--- title: "GetPolicyTemplate" method: GET path: "/v1/namespaces/{tenant_meta.namespace}/policy-templates/{uuid}" tags: ["PolicyTemplateService"] --- # GetPolicyTemplate `GET /v1/namespaces/{tenant_meta.namespace}/policy-templates/{uuid}` Fetches the policy template identified by the UUID. ## Path parameters - `tenant_meta.namespace` string, required - `uuid` string, required ## Query parameters - `get_parameters.mask` string ## Response `200` A successful response. - V1PolicyTemplate — PolicyTemplate represents a policy system in the system. Policy templates can be used to create policies from these templates. - `meta` V1Meta, required — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `propagate` boolean — Whether the object should be visible in child namespaces or not. - `spec` V1PolicyTemplateSpec, required - `admission` PolicyAdmissionAction - `bypass_exceptions` boolean — Set to true if exception policies should be ignored for findings matching this policy. - `disable_enforcement` boolean — If disable_enforcement is set the policy will just log the result and not enforce an action. This allows debugging and observation of the system. - `default_enabled` boolean — True if generated out-of-the-box policy is enabled by default (unless Policy.AutoEnable is explicitly disabled in SystemConfig). Default user finding policies are also generated for new tenants if this flag is set to true. - `deprecated` boolean — Set to True if the policy template has been deprecated. Policies created from deprecated templates are never deleted, but the template is no longer visible in the UI. - `finding` PolicyFindingAction - `categories` V1FindingCategory[] — List of categories that capture the use cases the finding fits in. For policy templates, this is used as the default value but it can be changed. - `explanation` string, required — Explanation provides information about the reason this is considered noteworthy. For policy templates this is used as the default value but it can be changed to any free form string. - `external_name` string — External finding name. For policy templates this is used as the default value but it can be changed to any free form string. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW', required — Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `meta_tags` string[] — Additional meta tags for the finding that is created. - `remediation` string, required — Remediation instructions. For policy templates this is used as the default value but it can be changed to any free form string. - `summary` string, required — Summary of the finding that is created. For policy templates this is used as the default value but it can be changed to any free form string. - `tags` V1FindingTags[] — Additional tags for the finding that is created. For policy templates, this is used as the default value but it can be changed. - `target_kind` string — Repository, RepositoryVersion, or PackageVersion. This is usually the same as the finding parent kind. - `finding_categories` V1FindingCategory[] — List of finding categories that the policy creates or acts on findings for. This field can be used to group policy templates. - `finding_level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW' — Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `group_by_fields` string[] — Custom fields to group policy output by. This may be a subset of all custom keys in the policy output. You do not need to add all custom fields here. You can add just the custom fileds you want to be used to group the matches by. The corresponding values are always treated as a single string. - `policy_type` 'POLICY_TYPE_UNSPECIFIED' | 'POLICY_TYPE_ADMISSION' | 'POLICY_TYPE_NOTIFICATION' | 'POLICY_TYPE_FINDING' | 'POLICY_TYPE_FINDING_CFG' | 'POLICY_TYPE_ML_FINDING' | 'POLICY_TYPE_SYSTEM_FINDING' | 'POLICY_TYPE_USER_FINDING' | 'POLICY_TYPE_EXCEPTION' | 'POLICY_TYPE_REMEDIATION', required — - POLICY_TYPE_ADMISSION: POLICY_TYPE_ADMISSION will admit/reject pipeline runs. Admission policies operate on Findings and are run during a CI/CD pipeline. They may return data such as the uuids of findings that violate the policy. - POLICY_TYPE_NOTIFICATION: POLICY_TYPE_NOTIFICATION is for policies that generate notifications. - POLICY_TYPE_ML_FINDING: ML finding policies enable or disable algorithmic findings. Note that there is no input data for these policies, they always return output, and the allowed value is ignored. - POLICY_TYPE_SYSTEM_FINDING: A system finding policy is created from a system policy template. It processes data and creates new findings. System finding policies are run together with user and ML (a.k.a. algorithmic) findings. System finding policies can only be enabled, disabled, and edited. They cannot be created or deleted. - POLICY_TYPE_USER_FINDING: A user finding policy is created from scratch or from a customer policy template. It processes data and creates new findings. User finding policies are run together with system and ML (a.k.a. algorithmic) findings. User finding policies can be created, enabled, disabled, edited, and deleted. - POLICY_TYPE_EXCEPTION: An exception policy identifies findings which should be excluded from admission and notification policies. It is created from scratch or from an exception policy template. - POLICY_TYPE_REMEDIATION: A remediation policy identifies findings which should be remediated. It is created from scratch or from a remediation policy template. - `query_statements` string[], required — The list of OPA query statements that must be executed to evaluate the resulting policy. For example, [ "data.packagename.allow" ]. - `release_notes` object — Release notes indexed by template version. - `resource_kinds` string[] — The additional resources that a policy requires. By default, policies are executed against Project, Repository, RepositoryVersion, PackageVersion, Metric and Finding. If a policy must include additional objects they must be defined here. - `rule` string, required — The policy template rule in text format. For example: package policyexample default allow = false allow { input.Value1 = input.Value2 } - `template_parameters` PolicyTemplateParameter[] — The list of values to customize the template. In the example above, Value1 and Value2. - `default_values` string[] — List of default values, if applicable. Used by the UI to pre-populate input values. - `description` string, required — The description of the field. - `multiple_ok` boolean — Is true if multiple possible values are allowed to be set as a list. - `name` string, required — The parameter name displayed to the user. - `possible_values` string[] — A list of possible values that are accepted by the template. Can be used by the UI as a selector. Ignored by UI if possible_values_from_db is set. - `possible_values_from_db` TemplateParameterQueryApiData — Information needed to get the list of possible values via the API. UI uses the meta.name and meta.description fields to present options. - `filter` string — Optional database filter for the list query (for example, "spec.origin==\"LINTER_RESULT_ORIGIN_SECRETS_SCANNER\""). - `input_field` string, required — Full name of field in resource object to use as input value to policy template (for example, "spec.sarif_result.rule_id" or "spec.license_id"). - `namespace` string — Optional value for the namespace to be used when retrieving the possible data values. - `resource_kind` string, required — Resource kind (for example, "LinterResult" or "License"). - `required` boolean — Set to true if the parameter must have an input value. - `value` string, required — The actual template parameter name and the key in the policy template_values map. - `version` string, required - `tenant_meta` V1TenantMeta — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The UUID of the policy template. ## Other responses - `default` — An unexpected error response. --- [API](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference.md) · [All operations](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/endorlabs/endor-labs-rest-api-reference/revisions/2fe1f84213b3/schema)