Skip to main content

Transition policy

POST 
/api/policies/:policy_id/transition

Explicit lifecycle transitions beyond the two the existing PATCH/DELETE endpoints already cover (ACTIVE<->DISABLED via enabled, ->ARCHIVED via delete — both left completely unchanged, since worker_app/gateway_app filter on enabled/deleted_at directly and must never need to learn about a new lifecycle concept). This endpoint is what actually reaches the states those two can't: DRAFT->VALIDATED, VALIDATED->PENDING_APPROVAL, PENDING_APPROVAL->ACTIVE.

Design correction made while implementing this (documented in POLICIES_COMPLETION.md rather than silently done): §18 originally proposed reusing approval_requests for the PENDING_APPROVAL->ACTIVE step. That table's entity_id column is NOT NULL — it structurally cannot represent "approve this policy itself" (there is no agent/entity involved), so this transition is a plain manage_policies-gated action instead, not a second approval-request row. Dual-control (a different reviewer than the author) is not enforced — a real gap if that guarantee is later required.

Request​

Responses​

Successful Response