Policy

Stable public contract — exactly these five fields. Clients should ignore any additional fields a future response may contain.

codestringrequired

Example: SEC-1

titlestringrequired

categorystringrequired

Possible values: [security, access_control, data_integrity, architecture, monitoring, cost_management]

severitystringrequired

Possible values: [critical, high, medium, low]

compliance_frameworks object[]required

Regulatory/standard mappings (e.g. SOC 2, GDPR) for this policy. Populated only for policies whose definitions carry framework mappings; policies without a mapping return an empty array. Framework coverage is being rolled out, so this list is currently empty for most policies.

Array [

frameworkstringrequired

Possible values: [SOC 2, GDPR, PCI-DSS, HIPAA, ISO 27001]

controlstringrequired

Example: CC6.1

]

Policy

{
  "code": "SEC-1",
  "title": "string",
  "category": "security",
  "severity": "critical",
  "compliance_frameworks": [
    {
      "framework": "SOC 2",
      "control": "CC6.1"
    }
  ]
}