Policy Groups API

Endpoints

All endpoints require authentication using a Personal API Access Token.

Authorization: Bearer YOUR_TOKEN

Read (list, get): API_MANAGEMENT + VIEW permission in the project
Write (create, update, delete): API_MANAGEMENT + MANAGE permission in the project
System administrators have full access

Name-based: All references use the policy group name, never the internal ID.
Distinct from Global Policies: A policy group is internally a Policy subtype (_class: "policy-group") but is deliberately handled as its own APIops resource, separate from Global Policies API. It is always persisted with global=false.
POST vs PUT Secret Contract Differs: POST (create) is also used by cross-instance API Promotion and accepts embedded policies whose @SecretData fields are already encrypted from the source instance — they are not re-encrypted. PUT (update) is a normal update — embedded policy secrets must be sent plaintext and are encrypted before persist. See the Create and Update pages.
Update and Delete Cascade to Embedders: PUT pushes the change into every API proxy and API proxy group that embeds this policy group by id, keeping their embedded snapshots in sync. DELETE does the same before removing the record — this is a cascade-detach, not an in-use guard.
Delete Undeploys: Unlike a plain global policy, a policy group is independently deployed to gateway workers. DELETE undeploys it from every running environment before removing the record.
Lightweight Responses: List/Get/Create/Update responses only return id, name and targetPipeline — never the embedded policy list, so no policy secrets are ever echoed back.