errors 400 invalid_request: status other than planned, implemented, partially_implemented or not_applicable; no title for a custom code; a framework other than iso_42001, nist_ai_rmf, gdpr or eu_ai_act. Evidence given is added. Writes the audit event risk.control.upsert.

Route: /v1/risk/controls (POST).

Name	Type	Default	Required	Description
control	dict[str, Any]		yes	Risk control to create, sent as the request body.

Returns: Any. Decoded JSON answer of the operation "Adopt or update a control".

Raises: the typed errors of the transport (Errors).

RiskClient.create_exception

create_exception(exception: dict[str, Any]) -> Any

Request a control exception. Records a time limited exception on a control (control_id or control_code) or on a target (target_ref). Needs tenant_admin, security_officer or developer.

Route: /v1/risk/exceptions (POST).

Name	Type	Default	Required	Description
exception	dict[str, Any]		yes	Risk exception to create, sent as the request body.

Returns: Any. Decoded JSON answer of the operation "Request a control exception".

Raises: the typed errors of the transport (Errors).

RiskClient.evidence

evidence(**filters: Any) -> Any

Get the compliance evidence. Returns the evidence recorded on controls and assessments, newest first, plus evidence collected automatically from the platform and mapped to the catalogue controls: counts of agents, tools, models, assessments, enabled DLP rules and retention policies, keys, audit events and exports with the state of the audit chain, evaluations, red team runs, incidents and approvals. Open to any member of the tenant.

Route: /v1/risk/evidence (GET).

Name	Type	Default	Required	Description
**filters	Any		no	Query parameters of the evidence listing, sent as is.

Returns: Any. Decoded JSON answer of the operation "Get the compliance evidence".

Raises: the typed errors of the transport (Errors).

RiskClient.list_assessments

list_assessments(**page: Any) -> Any

List the risk assessments. Lists the assessments of the tenant, newest first, at most 500, optionally for one target. Each item gives the target, eu_ai_act_category (also as risk_level), use cases, answers, rationale, obligations, status and owner. Open to any member of the tenant. next_cursor is always null.

Route: /v1/risk/assessments (GET).

Name	Type	Default	Required	Description
**page	Any		no	Pagination options passed to the listing: limit (maximum number of items per page) and cursor (the next_cursor of the previous page). Iterating the returned page follows every cursor.

Returns: Any. Decoded JSON answer of the operation "List the risk assessments".

Raises: the typed errors of the transport (Errors).

RiskClient.list_controls

list_controls(**page: Any) -> Any

List the controls. Lists the controls adopted by the tenant, ordered by code, each with evidence_count, its exceptions and active_exceptions, and the builtin catalog with adopted telling which ones the tenant uses. Open to any member of the tenant.

Route: /v1/risk/controls (GET).

Name	Type	Default	Required	Description
**page	Any		no	Pagination options passed to the listing: limit (maximum number of items per page) and cursor (the next_cursor of the previous page). Iterating the returned page follows every cursor.

Returns: Any. Decoded JSON answer of the operation "List the controls".

Raises: the typed errors of the transport (Errors).

RiskClient.list_exceptions

list_exceptions(status: str | None = None) -> Any

List the exceptions. Lists the exceptions of the tenant ordered by expiry, each with its computed status: active, expired or revoked. Open to any member of the tenant. next_cursor is always null.

Route: /v1/risk/exceptions (GET).

Name	Type	Default	Required	Description
status	str | None	None	no	Only the exceptions in this status: active, expired or revoked.

Returns: Any. Decoded JSON answer of the operation "List the exceptions".

Raises: the typed errors of the transport (Errors).

Class IncidentsClient

/v1/incidents and response actions (suspend agent/model/provider, rotate key).

Resource

IncidentsClient.act

act(incident_id: str, action: str, target: str, reason: str | None = None, **extra: Any) -> Any

Run a containment action. Runs a containment action through the domain that owns the target and records it on the incident. Needs tenant_admin or security_officer.

Route: /v1/incidents/{incident_id}/actions (POST).

Name	Type	Default	Required	Description
incident_id	str		yes	Identifier (UUID) of the incident.
action	str		yes	suspend_agent, resume_agent, kill_agent, suspend_model, disable_model, disable_provider, rotate_key or revoke_key.
target	str		yes	Target of the action: id or name (or model_id), plus scope, kind or grace_seconds depending on the action.
reason	str | None	None	no	Why the action is taken, passed to the owning domain and kept in the trail. Default: incident action <action>.
**extra	Any		no	Extra fields merged into the request body.

Returns: Any. Decoded JSON answer of the operation "Run a containment action".

Raises: the typed errors of the transport (Errors).

IncidentsClient.create

create(title: str, severity: str, **extra: Any) -> Any

Open an incident. Opens an incident in status open, adds the created entry to the timeline and forwards it to the SIEM. Needs tenant_admin, security_officer, developer or agent. An unknown severity answers 400 invalid_request. Writes the audit event incident.create. The answer (201) carries the incident with its timeline.

Route: /v1/incidents (POST).

Name	Type	Default	Required	Description
title	str		yes	Title, 3 to 300 characters.
severity	str		yes	sev1 (most severe) to sev4; the aliases critical, high, medium and low are accepted. Default sev3.
**extra	Any		no	Extra fields merged into the request body.

Returns: Any. Decoded JSON answer of the operation "Open an incident".

Raises: the typed errors of the transport (Errors).

IncidentsClient.get

get(incident_id: str) -> Any

Get an incident. Returns the incident with its timeline (kind, message, data, actor, date) and its containment actions (action, target, status, result). Open to any member of the tenant. Answers 404 not_found.

Route: /v1/incidents/{incident_id} (GET).

Name	Type	Default	Required	Description
incident_id	str		yes	Identifier (UUID) of the incident.

Returns: Any. Decoded JSON answer of the operation "Get an incident".

Raises: the typed errors of the transport (Errors).

IncidentsClient.list

list(**page: Any) -> Any

List the incidents. Lists the incidents of the tenant, newest identifier first, paginated, optionally filtered by status and severity. Items do not carry the timeline nor the actions (read one incident for those). Open to any member of the tenant.

Route: /v1/incidents (GET).

Name	Type	Default	Required	Description
**page	Any		no	Pagination options passed to the listing: limit (maximum number of items per page) and cursor (the next_cursor of the previous page). Iterating the returned page follows every cursor.

Returns: Any. Decoded JSON answer of the operation "List the incidents".

Raises: the typed errors of the transport (Errors).

IncidentsClient.receive_alerts

receive_alerts(payload: dict[str, Any]) -> Any

Receive Alertmanager alerts. Webhook receiver of Prometheus Alertmanager (payload version 4). Each alert is keyed by its fingerprint:

Route: /v1/incidents/alerts (POST).

Name	Type	Default	Required	Description
payload	dict[str, Any]		yes	Alertmanager webhook payload, at most 500 alerts.

Returns: Any. Decoded JSON answer of the operation "Receive Alertmanager alerts".

Raises: the typed errors of the transport (Errors).

IncidentsClient.update

update(incident_id: str, **changes: Any) -> Any

Update an incident. Changes the status, severity or assignee and optionally adds a note. Each change is added to the timeline and forwarded to the SIEM; moving to resolved or closed sets resolved_at. Needs tenant_admin or security_officer. An unknown status or severity answers 400 invalid_request. Writes the audit event incident.update.

Route: /v1/incidents/{incident_id} (PATCH).

Name	Type	Default	Required	Description
incident_id	str		yes	Identifier (UUID) of the incident.
**changes	Any		no	Fields of the incident to change, sent as the PATCH body.

Returns: Any. Decoded JSON answer of the operation "Update an incident".

Raises: the typed errors of the transport (Errors).

Class GovernanceClient

/v1/governance/registry: agents, models, tools, owners and risk in one view.

Resource

GovernanceClient.registry

registry(**filters: Any) -> Any

Read the governance registry. Inventory of agents, models, providers, tools, skills, plugins and connectors (5000 items per kind at most, by name), one list per kind (agents, models, ...), with a summary per kind: total, count by status, count by risk level (unassessed when none) and number of items without owner. missing_sources lists the tables not installed on this instance; their list is empty. Requires a tenant principal (403 tenant_required). An unknown kind answers 400 invalid_request with the allowed kinds.

Route: /v1/governance/registry (GET).

Name	Type	Default	Required	Description
**filters	Any		no	Query parameters of the registry listing, sent as is.

Returns: Any. Decoded JSON answer of the operation "Read the governance registry".

Raises: the typed errors of the transport (Errors).

Functions

policy_request

policy_request(action: str, resource: dict[str, Any], context: dict[str, Any] | None = None, subject: dict[str, Any] | None = None) -> dict[str, Any]

A policy evaluation request: who (subject, defaults to the caller), what, on which resource.

Name	Type	Default	Required	Description
action	str		yes	Action to evaluate, for example tool.invoke.
resource	dict[str, Any]		yes	Resource the action is about, as a dict.
context	dict[str, Any] | None	None	no	Extra input of the policy (default {}).
subject	dict[str, Any] | None	None	no	Subject of the decision; left out to evaluate for the caller.

Returns: dict[str, Any]. Dict {action, resource, context, subject?} for PoliciesClient.evaluate.