x-cpod-domain: policies

Policies

Governance policy documents with lifecycle management — acceptable use, data handling, security, HR. Policies can be published, retired, and reviewed on a cadence.

Try in explorer client.policies

Policy

A versioned governance policy document with an owner, category, and review cadence.

REST path/api/v1/policies/policies

Operations

listgetcreateupdatedeletepublishretire

SDK

// list — returns only your records; add filters/search:
await client.policies.policies.list()

// create:
await client.policies.policies.create({
  id: "rec_01HXEXAMPLE",
  tenant_id: "example tenant_id",
  created_at: "2026-01-01T00:00:00Z",
  updated_at: "2026-01-01T00:00:00Z",
  name: "example name",
  app_id: "example app_id",
})

Field	Type	Description
id*	uuid	Server-assigned ULID with type prefix (e.g. per_…).
tenant_id*	string	Tenant scope — auto-stamped from the caller's JWT.
app_id	string	App scope. Stamped ONLY when the caller's JWT was minted for a specific Application (integration API keys). Absent for human-user sessions. Filters reads when present.
created_at*	date-time	Server stamp.
updated_at*	date-time	Server stamp; updated on every patch.
created_by	uuid→User	User id from the caller's JWT (sub).
updated_by	uuid→User	User id from the last writer's JWT (sub).
source	string	Provenance tag — defaults to 'edm'.
source_type	enum	Where the write originated. Defaults to 'api'.`frontendbackendserversystemapi`
is_deleted	boolean	Soft-delete flag. Excluded from default list queries.
deleted_at	date-time	Stamped when soft-deleted; null otherwise.
deleted_by	uuid→User	User id who soft-deleted; null otherwise.
schema_version	number	Document schema version. Bumped on incompatible writes.
name*	string	Human-readable policy name (e.g. 'Acceptable Use Policy').
body	string	Full policy text (markdown).
version	string	Policy version identifier (e.g. '1.2.0'). Bump on material edits.
category	enum	Policy domain / category.`securityprivacyhrcompliancefinanceoperationsother`
status	enum	Lifecycle state.`draftin_reviewapprovedpublishedretired`
owner_id	uuid→User	Policy owner (user id).
published_at	date-time	Timestamp the policy was formally published. Stamped automatically by the publish action.
next_review_at	date-time	Next scheduled review date.
tags	json	Free-form tags for categorizing or searching the policy.

PolicyAcknowledgement

Records that a person has read and agreed to a specific version of a policy.

REST path/api/v1/policies/acknowledgements

Operations

listgetcreatedelete

SDK

// list — returns only your records; add filters/search:
await client.policies.acknowledgements.list()

// create:
await client.policies.acknowledgements.create({
  id: "rec_01HXEXAMPLE",
  tenant_id: "example tenant_id",
  created_at: "2026-01-01T00:00:00Z",
  updated_at: "2026-01-01T00:00:00Z",
  policy_id: "policy_01HXEXAMPLE",
  person_id: "person_01HXEXAMPLE",
})

Field	Type	Description
id*	uuid	Server-assigned ULID with type prefix (e.g. per_…).
tenant_id*	string	Tenant scope — auto-stamped from the caller's JWT.
app_id	string	App scope. Stamped ONLY when the caller's JWT was minted for a specific Application (integration API keys). Absent for human-user sessions. Filters reads when present.
created_at*	date-time	Server stamp.
updated_at*	date-time	Server stamp; updated on every patch.
created_by	uuid→User	User id from the caller's JWT (sub).
updated_by	uuid→User	User id from the last writer's JWT (sub).
source	string	Provenance tag — defaults to 'edm'.
source_type	enum	Where the write originated. Defaults to 'api'.`frontendbackendserversystemapi`
is_deleted	boolean	Soft-delete flag. Excluded from default list queries.
deleted_at	date-time	Stamped when soft-deleted; null otherwise.
deleted_by	uuid→User	User id who soft-deleted; null otherwise.
schema_version	number	Document schema version. Bumped on incompatible writes.
policy_id*	uuid→Policy	The policy being acknowledged.
person_id*	uuid→Person	Who acknowledged the policy.
policy_version	string	Version of the policy at the time of acknowledgement (snapshot).
acknowledged_at	date-time	ISO 8601 timestamp when the user clicked 'I agree'.
ip_address	string	Source IP address for stronger audit trail.
user_agent	string	User-Agent of the browser/client at acknowledgement time.

PolicyReview

A scheduled (or completed) periodic review of a policy. Enforces 'all policies reviewed at least annually' controls.

REST path/api/v1/policies/reviews

Operations

listgetcreateupdatedeletecomplete

SDK

// list — returns only your records; add filters/search:
await client.policies.reviews.list()

// create:
await client.policies.reviews.create({
  id: "rec_01HXEXAMPLE",
  tenant_id: "example tenant_id",
  created_at: "2026-01-01T00:00:00Z",
  updated_at: "2026-01-01T00:00:00Z",
  policy_id: "policy_01HXEXAMPLE",
  due_at: "2026-01-01T00:00:00Z",
})

Field	Type	Description
id*	uuid	Server-assigned ULID with type prefix (e.g. per_…).
tenant_id*	string	Tenant scope — auto-stamped from the caller's JWT.
app_id	string	App scope. Stamped ONLY when the caller's JWT was minted for a specific Application (integration API keys). Absent for human-user sessions. Filters reads when present.
created_at*	date-time	Server stamp.
updated_at*	date-time	Server stamp; updated on every patch.
created_by	uuid→User	User id from the caller's JWT (sub).
updated_by	uuid→User	User id from the last writer's JWT (sub).
source	string	Provenance tag — defaults to 'edm'.
source_type	enum	Where the write originated. Defaults to 'api'.`frontendbackendserversystemapi`
is_deleted	boolean	Soft-delete flag. Excluded from default list queries.
deleted_at	date-time	Stamped when soft-deleted; null otherwise.
deleted_by	uuid→User	User id who soft-deleted; null otherwise.
schema_version	number	Document schema version. Bumped on incompatible writes.
policy_id*	uuid→Policy	The policy under review.
reviewer_id	uuid→User	Assigned reviewer (user id).
due_at*	date-time	When the review is due.
completed_at	date-time	When the review was completed. Null if still pending.
status	enum	Review lifecycle state.`scheduledin_progresscompletedoverdue`
outcome	enum	Result of the review. Set via the complete action.`no_changeminor_revisionmajor_revisionretire`
notes	string	Reviewer notes — e.g. what was changed and why.

Docs

Policy

PolicyAcknowledgement

PolicyReview