Policy / rules endpoints

The cloud is the source of truth for policy — read and write. Collectors pull the published policy and enforce it locally. All paths are tenant-scoped and under /api.

GET /policy

The currently active policy bundle, with per-rule hit counts in the last window:

{
  "name":           "default",
  "version":        1,
  "default_action": "allow",
  "rules": [
    {
      "name":        "redact_secrets_on_egress",
      "action":      "redact",
      "match":       { "contains_secret": true },
      "reason":      "credential detected in outbound payload — masking before send",
      "hit_count":   1842
    }
  ]
}

Writes

• PUT /policy — replace the whole policy bundle.
• POST /policy/rules — add a rule.
• PUT /policy/rules/{name} — update a rule.
• DELETE /policy/rules/{name} — remove a rule.
• POST /policy/rules/reorder — reorder by name.

The Policy Rules and rule-editor pages in the console call these. Saved changes are pulled by collectors on their next cycle.