Sign in

v1

latestOpenAPI 3.0.32026-07-22238629559.2 KB
PoliciesV2Service

Preview a detection policy apply

Validates a candidate detection policy bundle and returns the diff a strict apply would produce, without changing anything. The response includes the state_version the diff was computed against; send that exact value as If-Match on the follow-up PUT to guarantee you apply the diff you previewed.

post/api/policies/v2/deployments/{deploymentId}/detection-policy/{product}:dryRun

Path parameters

deploymentIdinteger required

The unique numerical identifier for the deployment.

Example:1234
productstring required

The product the candidate bundle applies to. One of: code, secrets.

Example:code

Request body

Example request

{
  "bundle": {
    "deployment_slug": "my-org",
    "product": "code",
    "rulesets": [
      "p/owasp-top-10",
      "p/cwe-top-25"
    ],
    "rules": [
      "python.lang.security.audit.dangerous-system-call"
    ],
    "disabled": [
      "python.lang.security.audit.dangerous-eval"
    ],
    "exceptions": [
      {
        "exception_type": "exclude",
        "project": "my-org/legacy-svc",
        "project_tag_name": "segment",
        "rule": "python.lang.security.audit.dangerous-system-call",
        "rule_type": "rule"
      }
    ]
  }
}

Response

OK

state_versionstring

The state_version the diff was computed against. Send this exact value as the If-Match header on the follow-up PUT.

Example response

{
  "creates": [
    {
      "kind": "DetectionPolicyException",
      "key": {
        "product": "code",
        "scope_type": "project_tag",
        "scope_target": "segment",
        "rule": "python.lang.security.audit.dangerous-system-call",
        "rule_type": "rule"
      },
      "before": {
        "exception_type": "exclude"
      },
      "after": {
        "exception_type": "exclude"
      }
    }
  ],
  "updates": [
    {
      "kind": "DetectionPolicyException",
      "key": {
        "product": "code",
        "scope_type": "project_tag",
        "scope_target": "segment",
        "rule": "python.lang.security.audit.dangerous-system-call",
        "rule_type": "rule"
      },
      "before": {
        "exception_type": "exclude"
      },
      "after": {
        "exception_type": "exclude"
      }
    }
  ],
  "deletes": [
    {
      "kind": "DetectionPolicyException",
      "key": {
        "product": "code",
        "scope_type": "project_tag",
        "scope_target": "segment",
        "rule": "python.lang.security.audit.dangerous-system-call",
        "rule_type": "rule"
      },
      "before": {
        "exception_type": "exclude"
      },
      "after": {
        "exception_type": "exclude"
      }
    }
  ],
  "state_version": "a1b2c3d4",
  "validation_errors": [
    {
      "code": "UNSUPPORTED_ACTION_TYPE"
    }
  ]
}