Policy Export REST API

Policy Export REST API

This page describes the Policy Export REST API, a new IQ Server API for exporting policy definitions for a specific owner (organization, repository, application, repository manager or repository container). It enables you to retrieve all configured policies, labels, license threat groups and policy tags for the target owner, optionally including policies inherited from parent entities.

Overview

Policies govern license, security and quality rules in IQ Server. Administrators or automation may wish to export a complete set of policies for backup or analysis. The Policy Export API provides a read‑only, authenticated endpoint to return policy configurations in JSON format.

Note

This endpoint supports export only; it cannot be used to import policies. Any policy updates must be performed through supported administrative APIs or the IQ Server user interface.

The API supports two modes:

  1. Direct export – returns only the policies defined directly on the specified owner.
  2. Inherited export – returns policies defined on the specified owner and policies inherited from its parent hierarchy (e.g., repositories inherit from their repository manager and repository container).

The response includes lists of policies, labels, license threat groups and policy tags. Each entity in the export appears only once; duplicates are removed automatically.

Endpoint

GET /api/v2/policy/{ownerType}/{ownerId}/export

Note

Repository manager and repository container policies are included automatically in inherited repository exports. However, these hierarchy levels are not valid direct values for ownerType.

Permissions

The caller must authenticate and have Read Policies permission on the specified owner. If the owner does not exist, the API returns a 404 Not Found. If the caller lacks permission, a 403 Forbidden is returned.

Troubleshooting

HTTP Code Cause Resolution
403 Forbidden Caller lacks Read Policies permission Ensure the authenticated user has the Policy Administrator or equivalent role with Read Policies access on the specified owner.
404 Not Found Owner ID does not exist or wrong ownerType Verify the ownerId via the Organizations or Applications API and confirm that the correct ownerType value is used.

Examples

Export policies for an application

The following command exports only the policies defined on a specific application:

curl -u admin:admin123 -X GET \
  'https://your-iq-server/api/v2/policy/application/4bb67dcfc86344e3a483832f8c496419/export'

To include inherited policies (from the application's parent organization), set the includeInherited flag:

curl -u admin:admin123 -X GET \
  'https://your-iq-server/api/v2/policy/application/4bb67dcfc86344e3a483832f8c496419/export?includeInherited=true'

Export policies for a repository

Repositories exist in a separate hierarchy consisting of repository → repository manager → repository container → Root organization. The organization hierarchy does not apply. To export the complete policy set for a repository, including inherited policies from its repository manager and container, call:

curl -u admin:admin123 -X GET \
  'https://your-iq-server/api/v2/policy/repository/cfea8fa79df64283bd64e5b6b624ba48/export?includeInherited=true'

Export policies for an organization

Organizations are top‑level entities in IQ Server and are often the primary scope for policy configuration. To export the policies defined on a specific organization, use its internal ID or the special ROOT_ORGANIZATION_ID constant for the root organization:

curl -u admin:admin123 -X GET \
  'https://your-iq-server/api/v2/policy/organization/ROOT_ORGANIZATION_ID/export'

Append ?includeInherited=true when you want to include policies inherited from parent entities. In most cases, the root organization does not inherit from any parent.

Response Schema

A successful response returns a JSON object with the following structure:

{
  "policies": [
    {
      "id": "597c23c4cd1c4c0a9d890766d906eecb",
      "name": "Security-Critical",
      "threatLevel": 10,
      "constraints": [...],
      "actions": [...],
      "ownerId": "..."
    }
  ],
  "labels": [
    {
      "id": "9beee80c6fc148dfa51e8b0359ee4d4e",
      "label": "HIPAA",
      "ownerId": "..."
    }
  ],
  "licenseThreatGroups": [
    {
      "id": "4805fc0aaf3e421c9f26774f6638aa84",
      "name": "Reciprocal",
      "threatLevel": 7
    }
  ],
  "licenseThreatGroupLicenses": [
    {
      "licenseThreatGroupId": "4805fc0aaf3e421c9f26774f6638aa84",
      "licenseId": "GPL-3.0"
    }
  ],
  "tags": [
    {
      "id": "9beee80c6fc148dfa51e8b0359ee4d4e",
      "name": "Security"
    }
  ],
  "policyTags": [
    {
      "policyId": "597c23c4cd1c4c0a9d890766d906eecb",
      "tagId": "9beee80c6fc148dfa51e8b0359ee4d4e"
    }
  ]
}

Notes on inheritance

When includeInherited=true:

Policy-as-Code Integration

You can incorporate the export API into a policy‑as‑code workflow. By storing the exported JSON in version control you create an auditable record of the current policy configuration. You may compare successive exports or exports from different IQ Server instances to detect configuration drift. These diffs can be reviewed in pull requests, and CI/CD pipelines can be configured to fetch the latest export and alert when unexpected differences are detected. Because this endpoint is read‑only, applying changes still requires using supported administrative APIs or the IQ Server UI.

Example Use Cases