---
title: "Get the detection policy summary"
method: GET
path: "/api/policies/v2/deployments/{deploymentId}/detection-policy"
tags: ["PoliciesV2Service"]
---

# Get the detection policy summary

`GET /api/policies/v2/deployments/{deploymentId}/detection-policy`

Returns the detection policy bundles and state_versions for every enabled product in one read-only call. Writes always go through the per-product endpoints.

## Path parameters

- `deploymentId` integer, required — The unique numerical identifier for the deployment.

## Response `200`

OK

- ProtosPoliciesV2GetDetectionPolicySummaryResponse
  - `deployment_slug` string — The slug of the deployment.
  - `code` ProtosPoliciesV2DetectionPolicyState — A detection policy bundle paired with its state_version, as returned by the read-only summary endpoint.
    - `bundle` ProtosPoliciesV2DetectionPolicyBundle — The full declared detection state for one product. A strict apply replaces the entire bundle: rule selection is overwritten and exceptions absent from the bundle are deleted.
      - `deployment_slug` string — Output only. The slug of the deployment the bundle belongs to. Ignored when sent in a request body.
      - `product` string — The product the bundle applies to. One of: `code`, `secrets`. Optional in request bodies; when present it must match the product in the URL.
      - `rulesets` string[] — Registry ruleset paths that run deployment-wide, for example `p/owasp-top-10`. Must be empty when product is `secrets`.
      - `rules` string[] — Registry rule paths added individually, on top of the selected rulesets.
      - `disabled` string[] — Registry rule paths from the selected rulesets that are explicitly turned off.
      - `exceptions` ProtosPoliciesV2DetectionPolicyException[] — Per-project or per-tag include/exclude exceptions to the deployment-wide rule selection.
        - `exception_type` string, required — Whether the exception forces the rule to run (`include`) or skips it (`exclude`) on the targeted scope.
        - `project` string — The name of the project the exception targets. Mutually exclusive with project_tag_name.
        - `project_tag_name` string — The name of the project tag the exception targets. Treat tag names as opaque strings: they may contain spaces and special characters. Mutually exclusive with project.
        - `rule` string, required — The registry path of the rule or rule pack the exception applies to.
        - `rule_type` string, required — Whether rule refers to a single rule (`rule`) or a rule pack (`pack`).
    - `state_version` string — The state_version of the bundle. Send it as the If-Match header on a PUT to the product's detection policy endpoint.
  - `secrets` ProtosPoliciesV2DetectionPolicyState — A detection policy bundle paired with its state_version, as returned by the read-only summary endpoint.
    - `bundle` ProtosPoliciesV2DetectionPolicyBundle — The full declared detection state for one product. A strict apply replaces the entire bundle: rule selection is overwritten and exceptions absent from the bundle are deleted.
      - `deployment_slug` string — Output only. The slug of the deployment the bundle belongs to. Ignored when sent in a request body.
      - `product` string — The product the bundle applies to. One of: `code`, `secrets`. Optional in request bodies; when present it must match the product in the URL.
      - `rulesets` string[] — Registry ruleset paths that run deployment-wide, for example `p/owasp-top-10`. Must be empty when product is `secrets`.
      - `rules` string[] — Registry rule paths added individually, on top of the selected rulesets.
      - `disabled` string[] — Registry rule paths from the selected rulesets that are explicitly turned off.
      - `exceptions` ProtosPoliciesV2DetectionPolicyException[] — Per-project or per-tag include/exclude exceptions to the deployment-wide rule selection.
        - `exception_type` string, required — Whether the exception forces the rule to run (`include`) or skips it (`exclude`) on the targeted scope.
        - `project` string — The name of the project the exception targets. Mutually exclusive with project_tag_name.
        - `project_tag_name` string — The name of the project tag the exception targets. Treat tag names as opaque strings: they may contain spaces and special characters. Mutually exclusive with project.
        - `rule` string, required — The registry path of the rule or rule pack the exception applies to.
        - `rule_type` string, required — Whether rule refers to a single rule (`rule`) or a rule pack (`pack`).
    - `state_version` string — The state_version of the bundle. Send it as the If-Match header on a PUT to the product's detection policy endpoint.

---

[API](https://skmtc.net/semgrep/apis/semgrep-web-app.md) · [All operations](https://skmtc.net/semgrep/apis/semgrep-web-app/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/semgrep/semgrep-web-app/versions/6483eeecd582/schema)