Auto Policy Waiver REST API

The Auto Policy Waiver REST API allows you to manage the configuration of Automated Waivers for an organization or application.

Using this REST API you can create a new Automated Waiver configuration or retrieve, update or delete an existing Automated Waiver configuration.

Permissions Required: Waive Policy Violations

Methods supported:

• GET
• POST
• PUT
• DELETE

GET Existing Automated Waivers

GET /api/v2/autoPolicyWaivers/{ownerType: application|organization}/{ownerId}

Use this method to retrieve the configuration of all Automated Waivers for the specified ownerType and ownerId.

Example:

To retrieve the Automated Waiver configuration details for an organization, the field ownerType is organization, followed by the organizationId.

curl -X GET -u admin:admin123 http://localhost:8070/api/v2/autoPolicyWaivers/organization/<organizationId>

To retrieve the Automated Waiver configuration details for a specific auto-waiver, you can specify the autoPolicyWaiverId as below:

GET /{ownerType: application|organization}/{ownerId}/{autoPolicyWaiverId}

Response:

The response contains a list of Automated Waivers grouped by autoPolicyWaiverId.

{
    "autoPolicyWaiverId": "8dae7860ca9d4e26a91371ab156e2080",
    "ownerId": "5b6c0dde3b0e415487dd0c92220d105c",
    "ownerType": "application",
    "ownerName": "waiver-test",
    "publicId": "waiver-test",
    "threatLevel": 7,
    "reachable": null,
    "pathForward": true,
    "creatorId": "admin",
    "creatorName": "Admin BuiltIn",
    "createTime": "2024-12-11T03:06:41.985+0000"
}

If a security policy violation is configured for Automated Waivers both at the organization level and application level, there response retrieves the details for the automated waiver applied at the application level.

To retrieve the status of an existing Automated Waiver for an organization or application, you can send a request as below:

curl -X GET -u admin:admin123 http://localhost:8070/api/v2/autoPolicyWaivers/organization/<organizationId>/status

Response:

The response contains the status for the specified Automated Waiver.

POST New Automated Waiver

POST /api/v2/autoPolicyWaivers/{ownerType: application|organization}/{ownerId}

Use this method to create a new waiver request for a policy violation at the application, organization, or repository level.

Example:

curl -X POST -u admin:admin123 -H "Content-Type: application/json" -d '{"threatLevel": "5", "pathForward": "true", "reachable": "false"}' http://localhost:8070/api/v2/autoPolicyWaivers/organization/9cee7b6754f04d10a168fa8e32a265f0

Response:

The response contains the configuration details for the Automated Waiver created.

{
    "autoPolicyWaiverId": "bd68235902a448428abb9ee789899f91",
    "ownerId": "5b6c0dde3b0e415487dd0c92220d105c",
    "threatLevel": 9,
    "reachable": false,
    "pathForward": true,
    "creatorId": "admin",
    "creatorName": "Admin BuiltIn",
    "createTime": "2024-12-26T16:23:10.073+0000"
}

PUT To Update An Existing Automated Waiver

PUT /api/v2/autoPolicyWaivers/{ownerType: application|organization}/{ownerId}/{autoPolicyWaiverId}

Use this method to update an existing configuration of an Automated Waiver by providing the applicationId/organizationId and the autoPolicyWaiverId

Example:

curl -X PUT -u admin:admin123 -H "Content-Type: application/json" -d '{"threatLevel": "1", "pathForward": "true", "reachable": "false", "autoPolicyWaiverId": "ead479f981d94d37958539f56642c365", "ownerId": "9cee7b6754f04d10a168fa8e32a265f0"}'

Response:

The response contains details of the updated Automated Waiver.

DELETE An Existing Automated Waiver

DELETE /api/v2/autoPolicyWaivers/{ownerType: application|organization}/{ownerId}/{autoPolicyWaiverId}

Use this method to delete and an existing configuration for Automated Waiver by providing the autoPolicyWaiverId.

Example:

curl -X DELETE -u admin:admin123 http://localhost:8070/api/v2/autoPolicyWaivers/organization/<organizationId>/<autoPolicyWaiverId>

A response code 204 indicates that the Automated Waiver was deleted successfully.