Returns the policy in force for this reviewer's tenant.

curl --request GET \
  --url https://qa.esectra.com/v1/control/policy \
  --cookie esectra_session=

const options = {method: 'GET', headers: {cookie: 'esectra_session='}};

fetch('https://qa.esectra.com/v1/control/policy', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://qa.esectra.com/v1/control/policy",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_COOKIE => "esectra_session=",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://qa.esectra.com/v1/control/policy"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("cookie", "esectra_session=")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://qa.esectra.com/v1/control/policy")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["cookie"] = 'esectra_session='

response = http.request(request)
puts response.read_body

{
  "applies_to": "<string>",
  "checks": [
    {
      "check": "<string>",
      "required": true
    }
  ],
  "customization": "<string>",
  "outcomes": {
    "case_opened_for": [
      "<string>"
    ],
    "fail": "<string>",
    "missing_reference": "<string>",
    "pass": "<string>",
    "review": "<string>",
    "review_queue": "<string>"
  },
  "source": "ESECTRA_DEFAULT",
  "status": "<string>",
  "version": "<string>",
  "effective_from": "<string>"
}

Control

Returns the policy in force for this reviewer's tenant.

A tenant with no published policy is under Esectra’s strict default, and the route says so rather than answering 404: there is always a policy, and “none published” is a fact about the tenant, not a missing resource.

Errors

Returns 401 without a session, 403 for an API key - which acts for a tenant rather than a person - and 503 when the policy store cannot be read. The 503 names what is still true: sessions keep being evaluated, under the strict default, until the store answers again.

GET

control

policy

Returns the policy in force for this reviewer's tenant.

curl --request GET \
  --url https://qa.esectra.com/v1/control/policy \
  --cookie esectra_session=

const options = {method: 'GET', headers: {cookie: 'esectra_session='}};

fetch('https://qa.esectra.com/v1/control/policy', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://qa.esectra.com/v1/control/policy",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_COOKIE => "esectra_session=",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://qa.esectra.com/v1/control/policy"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("cookie", "esectra_session=")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://qa.esectra.com/v1/control/policy")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["cookie"] = 'esectra_session='

response = http.request(request)
puts response.read_body

{
  "applies_to": "<string>",
  "checks": [
    {
      "check": "<string>",
      "required": true
    }
  ],
  "customization": "<string>",
  "outcomes": {
    "case_opened_for": [
      "<string>"
    ],
    "fail": "<string>",
    "missing_reference": "<string>",
    "pass": "<string>",
    "review": "<string>",
    "review_queue": "<string>"
  },
  "source": "ESECTRA_DEFAULT",
  "status": "<string>",
  "version": "<string>",
  "effective_from": "<string>"
}

Authorizations

esectra_session

string

required

A signed-in reviewer's session. httpOnly and SameSite=Lax; set by POST /v1/control/sessions and only usable once the second factor is met.

Response

The effective policy: the tenant's own, or Esectra's default

The effective policy, as a reviewer may read it.

applies_to

string

required

What the policy governs.

checks

object[]

required

The checks a verification session must satisfy, in the order they are evaluated.

Show child attributes

customization

string

required

Who may change the policy. ESECTRA_MANAGED during the pilot.

outcomes

object

required

What each outcome leads to.

Show child attributes

source

enum<string>

required

Whether this is the tenant's own policy or Esectra's default.

Available options:

ESECTRA_DEFAULT,

ORGANIZATION

status

string

required

Always ACTIVE: the policy this route returns is the one in force.

version

string

required

The version decisions cite.

effective_from

string | null

When this version was published. Absent for the default, which has been in force since the deployment existed.

Start

Verify

Operate

API reference

Returns the policy in force for this reviewer's tenant.

Errors

Authorizations

Response