Versions

Create a new immutable policy set version

API Reference

Zones

Policy Sets

Versions

Create a new immutable policy set version

client.zones.policySets.versions.create(, , ?): PolicySetVersion { id, created_at, created_by, 10 more }

POST/zones/{zone_id}/policy-sets/{policy_set_id}/versions

Validates the manifest, computes SHA, and creates an immutable version snapshot.

ParametersExpand Collapse

policySetID: string

params: VersionCreateParams { zone_id, manifest, schema_version, 2 more }

zone_id: string

Path param: The zone identifier

manifest: PolicySetManifest { entries }

Body param

entries: Array<PolicySetManifestEntry { policy_id, policy_version_id, sha } >

policy_id: string

policy_version_id: string

sha?: string

SHA-256 of the policy version content, populated by the server

schema_version: string

Body param: Schema version to pin to this policy set version.

xAPIVersion?: string

Header param: API version header (date-based, e.g. 2026-02-01)

xClientRequestID?: string

Header param: Unique request identifier specified by the originating caller and passed along by proxies.

formatuuid

ReturnsExpand Collapse

PolicySetVersion { id, created_at, created_by, 10 more }

id: string

created_at: string

formatdate-time

created_by: string

manifest: PolicySetManifest { entries }

entries: Array<PolicySetManifestEntry { policy_id, policy_version_id, sha } >

policy_id: string

policy_version_id: string

sha?: string

SHA-256 of the policy version content, populated by the server

manifest_sha: string

Hex-encoded SHA-256 of the canonicalized manifest

owner_type: "platform" | "customer"

Who manages this policy set version:

"platform" — managed by the Keycard platform (system policy set versions).
"customer" — managed by the tenant (custom policy set versions).

Accepts one of the following:

"platform"

"customer"

policy_set_id: string

schema_version: string

Schema version pinned to this policy set version. Determines the Cedar schema used for evaluation when activated.

version: number

active?: boolean

Whether this policy set version is currently bound with mode='active'

archived_at?: string | null

formatdate-time

archived_by?: string | null

attestation?: AttestationStatement { attested_at, attested_by, key_id, 7 more } | null

Decoded content of an Attestation JWS payload. Describes the exact policy set version composition at attestation time. This schema defines what consumers see after base64url-decoding the Attestation.payload field.

attested_at: string

formatdate-time

attested_by: string

key_id: string

Key ID of the signing key used to produce the attestation signature. Matches the "kid" in the JWS protected header.

manifest_sha: string

SHA-256 of the policy set version manifest. Verifiers MUST check this matches the policy_set_version.manifest_sha to detect attestation/version mismatches.

policy_set_id: string

policy_set_version: number

status: "created" | "re_signed"

Event that produced this attestation. "created" is the initial attestation at version creation; "re_signed" is a re-attestation after key rotation (same content, new signature).

Accepts one of the following:

"created"

"re_signed"

type: "policy_set_attestation"

Statement type discriminator

v: 1

Statement schema version

zone_id: string

Create a new immutable policy set version

import KeycardAPI from '@keycardai/api';

const client = new KeycardAPI();

const policySetVersion = await client.zones.policySets.versions.create('policy_set_id', {
  zone_id: 'zone_id',
  manifest: { entries: [{ policy_id: 'policy_id', policy_version_id: 'policy_version_id' }] },
  schema_version: 'schema_version',
});

console.log(policySetVersion.id);

{
  "id": "id",
  "created_at": "2019-12-27T18:11:19.117Z",
  "created_by": "created_by",
  "manifest": {
    "entries": [
      {
        "policy_id": "policy_id",
        "policy_version_id": "policy_version_id",
        "sha": "sha"
      }
    ]
  },
  "manifest_sha": "manifest_sha",
  "owner_type": "platform",
  "policy_set_id": "policy_set_id",
  "schema_version": "schema_version",
  "version": 0,
  "active": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by": "archived_by",
  "attestation": {
    "attested_at": "2019-12-27T18:11:19.117Z",
    "attested_by": "attested_by",
    "key_id": "key_id",
    "manifest_sha": "manifest_sha",
    "policy_set_id": "policy_set_id",
    "policy_set_version": 0,
    "status": "created",
    "type": "policy_set_attestation",
    "v": 1,
    "zone_id": "zone_id"
  }
}

Returns Examples

{
  "id": "id",
  "created_at": "2019-12-27T18:11:19.117Z",
  "created_by": "created_by",
  "manifest": {
    "entries": [
      {
        "policy_id": "policy_id",
        "policy_version_id": "policy_version_id",
        "sha": "sha"
      }
    ]
  },
  "manifest_sha": "manifest_sha",
  "owner_type": "platform",
  "policy_set_id": "policy_set_id",
  "schema_version": "schema_version",
  "version": 0,
  "active": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by": "archived_by",
  "attestation": {
    "attested_at": "2019-12-27T18:11:19.117Z",
    "attested_by": "attested_by",
    "key_id": "key_id",
    "manifest_sha": "manifest_sha",
    "policy_set_id": "policy_set_id",
    "policy_set_version": 0,
    "status": "created",
    "type": "policy_set_attestation",
    "v": 1,
    "zone_id": "zone_id"
  }
}