Skip to content
KataraKatara documentation

Publish a signed immutable policy version

POST
/katara/v1/orgs/{org_id}/environments/{environment_id}/policies
curl --request POST \
  --url https://api.katara.com/katara/v1/orgs/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/environments/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/policies \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: example' \
  --header 'X-Katara-CSRF: 1' \
  --data '{ "name": "example", "rules": { "allowed_kinds": [ "tool" ], "allowed_origins": [ "https://example.com" ], "approval_effects": [ "read_only" ], "detector_failure": "deny" }, "approval": { "stages": [ { "team_ids": [ "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" ], "quorum": 1, "exclude_requester": true, "exclude_previous_approvers": true, "require_recent_auth_seconds": 1, "require_mfa": true } ], "expires_in_seconds": 1, "on_expiry": "deny" }, "parent": { "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "version": 1, "integrity": "example" }, "expected_environment_epoch": 1, "expected_reset_generation": 1 }'

Requires the reviewed expected_environment_epoch and expected_reset_generation. Both are checked against locked current environment authority before publication. Retain the exact body and idempotency key after an uncertain response; do not replace the reviewed pins.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
org_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
environment_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000

Header Parameters

Section titled “Header Parameters”
Idempotency-Key
required
string
/^[A-Za-z0-9._:-]{8,128}$/
X-Katara-CSRF
Allowed value: 1

Browser cookie mutations require value 1 and an allowed Origin. Session bearer clients may omit this header.

X-Katara-Account-ID
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Required for cookie-authenticated changes. Use the UUID of the account that loaded the application. A different current cookie account returns account_changed before the handler runs. Session bearer and API key clients do not require this header.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
name
required
string
>= 1 characters <= 120 characters /.*\S.*/
rules
required
object
allowed_kinds
required
Array
>= 1 items <= 5 items unique items
Allowed values: tool inference sandbox evaluation memory
allowed_origins
required
Array<string>
<= 100 items unique items
approval_effects
required
Array
<= 3 items unique items
Allowed values: read_only idempotent_write non_idempotent_write
detector_failure
required
Allowed values: deny require_approval
approval
required
object
stages
required
Array<object>
>= 1 items <= 16 items
object
team_ids
required
Array<string>
>= 1 items <= 32 items unique items
quorum
required
integer
>= 1 <= 32
exclude_requester
required
exclude_previous_approvers
required
boolean
require_recent_auth_seconds
required
integer
>= 60 <= 3600
require_mfa
required
boolean
expires_in_seconds
required
integer
>= 60 <= 604800
on_expiry
required
Allowed value: deny
parent
object
id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
version
required
integer
>= 1 <= 9223372036854776000
integrity
required
string
/^sha256:[a-f0-9]{64}$/
expected_environment_epoch
required
integer
>= 1 <= 9007199254740991
expected_reset_generation
required
integer
>= 1 <= 9007199254740991

Responses

Section titled “Responses”

201

Section titled “201”

Successful request

Media typeapplication/json
object
operation_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
resource_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
completed
required
boolean
Examplegenerated
{
  "operation_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "resource_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "completed": true
}

409

Section titled “409”

Account_changed: reload and review with the signed-in account.

default

Section titled “default”

Request error

Media typeapplication/json
object
error
required
object
message
required
string
>= 1 characters <= 500 characters
type
required
string
>= 1 characters <= 100 characters
code
required

Stable; branch on it. Any operation can answer invalid_request, with param naming the refused field when there is one; human_session_required, when an API key, service account or workload calls an operation only a signed-in person may perform; reauthentication_required, when a person’s sign-in is too old for the operation; permission_denied; route_not_found and method_not_allowed, when no operation matches the path or method; and feature_unavailable, when the operation’s service is not enabled on this deployment.

string
>= 1 characters <= 100 characters
param
required

The request field a refusal is about, such as the agent_id or run_id query parameter; null when the refusal is not about one field.

string | null
request_id
required
string
>= 1 characters <= 100 characters
upstream_status
required
integer | null
action
Allowed values: sign_in reauthenticate request_access review fund retry reconcile refresh support
operation_id
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
snapshot_ref
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
Example
{
  "error": {
    "action": "sign_in"
  }
}