--- title: "Preview a remediation policies apply" method: POST path: "/api/policies/v2/deployments/{deploymentId}/remediation-policies:dryRun" tags: ["PoliciesV2Service"] --- # Preview a remediation policies apply `POST /api/policies/v2/deployments/{deploymentId}/remediation-policies:dryRun` Validates a candidate remediation policies bundle and returns the diff a strict apply would produce, without changing anything. The response includes the state_version the diff was computed against; send that exact value as If-Match on the follow-up PUT to guarantee you apply the diff you previewed. ## Path parameters - `deploymentId` integer, required — The unique numerical identifier for the deployment. ## Request body - ProtosPoliciesV2DryRunRemediationPoliciesRequest - `bundle` ProtosPoliciesV2RemediationPoliciesBundle, required — The full declared set of remediation policies for a deployment. A strict apply replaces the whole list: policies absent from the submitted bundle are deleted. System-managed policies never appear in the bundle and are never affected by an apply. - `deployment_slug` string — Output only. The slug of the deployment the bundle belongs to. Ignored when sent in a request body. - `policies` ProtosPoliciesV2RemediationPolicy[] — The remediation policies of the deployment. - `slug` string — The stable public identity of the policy. Immutable after create: renames change name but never slug. When omitted on create, it is derived from name; set it explicitly to pin a URL-safe identity independent of name. - `name` string, required — The display name of the policy. - `description` string — An optional free-form description of the policy. - `active` boolean — Whether the policy is evaluated. Defaults to `true` when omitted on create. - `filters` ProtosPoliciesV2RemediationPolicyFilters, required — How a remediation policy decides whether a finding matches. - `mode` string, required — How the conditions combine. One of: `all`, `any`. - `conditions` ProtosPoliciesV2RemediationPolicyCondition[] — The conditions evaluated against each finding. At least one condition is required. - `type` string, required — The condition type, for example `severity`, `confidence`, or `repository_tag`. The vocab endpoint lists the accepted types. - `values` string[], required — The values the condition matches against. - `mode` string — How multiple values combine. One of: `any`, `none`. `none` negates the condition (the finding must match none of the values). Defaults to `any`. - `actions` ProtosPoliciesV2RemediationPolicyAction[], required — The actions that fire when a finding matches. The list is replaced as a unit on update: any change to it is a single update of the policy. - `type` string, required — The action type. One of: `block`, `pr_comment`, `jira`, `slack_app`, `webhook`, `triage`. The vocab endpoint lists the accepted types and their companion requirements (for example, `block` requires `pr_comment` in the same policy). - `config` object — Action-specific configuration. Downstream resources are referenced by slug or name, never by numeric id. For example, a `jira` action takes `project_id` and `credential_slug`. ## Response `200` OK - ProtosPoliciesV2DryRunRemediationPoliciesResponse - `creates` ProtosPoliciesV2RemediationPolicyDiffEntry[] — Remediation policies that the apply would create. - `kind` string — The resource the entry refers to. Always `RemediationPolicy`. - `key` ProtosPoliciesV2RemediationPolicyDiffKey — The stable identity of a remediation policy in a diff. - `slug` string — The slug of the policy. - `before` ProtosPoliciesV2RemediationPolicy — A remediation policy: conditions that fire actions when a finding matches. - `slug` string — The stable public identity of the policy. Immutable after create: renames change name but never slug. When omitted on create, it is derived from name; set it explicitly to pin a URL-safe identity independent of name. - `name` string, required — The display name of the policy. - `description` string — An optional free-form description of the policy. - `active` boolean — Whether the policy is evaluated. Defaults to `true` when omitted on create. - `filters` ProtosPoliciesV2RemediationPolicyFilters, required — How a remediation policy decides whether a finding matches. - `mode` string, required — How the conditions combine. One of: `all`, `any`. - `conditions` ProtosPoliciesV2RemediationPolicyCondition[] — The conditions evaluated against each finding. At least one condition is required. - `type` string, required — The condition type, for example `severity`, `confidence`, or `repository_tag`. The vocab endpoint lists the accepted types. - `values` string[], required — The values the condition matches against. - `mode` string — How multiple values combine. One of: `any`, `none`. `none` negates the condition (the finding must match none of the values). Defaults to `any`. - `actions` ProtosPoliciesV2RemediationPolicyAction[], required — The actions that fire when a finding matches. The list is replaced as a unit on update: any change to it is a single update of the policy. - `type` string, required — The action type. One of: `block`, `pr_comment`, `jira`, `slack_app`, `webhook`, `triage`. The vocab endpoint lists the accepted types and their companion requirements (for example, `block` requires `pr_comment` in the same policy). - `config` object — Action-specific configuration. Downstream resources are referenced by slug or name, never by numeric id. For example, a `jira` action takes `project_id` and `credential_slug`. - `after` ProtosPoliciesV2RemediationPolicy — A remediation policy: conditions that fire actions when a finding matches. - `slug` string — The stable public identity of the policy. Immutable after create: renames change name but never slug. When omitted on create, it is derived from name; set it explicitly to pin a URL-safe identity independent of name. - `name` string, required — The display name of the policy. - `description` string — An optional free-form description of the policy. - `active` boolean — Whether the policy is evaluated. Defaults to `true` when omitted on create. - `filters` ProtosPoliciesV2RemediationPolicyFilters, required — How a remediation policy decides whether a finding matches. - `mode` string, required — How the conditions combine. One of: `all`, `any`. - `conditions` ProtosPoliciesV2RemediationPolicyCondition[] — The conditions evaluated against each finding. At least one condition is required. - `type` string, required — The condition type, for example `severity`, `confidence`, or `repository_tag`. The vocab endpoint lists the accepted types. - `values` string[], required — The values the condition matches against. - `mode` string — How multiple values combine. One of: `any`, `none`. `none` negates the condition (the finding must match none of the values). Defaults to `any`. - `actions` ProtosPoliciesV2RemediationPolicyAction[], required — The actions that fire when a finding matches. The list is replaced as a unit on update: any change to it is a single update of the policy. - `type` string, required — The action type. One of: `block`, `pr_comment`, `jira`, `slack_app`, `webhook`, `triage`. The vocab endpoint lists the accepted types and their companion requirements (for example, `block` requires `pr_comment` in the same policy). - `config` object — Action-specific configuration. Downstream resources are referenced by slug or name, never by numeric id. For example, a `jira` action takes `project_id` and `credential_slug`. - `updates` ProtosPoliciesV2RemediationPolicyDiffEntry[] — Remediation policies that the apply would update. - `kind` string — The resource the entry refers to. Always `RemediationPolicy`. - `key` ProtosPoliciesV2RemediationPolicyDiffKey — The stable identity of a remediation policy in a diff. - `slug` string — The slug of the policy. - `before` ProtosPoliciesV2RemediationPolicy — A remediation policy: conditions that fire actions when a finding matches. - `slug` string — The stable public identity of the policy. Immutable after create: renames change name but never slug. When omitted on create, it is derived from name; set it explicitly to pin a URL-safe identity independent of name. - `name` string, required — The display name of the policy. - `description` string — An optional free-form description of the policy. - `active` boolean — Whether the policy is evaluated. Defaults to `true` when omitted on create. - `filters` ProtosPoliciesV2RemediationPolicyFilters, required — How a remediation policy decides whether a finding matches. - `mode` string, required — How the conditions combine. One of: `all`, `any`. - `conditions` ProtosPoliciesV2RemediationPolicyCondition[] — The conditions evaluated against each finding. At least one condition is required. - `type` string, required — The condition type, for example `severity`, `confidence`, or `repository_tag`. The vocab endpoint lists the accepted types. - `values` string[], required — The values the condition matches against. - `mode` string — How multiple values combine. One of: `any`, `none`. `none` negates the condition (the finding must match none of the values). Defaults to `any`. - `actions` ProtosPoliciesV2RemediationPolicyAction[], required — The actions that fire when a finding matches. The list is replaced as a unit on update: any change to it is a single update of the policy. - `type` string, required — The action type. One of: `block`, `pr_comment`, `jira`, `slack_app`, `webhook`, `triage`. The vocab endpoint lists the accepted types and their companion requirements (for example, `block` requires `pr_comment` in the same policy). - `config` object — Action-specific configuration. Downstream resources are referenced by slug or name, never by numeric id. For example, a `jira` action takes `project_id` and `credential_slug`. - `after` ProtosPoliciesV2RemediationPolicy — A remediation policy: conditions that fire actions when a finding matches. - `slug` string — The stable public identity of the policy. Immutable after create: renames change name but never slug. When omitted on create, it is derived from name; set it explicitly to pin a URL-safe identity independent of name. - `name` string, required — The display name of the policy. - `description` string — An optional free-form description of the policy. - `active` boolean — Whether the policy is evaluated. Defaults to `true` when omitted on create. - `filters` ProtosPoliciesV2RemediationPolicyFilters, required — How a remediation policy decides whether a finding matches. - `mode` string, required — How the conditions combine. One of: `all`, `any`. - `conditions` ProtosPoliciesV2RemediationPolicyCondition[] — The conditions evaluated against each finding. At least one condition is required. - `type` string, required — The condition type, for example `severity`, `confidence`, or `repository_tag`. The vocab endpoint lists the accepted types. - `values` string[], required — The values the condition matches against. - `mode` string — How multiple values combine. One of: `any`, `none`. `none` negates the condition (the finding must match none of the values). Defaults to `any`. - `actions` ProtosPoliciesV2RemediationPolicyAction[], required — The actions that fire when a finding matches. The list is replaced as a unit on update: any change to it is a single update of the policy. - `type` string, required — The action type. One of: `block`, `pr_comment`, `jira`, `slack_app`, `webhook`, `triage`. The vocab endpoint lists the accepted types and their companion requirements (for example, `block` requires `pr_comment` in the same policy). - `config` object — Action-specific configuration. Downstream resources are referenced by slug or name, never by numeric id. For example, a `jira` action takes `project_id` and `credential_slug`. - `deletes` ProtosPoliciesV2RemediationPolicyDiffEntry[] — Remediation policies that the apply would delete. - `kind` string — The resource the entry refers to. Always `RemediationPolicy`. - `key` ProtosPoliciesV2RemediationPolicyDiffKey — The stable identity of a remediation policy in a diff. - `slug` string — The slug of the policy. - `before` ProtosPoliciesV2RemediationPolicy — A remediation policy: conditions that fire actions when a finding matches. - `slug` string — The stable public identity of the policy. Immutable after create: renames change name but never slug. When omitted on create, it is derived from name; set it explicitly to pin a URL-safe identity independent of name. - `name` string, required — The display name of the policy. - `description` string — An optional free-form description of the policy. - `active` boolean — Whether the policy is evaluated. Defaults to `true` when omitted on create. - `filters` ProtosPoliciesV2RemediationPolicyFilters, required — How a remediation policy decides whether a finding matches. - `mode` string, required — How the conditions combine. One of: `all`, `any`. - `conditions` ProtosPoliciesV2RemediationPolicyCondition[] — The conditions evaluated against each finding. At least one condition is required. - `type` string, required — The condition type, for example `severity`, `confidence`, or `repository_tag`. The vocab endpoint lists the accepted types. - `values` string[], required — The values the condition matches against. - `mode` string — How multiple values combine. One of: `any`, `none`. `none` negates the condition (the finding must match none of the values). Defaults to `any`. - `actions` ProtosPoliciesV2RemediationPolicyAction[], required — The actions that fire when a finding matches. The list is replaced as a unit on update: any change to it is a single update of the policy. - `type` string, required — The action type. One of: `block`, `pr_comment`, `jira`, `slack_app`, `webhook`, `triage`. The vocab endpoint lists the accepted types and their companion requirements (for example, `block` requires `pr_comment` in the same policy). - `config` object — Action-specific configuration. Downstream resources are referenced by slug or name, never by numeric id. For example, a `jira` action takes `project_id` and `credential_slug`. - `after` ProtosPoliciesV2RemediationPolicy — A remediation policy: conditions that fire actions when a finding matches. - `slug` string — The stable public identity of the policy. Immutable after create: renames change name but never slug. When omitted on create, it is derived from name; set it explicitly to pin a URL-safe identity independent of name. - `name` string, required — The display name of the policy. - `description` string — An optional free-form description of the policy. - `active` boolean — Whether the policy is evaluated. Defaults to `true` when omitted on create. - `filters` ProtosPoliciesV2RemediationPolicyFilters, required — How a remediation policy decides whether a finding matches. - `mode` string, required — How the conditions combine. One of: `all`, `any`. - `conditions` ProtosPoliciesV2RemediationPolicyCondition[] — The conditions evaluated against each finding. At least one condition is required. - `type` string, required — The condition type, for example `severity`, `confidence`, or `repository_tag`. The vocab endpoint lists the accepted types. - `values` string[], required — The values the condition matches against. - `mode` string — How multiple values combine. One of: `any`, `none`. `none` negates the condition (the finding must match none of the values). Defaults to `any`. - `actions` ProtosPoliciesV2RemediationPolicyAction[], required — The actions that fire when a finding matches. The list is replaced as a unit on update: any change to it is a single update of the policy. - `type` string, required — The action type. One of: `block`, `pr_comment`, `jira`, `slack_app`, `webhook`, `triage`. The vocab endpoint lists the accepted types and their companion requirements (for example, `block` requires `pr_comment` in the same policy). - `config` object — Action-specific configuration. Downstream resources are referenced by slug or name, never by numeric id. For example, a `jira` action takes `project_id` and `credential_slug`. - `state_version` string — The state_version the diff was computed against. Send this exact value as the If-Match header on the follow-up PUT. - `validation_errors` ProtosPoliciesV2BundleValidationError[] — Validation problems with the candidate bundle. When non-empty, the diff fields are empty and a strict apply would be rejected. - `code` string — A stable, machine-readable error code, for example `UNSUPPORTED_ACTION_TYPE` or `UNKNOWN_REFERENCE`. - `message` string — A human-readable explanation of the problem. - `policy_slug` string — The slug of the remediation policy the error applies to, when scoped to a single policy. Empty for bundle-wide errors. - `context` object — Structured detail for the error; the keys present depend on `code` (for example `action_type`, `missing_companion`, `condition_type`, `value`). --- [API](https://skmtc.net/semgrep/apis/semgrep-web-app.md) · [All operations](https://skmtc.net/semgrep/apis/semgrep-web-app/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/semgrep/semgrep-web-app/revisions/6483eeecd582/schema)