Activate a Policy version
POST /v1/policies/{policy_id}/versions/{version}/activate
| Property | Value |
|---|---|
| Operation | activate_policy_version |
| Group | Policies |
| Scope | policies:write |
| Route class | control |
| Idempotency | Idempotency-Key accepted: a retry with the same key replays the first answer |
| Audit | Audited policy.version.activate (mutation) |
| Released in | 1.47.0 |
| Phase 0 host | Served (the hosted api pins 1.65.0) |
Makes the version the active one and answers it. An agent-scoped change reaches Calls only through the next Agent version publish, which pins it; an organization-scoped one reaches the next Call. A Call never changes Policy versions mid-Call. It emits the Webhook event policy.version.activated. A write to an organization-scoped Policy, or one that disables a compliance-tagged Policy, also needs policies:admin and is otherwise refused with forbidden and the detail policies_admin_required.
Request
Set VOCAL_API to the base URL of your API and VOCAL_API_KEY to an API key with the policies:write scope (Authentication and keys). Replace each placeholder, such as agt_... or <name>, with your own value.
curl -X POST "$VOCAL_API/v1/policies/pol_.../versions/1/activate" \
-H "Authorization: Bearer $VOCAL_API_KEY" \
-H "Idempotency-Key: $(uuidgen)"const response = await fetch(`${process.env.VOCAL_API}/v1/policies/pol_.../versions/1/activate`, {
method: 'POST',
headers: {
Authorization: `Bearer ${process.env.VOCAL_API_KEY}`,
'Idempotency-Key': crypto.randomUUID(),
},
});
console.log(response.status, await response.text());import os
import uuid
import requests
response = requests.post(
f"{os.environ['VOCAL_API']}/v1/policies/pol_.../versions/1/activate",
headers={
"Authorization": f"Bearer {os.environ['VOCAL_API_KEY']}",
"Idempotency-Key": str(uuid.uuid4()),
},
)
print(response.status_code, response.text)Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
policy_id | path | PolicyId | yes | The id of a Policy: pol_ and the row's UUIDv7 in 26 Crockford base32 characters. Opaque and safe to log. |
version | path | integer | yes | A version number, from 1. |
idempotency-key | header | string | no | A client-chosen key, kept 24 hours per Organization, environment and route. A replay returns the stored response. |
Responses
| Status | Content type | Shape | Error codes |
|---|---|---|---|
200 | application/json | PolicyVersion | |
400 | application/json | ErrorEnvelope | invalid_request |
401 | application/json | ErrorEnvelope | unauthenticated |
403 | application/json | ErrorEnvelope | forbidden, org_suspended |
404 | application/json | ErrorEnvelope | not_found |
409 | application/json | ErrorEnvelope | policy_archived, idempotency_in_progress, idempotency_key_reused |
429 | application/json | ErrorEnvelope | rate_limited |
500 | application/json | ErrorEnvelope | internal_error |
Fields of the 200 answer
The shape is PolicyVersion.
| Field | Type | Required | Description |
|---|---|---|---|
action_type | PolicyActionType | yes | |
active | boolean | yes | True for the active version: the one Agent version publish pins, or, for an organization-scoped Policy, the one dispatch resolves. |
analysis | PolicyAnalysis | yes | |
compliance_tag | ComplianceTag or null | yes | |
engine_version | string | yes | The Zen engine version the version was published under; a worker refuses one it does not run with rules_engine_version_mismatch. |
hook | HookPoint | yes | |
logic | JdmDocument | yes | |
logic_sha256 | string | yes | The SHA-256 of the canonical document, in lowercase hex. |
notes | string or null | yes | |
object | "policy_version" | yes | |
policy_id | PolicyId | yes | |
priority | integer | yes | |
profile_version | integer | yes | The Vocal JDM profile version the document was linted under. |
published_at | Timestamp | yes | |
published_by | ActorRef | yes | |
source_revision | integer | yes | The draft revision this version was published from. |
status | PolicyVersionStatus | yes | |
version | integer | yes | The snapshot number, from 1. |