DevGuard Policies API
Policies are the rules your software has to satisfy — no critical vulnerabilities in a release, a required attestation present, a license category disallowed. This API manages them.
Policies are defined once at organization level and then switched on per project. That split matters: creating a policy does not enforce it anywhere, and deleting one removes it everywhere. The project-level endpoints only enable or disable an existing organization policy for that project, which lets a stricter rule roll out gradually instead of breaking every pipeline at once.
Policy definitions themselves are written in CEL. The VEX CEL Reference documents the expression language and the fields available to it.
Related Documentation
- Attestation Policies — writing and applying a policy
- VEX CEL Reference — the expression language
- Compliance API — the results of evaluating these policies
- Compliance as Code — the model behind policies
- Projects API — the scope policies are enabled for
- Use the DevGuard API — authentication and conventions
- DevGuard API Reference