Skip to main content
Pulumi logo Pulumi logo
25.8K Contact us Sign in Dashboard Get started
  1. Docs
  2. Reference
  3. REST API Docs
  4. Policy Exceptions

Policy Exceptions

    List Policy Exceptions

    ▼
    Preview. This endpoint is in preview and may change without notice.
    GET /api/orgs/{orgName}/policy/exceptions

    Lists the organization’s policy exceptions, most recently created first. By default only active exceptions are returned; pass status to choose others. Results are paginated; use continuationToken and maxResults to page through them. Returns 400 for an unknown status, a stack that isn’t <project>/<stack>, policy combined with stack, or an invalid continuation token.

    Request Parameters

    • orgName string path required
      The organization name
    • continuationToken string query optional
      Token from a previous response to fetch the next page of exceptions
    • maxResults integer query optional
      Maximum number of exceptions to return per page (default and max 500)
    • policy string query optional
      Only return exceptions that name this policy
    • policyPack string query optional
      Only return exceptions for this policy pack
    • stack string query optional
      Only return exceptions with a resource on this stack, as <project>/<stack>. Can’t be combined with policy.
    • status array query optional
      Only return exceptions with one of these statuses (default: active)

    Responses

    200 OK
    Schema: ListPolicyExceptionsResponse
    • exceptions array[PolicyException] required
      The policy exceptions, most recently created first.
    • ↳ id string required
      The exception ID, unique within the organization, for example EXC-42.
    • ↳ policyPack string required
      The name of the policy pack the exception applies to.
    • ↳ match array[PolicyExceptionMatch] required
      The exception’s entries.
    • ↳ reason string required
      The justification for the exception.
    • ↳ status enum required
      The exception’s lifecycle status.
      Values: active, removed
    • ↳ expiresAt string optional
      When the exception expires, after which it’s removed. Null if it never expires.
    • ↳ changeRequestId string optional
      The change request that approved the exception, if creating it required approval.
    • ↳ createdBy UserInfo optional
      The user who created the exception, if the user still exists.
    • ↳ createdAt string required
      When the exception was created.
    • ↳ removedBy UserInfo optional
      The user who removed the exception, if the user still exists.
    • ↳ removedAt string optional
      When the exception was removed. Null while it is active.
    • continuationToken string optional
      Pass as continuationToken to fetch the next page. Null once all exceptions have been returned.
    Errors: 400 Invalid filter or continuation token 404 Organization not found

    Create Policy Exception

    ▼
    Preview. This endpoint is in preview and may change without notice.
    POST /api/orgs/{orgName}/policy/exceptions

    Creates an active policy exception and returns it with its ID (EXC-<n>). Returns 400 when the request breaks a field’s limits or the policy pack isn’t in one of the organization’s policy groups, 403 when the organization has disabled policy exceptions, and 409 when it requires approval to create them.

    Request Parameters

    • orgName string path required
      The organization name

    Request Body

    Schema: CreatePolicyExceptionRequest
    • policyPack string required
      The name of the policy pack the exception applies to.
    • match array[PolicyExceptionMatch] required
      The exception’s entries: between 1 and 100.
    • reason string required
      The justification for the exception: up to 2048 characters, not blank.
    • expiresInSeconds integer optional
      Seconds until the exception expires, counted from when it’s created: a whole number of hours, between 1 hour and 3650 days. Omit for an exception that never expires.

    Responses

    201 Created
    Schema: PolicyException
    • id string required
      The exception ID, unique within the organization, for example EXC-42.
    • policyPack string required
      The name of the policy pack the exception applies to.
    • match array[PolicyExceptionMatch] required
      The exception’s entries.
    • ↳ policies array[string] required
      The names of policies within the policy pack: between 1 and 100 non-blank names.
    • ↳ targets array[string] required
      The URNs of the resources the violations are reported against: between 1 and 100 URNs of at most 2048 characters each.
    • reason string required
      The justification for the exception.
    • status enum required
      The exception’s lifecycle status.
      Values: active, removed
    • expiresAt string optional
      When the exception expires, after which it’s removed. Null if it never expires.
    • changeRequestId string optional
      The change request that approved the exception, if creating it required approval.
    • createdBy UserInfo optional
      The user who created the exception, if the user still exists.
    • ↳ name string required
      The user’s display name.
    • ↳ githubLogin string required
      The user’s login name.
    • ↳ avatarUrl string required
      The URL of the user’s avatar image.
    • ↳ email string optional
      The user’s email address. It is only populated on selected endpoints and is omitted from most responses. Treat it as sensitive information.
    • createdAt string required
      When the exception was created.
    • removedBy UserInfo optional
      The user who removed the exception, if the user still exists.
    • ↳ name string required
      The user’s display name.
    • ↳ githubLogin string required
      The user’s login name.
    • ↳ avatarUrl string required
      The URL of the user’s avatar image.
    • ↳ email string optional
      The user’s email address. It is only populated on selected endpoints and is omitted from most responses. Treat it as sensitive information.
    • removedAt string optional
      When the exception was removed. Null while it is active.
    Errors: 400 Invalid exception 403 Policy exceptions are disabled for the organization 404 Organization not found 409 Creating policy exceptions requires approval

    Get Policy Exception

    ▼
    Preview. This endpoint is in preview and may change without notice.
    GET /api/orgs/{orgName}/policy/exceptions/{exceptionId}

    Returns a policy exception by ID, active or removed.

    Request Parameters

    • orgName string path required
      The organization name
    • exceptionId string path required
      The exception ID, for example EXC-42

    Responses

    200 OK
    Schema: PolicyException
    • id string required
      The exception ID, unique within the organization, for example EXC-42.
    • policyPack string required
      The name of the policy pack the exception applies to.
    • match array[PolicyExceptionMatch] required
      The exception’s entries.
    • ↳ policies array[string] required
      The names of policies within the policy pack: between 1 and 100 non-blank names.
    • ↳ targets array[string] required
      The URNs of the resources the violations are reported against: between 1 and 100 URNs of at most 2048 characters each.
    • reason string required
      The justification for the exception.
    • status enum required
      The exception’s lifecycle status.
      Values: active, removed
    • expiresAt string optional
      When the exception expires, after which it’s removed. Null if it never expires.
    • changeRequestId string optional
      The change request that approved the exception, if creating it required approval.
    • createdBy UserInfo optional
      The user who created the exception, if the user still exists.
    • ↳ name string required
      The user’s display name.
    • ↳ githubLogin string required
      The user’s login name.
    • ↳ avatarUrl string required
      The URL of the user’s avatar image.
    • ↳ email string optional
      The user’s email address. It is only populated on selected endpoints and is omitted from most responses. Treat it as sensitive information.
    • createdAt string required
      When the exception was created.
    • removedBy UserInfo optional
      The user who removed the exception, if the user still exists.
    • ↳ name string required
      The user’s display name.
    • ↳ githubLogin string required
      The user’s login name.
    • ↳ avatarUrl string required
      The URL of the user’s avatar image.
    • ↳ email string optional
      The user’s email address. It is only populated on selected endpoints and is omitted from most responses. Treat it as sensitive information.
    • removedAt string optional
      When the exception was removed. Null while it is active.
    Errors: 404 Organization or policy exception not found

    Remove Policy Exception

    ▼
    Preview. This endpoint is in preview and may change without notice.
    DELETE /api/orgs/{orgName}/policy/exceptions/{exceptionId}

    Marks an active policy exception removed and returns it. Returns 409 when the exception was already removed.

    Request Parameters

    • orgName string path required
      The organization name
    • exceptionId string path required
      The exception ID, for example EXC-42

    Responses

    200 OK
    Schema: PolicyException
    • id string required
      The exception ID, unique within the organization, for example EXC-42.
    • policyPack string required
      The name of the policy pack the exception applies to.
    • match array[PolicyExceptionMatch] required
      The exception’s entries.
    • ↳ policies array[string] required
      The names of policies within the policy pack: between 1 and 100 non-blank names.
    • ↳ targets array[string] required
      The URNs of the resources the violations are reported against: between 1 and 100 URNs of at most 2048 characters each.
    • reason string required
      The justification for the exception.
    • status enum required
      The exception’s lifecycle status.
      Values: active, removed
    • expiresAt string optional
      When the exception expires, after which it’s removed. Null if it never expires.
    • changeRequestId string optional
      The change request that approved the exception, if creating it required approval.
    • createdBy UserInfo optional
      The user who created the exception, if the user still exists.
    • ↳ name string required
      The user’s display name.
    • ↳ githubLogin string required
      The user’s login name.
    • ↳ avatarUrl string required
      The URL of the user’s avatar image.
    • ↳ email string optional
      The user’s email address. It is only populated on selected endpoints and is omitted from most responses. Treat it as sensitive information.
    • createdAt string required
      When the exception was created.
    • removedBy UserInfo optional
      The user who removed the exception, if the user still exists.
    • ↳ name string required
      The user’s display name.
    • ↳ githubLogin string required
      The user’s login name.
    • ↳ avatarUrl string required
      The URL of the user’s avatar image.
    • ↳ email string optional
      The user’s email address. It is only populated on selected endpoints and is omitted from most responses. Treat it as sensitive information.
    • removedAt string optional
      When the exception was removed. Null while it is active.
    Errors: 404 Organization or policy exception not found 409 The exception was already removed

      The infrastructure as code platform for any cloud.

      Contact us Get started