# Policy Export REST API

This page describes the **Policy Export REST API**, a new IQ Server API for exporting policy definitions for a specific owner (organization, repository, application, repository manager or repository container). It enables you to retrieve all configured policies, labels, license threat groups and policy tags for the target owner, optionally including policies inherited from parent entities.

### Overview

Policies govern license, security and quality rules in IQ Server. Administrators or automation may wish to export a complete set of policies for backup or analysis. The Policy Export API provides a read‑only, authenticated endpoint to return policy configurations in JSON format.

**Note**

This endpoint supports export only; it cannot be used to import policies. Any policy updates must be performed through supported administrative APIs or the IQ Server user interface.

The API supports two modes:

1. **Direct export** – returns only the policies defined directly on the specified owner.
2. **Inherited export** – returns policies defined on the specified owner and policies inherited from its parent hierarchy (e.g., repositories inherit from their repository manager and repository container).

The response includes lists of policies, labels, license threat groups and policy tags. Each entity in the export appears only once; duplicates are removed automatically.

### Endpoint

```
GET /api/v2/policy/{ownerType}/{ownerId}/export
```

- **ownerType** – one of `organization`, `repository` or `application`. Repository exports include inherited policies from repository manager and repository container hierarchy levels when `includeInherited=true`. Repository manager and repository container cannot be exported directly through this endpoint.

**Note**

Repository manager and repository container policies are included automatically in inherited repository exports. However, these hierarchy levels are not valid direct values for `ownerType`.

- **ownerId** – The internal ID of the target owner. Obtain organization IDs via the Organizations API, or application IDs via the Applications API, or copy the ID from the IQ Server UI. Repository IDs can be retrieved from the Repository Manager interface.

- **includeInherited** (query, optional, Boolean) – Defaults to `false`. Set to `true` to include policies inherited from parent entities. When `false`, only policies defined on the specified owner are returned.

#### Permissions

The caller must authenticate and have **Read Policies** permission on the specified owner. If the owner does not exist, the API returns a `404 Not Found`. If the caller lacks permission, a `403 Forbidden` is returned.

### Troubleshooting

| HTTP Code | Cause | Resolution |
| --- | --- | --- |
| **403 Forbidden** | Caller lacks **Read Policies** permission | Ensure the authenticated user has the _Policy Administrator_ or equivalent role with Read Policies access on the specified owner. |
| **404 Not Found** | Owner ID does not exist or wrong `ownerType` | Verify the `ownerId` via the Organizations or Applications API and confirm that the correct `ownerType` value is used. |

### Examples

#### Export policies for an application

The following command exports only the policies defined on a specific application:

```
curl -u admin:admin123 -X GET \
  'https://your-iq-server/api/v2/policy/application/4bb67dcfc86344e3a483832f8c496419/export'
```

To include inherited policies (from the application's parent organization), set the `includeInherited` flag:

```
curl -u admin:admin123 -X GET \
  'https://your-iq-server/api/v2/policy/application/4bb67dcfc86344e3a483832f8c496419/export?includeInherited=true'
```

#### Export policies for a repository

Repositories exist in a separate hierarchy consisting of repository → repository manager → repository container → Root organization. The organization hierarchy does not apply. To export the complete policy set for a repository, including inherited policies from its repository manager and container, call:

```
curl -u admin:admin123 -X GET \
  'https://your-iq-server/api/v2/policy/repository/cfea8fa79df64283bd64e5b6b624ba48/export?includeInherited=true'
```

#### Export policies for an organization

Organizations are top‑level entities in IQ Server and are often the primary scope for policy configuration. To export the policies defined on a specific organization, use its internal ID or the special `ROOT_ORGANIZATION_ID` constant for the root organization:

```
curl -u admin:admin123 -X GET \
  'https://your-iq-server/api/v2/policy/organization/ROOT_ORGANIZATION_ID/export'
```

Append `?includeInherited=true` when you want to include policies inherited from parent entities. In most cases, the root organization does not inherit from any parent.

### Response Schema

A successful response returns a JSON object with the following structure:

```
{
  "policies": [
    {
      "id": "597c23c4cd1c4c0a9d890766d906eecb",
      "name": "Security-Critical",
      "threatLevel": 10,
      "constraints": [...],
      "actions": [...],
      "ownerId": "..."
    }
  ],
  "labels": [
    {
      "id": "9beee80c6fc148dfa51e8b0359ee4d4e",
      "label": "HIPAA",
      "ownerId": "..."
    }
  ],
  "licenseThreatGroups": [
    {
      "id": "4805fc0aaf3e421c9f26774f6638aa84",
      "name": "Reciprocal",
      "threatLevel": 7
    }
  ],
  "licenseThreatGroupLicenses": [
    {
      "licenseThreatGroupId": "4805fc0aaf3e421c9f26774f6638aa84",
      "licenseId": "GPL-3.0"
    }
  ],
  "tags": [
    {
      "id": "9beee80c6fc148dfa51e8b0359ee4d4e",
      "name": "Security"
    }
  ],
  "policyTags": [
    {
      "policyId": "597c23c4cd1c4c0a9d890766d906eecb",
      "tagId": "9beee80c6fc148dfa51e8b0359ee4d4e"
    }
  ]
}
```

- `policies` – array of policy definitions. Each policy includes metadata such as ID, name, threat level, constraints, actions and owner ID.

- `labels` – array of label definitions associated with the owner. Each label contains a `label` field representing the displayed label value.

- `licenseThreatGroups` – array of license threat group definitions. Each group contains threat level information.

- `licenseThreatGroupLicenses` \- associations between license threat groups and licenses.

- `tags` \- tag definitions associated with the exported policies. Tags are organization-scoped entities.

- `policyTags` – associations between policies and tags. Tags are defined at the organization level; therefore this array is non‑empty only when exporting from an organization and when tags exist.

#### Notes on inheritance

When `includeInherited=true`:

- Policies defined on parent entities are returned alongside the target owner’s policies. They are not duplicated if they appear on multiple levels.
- License threat groups and labels are also inherited from parent entities where applicable.
- Repository hierarchies are not part of the organization hierarchy; repositories do not inherit policies from organizations or applications.

### Policy-as-Code Integration

You can incorporate the export API into a policy‑as‑code workflow. By storing the exported JSON in version control you create an auditable record of the current policy configuration. You may compare successive exports or exports from different IQ Server instances to detect configuration drift. These diffs can be reviewed in pull requests, and CI/CD pipelines can be configured to fetch the latest export and alert when unexpected differences are detected. Because this endpoint is read‑only, applying changes still requires using supported administrative APIs or the IQ Server UI.

### Example Use Cases

- **Backing up policies before an upgrade** – Run an export for each organization, application or repository prior to upgrading IQ Server and store the resulting JSON files in version control as a baseline.
- **Comparing production vs test environments** – Use the export API on two separate IQ Server instances (e.g. production and test) and compare the outputs to ensure that both environments use the same set of policies.
- **Seeding policies in a new IQ Server instance** – Export the policies from an existing server and use the resulting JSON as a reference when recreating policies in a new instance. Although policies cannot be imported directly via this endpoint, the exported data provides a template for manual or scripted configuration.