Global Policies API

Endpoints

• List Global Policies - List all global policies in a project
• Get Global Policy - Retrieve a single global policy by name
• Create Global Policy - Create a new global policy
• Update Global Policy - Update an existing global policy
• Delete Global Policy - Delete a global policy

Authentication

All endpoints require authentication using a Personal API Access Token.

Header

Authorization: Bearer YOUR_TOKEN

Permissions

• Read (list, get): API_MANAGEMENT + VIEW permission in the project
• Write (create, update, delete): API_MANAGEMENT + MANAGE permission in the project
• System administrators have full access

Notes and Warnings

• Name-based: All references use the policy name, never the internal ID.
• Polymorphic Body: POST/PUT bodies are a polymorphic policy snapshot — the top-level "_class" field selects the concrete policy type (e.g. "oidc-auth", "policy-ws-security-username", "allowed-hours"). See Create Global Policy for the full catalog of _class values.
• policy-group Is a Different Resource: The policy-group type is deliberately excluded from this resource's GET/PUT/DELETE name lookups. Policy groups are managed through the dedicated Policy Groups API instead.
• POST vs PUT Secret Contract Differs: POST (create) is also used by cross-instance API Promotion, so it accepts @SecretData fields already encrypted from the source instance and does not re-encrypt them. PUT (update) is a normal update — @SecretData fields must be sent plaintext and are encrypted before persist. Sending a plaintext secret to POST, or an already-encrypted value to PUT, corrupts the stored secret. See the Create and Update pages.
• Update Cascades to Embedders: PUT pushes the change into every API proxy, API proxy group and policy group that embeds this global policy by id, so their embedded snapshots stay in sync.
• Delete Is Cascade-Detach, Not an In-Use Guard: DELETE removes the embedded copy of the policy from every API proxy, API proxy group and policy group that references it, then deletes the standalone record. There is no "still in use" guard — deleting a global policy that is actively embedded elsewhere silently detaches it from those places.
• Lightweight Responses: List/Get/Create/Update responses only return id, name, policyType and policyTypeLabel — never the full policy body, so @SecretData fields are never echoed back in any form (not even masked).

Related Documentation

• Policy Groups API - Manage reusable groups of policies
• Authentication Guide - How to obtain and use API tokens
• Error Handling - Error response formats