Policies

This stores a network policy named web with one rule. A sandbox with this policy can reach api.example.com, and the policy drops whatever its rules do not allow:

curl --unix-socket /var/lib/shard/shard.sock -X PUT -H 'Content-Type: application/json' -d '{"rules":[{"action":"allow","rule":"api.example.com"}]}' http://localhost/v0/policies/web

A create names the policy, and so does an attach to a stopped sandbox.

Each route answers an error with the Error body, unless its responses say otherwise.

List policies

GET /v0/policies · scope policy:*

Parameters

Name	In	Type	Required	Description
limit	query	integer (int64)	no	The most items on a page; absent returns the whole list. At least 1.
cursor	query	string	no	The next value of the previous page; this page starts after it.

Responses

Status	Body
200	PoliciesResponse as application/json

Read a policy

GET /v0/policies/{name} · scope policy:*

Parameters

Name	In	Type	Required
name	path	string	yes

Responses

Status	Body
200	PolicyView as application/json

Create or replace a policy

PUT /v0/policies/{name} · scope policy:*

Parameters

Name	In	Type	Required
name	path	string	yes

Request body

PolicyRequest as application/json, optional.

Responses

Status	Body
200	PolicyView as application/json

Remove a policy

DELETE /v0/policies/{name} · scope policy:*

Parameters

Name	In	Type	Required
name	path	string	yes

Responses

Status	Body
204	none

Objects

PoliciesResponse

Field	Type	Required
next	string or null	yes
policies	array of Policy	yes

Policy

Field	Type	Required
name	string	yes
rules	array of Rule	yes

PolicyRequest

Field	Type	Required
rules	array of RuleText	no

PolicyView

Field	Type	Required	Description
dns	string	yes	One of open, closed.
holders	array of string	no
name	string	yes
rules	array of Rule	yes

Rule

Field	Type	Required	Description
action	string	yes	One of allow, deny.
destination	Destination	yes
ports	array of integer (int64)	no
protocol	string	no	Absent for a rule over every protocol. One of tcp, udp.

RuleText

Field	Type	Required	Description
action	string	yes	One of allow, deny.
rule	string	yes