Beta module namespace
claude-policy
Beta routes may change with notice and are NOT covered by the 24-month stable window of the core contract.
Every module route is enumerated with method, path, auth and required permission; request/response schemas are not published for the beta surface.
8 operations
| Method | Path | Required permission | Authentication | Summary |
|---|---|---|---|---|
| get | /v1/m/claude-policy/{surface}/artifact | governance:claude-policy:read | Bearer token | Serves the latest (or ?revision=N) SIGNED artifact for a surface — the agent-pull half of the decided distribution mechanism. |
| post | /v1/m/claude-policy/{surface}/checkin | governance:claude-policy:write | Bearer token | Records a distribution agent's attested check-in: it verifies the echoed artifact hash/fingerprint against the distribution record (a mismatch is a HIGH drift finding — tampered or stale artifact), upserts the scope's OBSERVED config (credential-redacted), computes drift against the latest published revision, and audits the whole thing. |
| get | /v1/m/claude-policy/{surface}/distribution | governance:claude-policy:read | Bearer token | Serves the per-surface truth view (read tier): published vs signed vs observed, scope by scope — real state only, every absence named. |
| post | /v1/m/claude-policy/{surface}/dry-run | governance:claude-policy:read | Bearer token | Previews the resolved precedence/effect WITHOUT publishing or touching any host. |
| post | /v1/m/claude-policy/{surface}/publish | governance:claude-policy:admin | Bearer token | Persists an immutable revision and runs PERMITTED-vs-OBSERVED drift. |
| post | /v1/m/claude-policy/{surface}/validate | governance:claude-policy:read | Bearer token | Validates a document server-side (defense in depth — the UI is never the security boundary). |
| get | /v1/m/claude-policy/{surface}/versions | governance:claude-policy:read | Bearer token | Returns a surface's revision history (metadata only). |
| get | /v1/m/claude-policy/{surface}/versions/{revision} | governance:claude-policy:read | Bearer token | Returns one revision with its content. |