Versions

List versions of a policy set

GET/zones/{zone_id}/policy-sets/{policy_set_id}/versions

Create a new immutable policy set version

POST/zones/{zone_id}/policy-sets/{policy_set_id}/versions

Get a specific policy set version

GET/zones/{zone_id}/policy-sets/{policy_set_id}/versions/{version_id}

Activate a policy set version

PATCH/zones/{zone_id}/policy-sets/{policy_set_id}/versions/{version_id}

Archive a policy set version

DELETE/zones/{zone_id}/policy-sets/{policy_set_id}/versions/{version_id}

List policy versions in a policy set version

GET/zones/{zone_id}/policy-sets/{policy_set_id}/versions/{version_id}/policies

ModelsExpand Collapse

PolicySetVersion = object { id, created_at, created_by, 10 more }

id: string

created_at: string

formatdate-time

created_by: string

manifest: PolicySetManifest { entries }

entries: array of PolicySetManifestEntry { policy_id, policy_version_id, sha }

policy_id: string

policy_version_id: string

sha: optional string

SHA-256 of the policy version content, populated by the server

manifest_sha: string

Hex-encoded SHA-256 of the canonicalized manifest

owner_type: "platform" or "customer"

Who manages this policy set version:

"platform" — managed by the Keycard platform (system policy set versions).
"customer" — managed by the tenant (custom policy set versions).

Accepts one of the following:

"platform"

"customer"

policy_set_id: string

schema_version: string

Schema version pinned to this policy set version. Determines the Cedar schema used for evaluation when activated.

version: number

active: optional boolean

Whether this policy set version is currently bound with mode='active'

archived_at: optional string

formatdate-time

archived_by: optional string

attestation: optional AttestationStatement { attested_at, attested_by, key_id, 7 more }

Decoded content of an Attestation JWS payload. Describes the exact policy set version composition at attestation time. This schema defines what consumers see after base64url-decoding the Attestation.payload field.

attested_at: string

formatdate-time

attested_by: string

key_id: string

Key ID of the signing key used to produce the attestation signature. Matches the "kid" in the JWS protected header.

manifest_sha: string

SHA-256 of the policy set version manifest. Verifiers MUST check this matches the policy_set_version.manifest_sha to detect attestation/version mismatches.

policy_set_id: string

policy_set_version: number

status: "created" or "re_signed"

Event that produced this attestation. "created" is the initial attestation at version creation; "re_signed" is a re-attestation after key rotation (same content, new signature).

Accepts one of the following:

"created"

"re_signed"

type: "policy_set_attestation"

Statement type discriminator

v: 1

Statement schema version

zone_id: string