ALTR Policy API

openapi: 3.2.0
info:
  title: Unified Policy API
  version: 4.11.1
  termsOfService: https://www.altr.com/info/altr-solutions-inc-terms-of-service
  contact:
    name: Support
    email: support@altr.com
  description: 'Welcome to the Swagger documentation for ALTR''s Unified Policy API. This API allows ALTR customers to manage the policy they enact on Data Sources. These policies include column-level masking, tag-based, pushddown and access management.


    The API provides endpoints to create, update, retrieve, and delete policies, as well as manage rules and thresholds associated with them. It supports advanced features such as time-based and rate-based thresholds, role-based access control, and integration with Snowflake and Databricks.


    For more details, refer to the examples and schemas provided in this documentation.'
servers:
- url: https://api.live.altr.com/v1/unified-policy/management/
security:
- basicAuth: []
tags:
- name: policy
paths:
  /policy/withRules:
    post:
      operationId: createPolicyWithRules
      tags:
      - policy
      summary: Create a policy with rules attached in a single request.
      description: 'This endpoint allows you to create a policy and attach rules to it in a single API call. The policy defines the overarching structure, while the rules specify the conditions and actions to enforce. Rules can include access rate thresholds, time window thresholds, masking policies, and role-based or tag-based conditions. This endpoint is useful for creating fully configured policies without needing to make multiple API calls to add rules separately.


        Note that the policy limitations of POST /policy still apply; such as needing `database_ids` to specify a Databricks source.'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                policy:
                  $ref: '#/components/schemas/CreatePolicyRequest'
                rules:
                  type: array
                  items:
                    $ref: '#/components/schemas/Rule'
            examples:
              SFCreateColumnPolicyWithBasicRules:
                summary: Snowflake - Column Policy with Rules
                description: This example shows how to create a basic column policy with rules attached. The rules include what role to apply the policy to and the masking policy to use.
                value:
                  policy:
                    identifier: '123'
                    type: COLUMN
                  rules:
                  - masking_policy: 10001
                    role: DEVELOPER_ROLE
              SFCreateTagPolicyWithBasicRules:
                summary: Snowflake - Tag Policy with Tag Name + Tag Value Rules
                description: This example shows how to create a basic tag policy with simple rules attached. The rules include what role to apply the policy to, the tag value and the masking policy to use.
                value:
                  policy:
                    identifier: PII
                    type: TAG
                  rules:
                  - masking_policy: 10001
                    role: DEVELOPER_ROLE
                    tag_value: CREDIT_CARD
              SFCreateTagPolicyWithMultipleRules:
                summary: Snowflake - Tag Policy with Tag Name + Tag Value Multiple Rules
                description: This example shows how to create a tag policy with multiple rules attached. The rules include what role to apply the policy to, and all the tag values and the masking policies to use.
                value:
                  policy:
                    identifier: PII
                    type: TAG
                  rules:
                  - masking_policy: 10001
                    role: DEVELOPER_ROLE
                    tag_value: CREDIT_CARD
                  - masking_policy: 10004
                    role: DEVELOPER_ROLE
                    tag_value: SSN
                  - masking_policy: 10002
                    role: DEVELOPER_ROLE
                    tag_value: DOB
              SFCreateTagPolicyWithTagNameOnly:
                summary: Snowflake - Tag Policy with Tag Name Only Rules
                description: This example shows how to create a basic tag policy with a tag name only rules attached. The rules include what role to apply the policy to, the tag value is a regex of * which indicates that the tag name with any tag value will apply, and the masking policy to use.
                value:
                  policy:
                    identifier: PII
                    type: TAG
                  rules:
                  - masking_policy: 10001
                    role: DEVELOPER_ROLE
                    tag_value_regex: '*'
              SFCreateTagPolicyWithTagNameWithAccessRateThreshold:
                summary: Snowflake - Tag Policy with Tag Name Only and Access Rate Threshold Rules
                description: This example shows how to create a tag policy with a tag name only rules attached with access rate thresholds. The access rate thresholds include a rate limit of 10 per minute and an action of alert.
                value:
                  policy:
                    identifier: PII
                    type: TAG
                  rules:
                  - masking_policy: 10001
                    role: DEVELOPER_ROLE
                    tag_value_regex: '*'
                    access_rate_thresholds:
                    - access_rate_unit: minute
                      access_rate_limit: 10
                      action: ALERT
              SFCreateTagPolicyWithTagNameWithTimeWindowThreshold:
                summary: Snowflake - Tag Policy with Tag Name Only and Time Window Threshold Rules
                description: This example shows how to create a tag policy with a tag name only rules attached with access rate thresholds.
                value:
                  policy:
                    identifier: PII
                    type: TAG
                  rules:
                  - masking_policy: 10001
                    role: DEVELOPER_ROLE
                    tag_value_regex: '*'
                    time_window_thresholds:
                    - day:
                      - monday
                      - tuesday
                      - wednesday
                      - thursday
                      - friday
                      start_time:
                        hour: 9
                        minute: 0
                      end_time:
                        hour: 10
                        minute: 30
                      timezone: America/New_York
                      action: ALERT
              SFCreatePushDownPolicyWithBasicRules:
                summary: Snowflake - Push Down Policy
                description: This example shows how to create a basic push down policy with simple rules attached. The rules include what role to apply the policy to, the tag value and the masking policy to use. Note that for pushdown this is the only way to create a pushdown policy.
                value:
                  policy:
                    identifier: PII
                    type: PUSHDOWN
                  rules:
                  - masking_policy: 10001
                    role: DEVELOPER_ROLE
                    tag_value: CREDIT_CARD
              DBXCreateTagWithBasicRules:
                summary: Databricks - Tag Policy
                description: This example shows how to create a basic tag policy for Databricks with a simple rule attached. The rules include what role to apply the policy to, the tag value and the masking policy to use. Note that for Databricks, this is the only way to create a tag policy for Databricks.
                value:
                  policy:
                    identifier: PII
                    type: TAG
                    database_ids:
                    - 1
                  rules:
                  - masking_policy: 10001
                    role: DEVELOPER_ROLE
                    tag_value: CREDIT_CARD
              DBXCreatePushDownPolicyWithBasicRules:
                summary: Databricks - Push Down Policy
                description: This example shows how to create a basic push down policy for Databricks with a simple rule attached. The rules include what role to apply the policy to, the tag value and the masking policy to use. Note that for Databricks, this is the only way to create a push down for Databricks.
                value:
                  policy:
                    identifier: PII
                    type: PUSHDOWN
                    database_ids:
                    - 1
                  rules:
                  - masking_policy: 10001
                    role: DEVELOPER_ROLE
                    tag_value: CREDIT_CARD
      responses:
        '200':
          description: Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  data:
                    type: object
                    properties:
                      policy_id:
                        type: string
                        example: COLUMN#iiowdjioqi213u90jdd0wau90
                        description: The unique id associated with the policy
                      rule_ids:
                        type: array
                        items:
                          type: string
                          description: The unique id of the rule
                          example: TAG#896c2bbf427ca7fe55e2bb30dfd722c1eb91a09c44e6d14bd5a754754c1ee79e#ROLE#a0192a8d618436d26d78ac6df5bfa2455e1fae549577282669d37d8cfb1ebe1c#TAG_VALUE#7b546b3e08faa6882d4b1f762f9c76492168144d864668776fe9ffb2af018805
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalError'
  /policy/rules/supportedMaskingTypes:
    get:
      tags:
      - policy
      summary: Fetch supported masking types for different databases and policy types
      description: Retrieve all supported masking types for policies based on the policy type and database type.
      parameters:
      - name: policy_type
        in: query
        required: true
        schema:
          type: string
          enum:
          - tag
          - column
          - tag_pushdown
          example: tag
        description: Type of the policy for which masking types are being queried. E.g.,  'tag','column', 'tag_pushdown'.
      - name: database_type
        in: query
        required: false
        schema:
          type: string
          enum:
          - snowflake
          - databricks
          example: snowflake
        description: The database type for which the masking types are being requested. E.g., 'snowflake', 'databricks'.
      - name: field_id
        in: query
        required: false
        schema:
          type: int
          example: 15050
        description: ' A corresponding field id for column based requests'
      responses:
        '200':
          description: A list of supported masking types
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    example: true
                    description: Indicates if the response was successful.
                  data:
                    type: array
                    description: The list of supported masking types.
                    items:
                      type: object
                      properties:
                        permissive_index:
                          type: integer
                          example: 90
                          description: The priority index of the masking type.
                        masking_type:
                          type: integer
                          example: 10000
                          description: The ID of the masking policy.
                        title:
                          type: string
                          example: No Mask
                          description: The title of the masking type.
                        instruction:
                          type: string
                          example: A
                          description: The instruction related to the masking type.
                        database_type:
                          type: array
                          items:
                            type: string
                          example:
                          - snowflake
                          description: The list of database types supported by this masking type.
                        supported_snowflake_tag_types:
                          type: array
                          items:
                            type: string
                          example:
                          - governed
                          - tokenized_vault
                          - encryption_fpe
                          description: The Snowflake tag types supported by this masking type.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalError'
  /policy/reportUrl/{policy_id}:
    get:
      operationId: getPolicyReportUrl
      tags:
      - policy
      summary: Generates a S3 presigned URL which contains the policy report from the most recent report id.
      description: Given the policy id, this endpoint will generate a presigned URL that will allow you to download the report. The URL will expire in 15 minutes. This endpoint grabs the most recent report id for the policy and generates a presigned URL for that report.
      parameters:
      - name: policy_id
        description: The policy id, this can be found in the response of an access management policy.
        in: path
        required: true
        schema:
          type: string
      - name: format
        in: query
        required: true
        schema:
          type: string
          enum:
          - csv
          default: csv
      responses:
        '200':
          description: Successfully generated presigned URL
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    example: true
                  data:
                    type: object
                    properties:
                      report_url:
                        type: string
                        example: https://example-bucket.s3.amazonaws.com/report.csv?AWSAccessKeyId=AKIA...&Expires=1609459200&Signature=...
                      expiration:
                        type: integer
                        example: 900000
        '400':
          description: Bad Request
        '404':
          description: Report Not Found
        '500':
          description: Internal Server Error
  /policy/reportUrl/{policy_id}/{report_id}:
    get:
      tags:
      - policy
      summary: Generates a S3 presigned URL which contains the policy report given the policy id and report id.
      description: Given the policy id and report id, this endpoint will generate a presigned URL that will allow you to download the report. The URL will expire in 15 minutes. This endpoint generates a presigned URL for the given report and policy.
      parameters:
      - name: policy_id
        description: The policy id, this can be found in the response of an access management policy.
        in: path
        required: true
        schema:
          type: string
      - name: report_id
        description: The report id, this can be found in the response of an access management policy.
        in: path
        required: true
        schema:
          type: string
      - name: format
        in: query
        required: true
        schema:
          type: string
          enum:
          - csv
          default: csv
      responses:
        '200':
          description: Successfully generated presigned URL
          content:
            application/json:
              schema:
                type: object
                properties:
                  report_url:
                    type: string
                    example: https://example-bucket.s3.amazonaws.com/report.csv?AWSAccessKeyId=AKIA...&Expires=1609459200&Signature=...
                  expiration:
                    type: integer
                    example: 900000
        '400':
          description: Bad Request
        '404':
          description: Report Not Found
        '500':
          description: Internal Server Error
  /policy/{policy_id}/reports:
    get:
      tags:
      - policy
      summary: Returns all reports for a policy.
      description: Given the policy id, this endpoint will return a list of reports.
      parameters:
      - name: policy_id
        description: The policy id, this can be found in the response of an access management policy.
        in: path
        required: true
        schema:
          type: string
      - name: limit
        description: The number of policies to return
        example: 10
        in: query
        schema:
          type: integer
      - name: exclusive_start_key
        schema:
          type: string
        description: The last evaluated key for pagination. This can be found in the response body under `last_evaluated_key`. If the value is present, it can be used to get the next set of policies.
        in: query
      responses:
        '200':
          description: Successfully returned reports
          content:
            application/json:
              schema:
                type: object
                properties:
                  reports:
                    type: array
                    example: '[]'
        '400':
          description: Bad Request
        '404':
          description: Policy Not Found
        '500':
          description: Internal Server Error
  /policy/accessManagement/snowflake:
    post:
      operationId: createAccessManagementPolicySnowflake
      tags:
      - policy
      summary: Creates a access management policy for a Snowflake datasource.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessManagementPolicy'
            examples:
              BasicAccessManagementPolicy:
                summary: Basic Access Management Policy
                description: This is a basic access management policy that will grant read access to the database MY_DATABASE for the role SECURITYADMIN.
                value:
                  policy_name: My Basic Policy
                  description: This is a basic policy that doesn't do much.
                  connection_ids:
                  - 1
                  rules:
                  - actors:
                    - type: role
                      condition: equals
                      identifiers:
                      - SECURITYADMIN
                    objects:
                    - type: database
                      condition: equals
                      identifiers:
                      - MY_DATABASE
                    access:
                    - name: read
              StartsWithAccessManagementPolicy:
                summary: Access Management Policy Starts With Condition
                description: This is a access management policy that will grant read access to all database in your Snowflake account that have the prefix of 'DEV_' for all roles that have the prefix of 'DEV_ENGINEER_'.
                value:
                  policy_name: My Is A Starts With Policy
                  description: This is a basic policy description.
                  connection_ids:
                  - 1
                  rules:
                  - actors:
                    - type: role
                      condition: starts_with
                      identifiers:
                      - DEV_ENGINEER_
                    objects:
                    - type: database
                      condition: equals
                      identifiers:
                      - DEV_
                    access:
                    - name: read
              FullyQualifiedAccessManagementPolicy:
                summary: Fully Qualified Access Management Policy
                description: This is a access management policy that grants access to the very specified table (fully qualified) to all roles that end_with _ENGINEER.
                value:
                  policy_name: My Fully Qualified Policy
                  description: This is a basic Fully Qualified policy.
                  connection_ids:
                  - 1
                  rules:
                  - actors:
                    - type: role
                      condition: ends_with
                      identifiers:
                      - _ENGINEER
                    objects:
                    - type: database
                      condition: fully_qualified
                      fully_qualified_identifiers:
                      - database: MY_DATABASE
                        schema: PUBLIC
                        table: MY_TABLE
                    access:
                    - name: read
              BasicAccessManagementPolicyWithMaintenance:
                summary: Basic Access Management Policy With Maintenance Day Rate
                description: This is a basic access management policy that will grant read access to the database MY_DATABASE for the role SECURITYADMIN and will re-run every day that is specified.
                value:
                  policy_name: My Basic Policy
                  description: This is a basic policy that doesn't do much.
                  connection_ids:
                  - 1
                  policy_maintenance:
                    rate: day
                    value: 1
                  rules:
                  - actors:
                    - type: role
                      condition: equals
                      identifiers:
                      - SECURITYADMIN
                    objects:
                    - type: database
                      condition: equals
                      identifiers:
                      - MY_DATABASE
                    access:
                    - name: read
              BasicAccessManagementPolicyWithMaintenanceCron:
                summary: Basic Access Management Policy With Maintenance Cron Rate
                description: This is a basic access management policy that will grant read access to the database MY_DATABASE for the role SECURITYADMIN and will re-run every day that is specified by the cron expression.
                value:
                  policy_name: My Basic Policy
                  description: This is a basic policy that doesn't do much.
                  connection_ids:
                  - 1
                  policy_maintenance:
                    rate: cron
                    value: 0 12 * * ? *
                  rules:
                  - actors:
                    - type: role
                      condition: equals
                      identifiers:
                      - SECURITYADMIN
                    objects:
                    - type: database
                      condition: equals
                      identifiers:
                      - MY_DATABASE
                    access:
                    - name: read
              AccessManagementPolicyWithTag:
                summary: Access Management Policy With Tag
                description: This is an access management policy that grants read access to all databases tagged with 'sensitive_data' having the value 'PII' for the role 'SECURITYADMIN'.
                value:
                  policy_name: My AMP Policy with Tags
                  description: This is a basic policy that has a tag.
                  connection_ids:
                  - 1
                  rules:
                  - actors:
                    - type: role
                      condition: equals
                      identifiers:
                      - SECURITYADMIN
                    tagged_objects:
                    - check_against:
                      - databases
                      tagged_with:
                      - database: MY_DATABASE
                        schema: PUBLIC
                        name: sensitive_data
                        value: PII
                      tag_condition: and
                    access:
                    - name: read
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessManagementPolicyResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalError'
  /policy/accessManagement/oltp:
    post:
      operationId: createAccessManagementPolicyOltp
      tags:
      - policy
      summary: Creates a access management policy for an OLTP datasource.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OltpPolicyRequest'
            examples:
              FullyQualifiedAccessManagementPolicy:
                summary: Basic Access Management Policy
                description: This is a basic access management policy that will grant read access to the database MY_DATABASE for the role SECURITYADMIN.
                value:
                  policy_name: My Basic Policy
                  description: This is a basic policy that doesn't do much.
                  repo_name: my-repo
                  database_type: 4
                  database_type_name: oracle
                  case_sensitivity: case_sensitive
                  rules:
                  - type: read
                    actors:
                    - type: idp_user
                      condition: equals
                      identifiers:
                      - DANIEL
                    - type: idp_group
                      condition: equals
                      identifiers:
                      - ADMINS
                    objects:
                    - type: column
                      identifiers:
                      - database:
                          name: MY_DATABASE
                        schema:
                          name: MY_SCHEMA
                        table:
                          name: MY_TABLE
                        column:
                          name: MY_COLUMN
              WildcardAccessManagementPolicy:
                summary: Fully Qualified Access Management Policy
                description: This is a access management policy that grants access to the very specified table (fully qualified) to all roles that end_with _ENGINEER.
                value:
                  policy_name: My Wildcard Policy
                  description: This is a basic wildcard policy that doesn't do much.
                  repo_name: my-repo
                  database_type: 4
                  database_type_name: oracle
                  rules:
                  - type: read
                    actors:
                    - type: idp_user
                      condition: equals
                      identifiers:
                      - DANIEL
                    - type: idp_group
                      condition: equals
                      identifiers:
                      - ADMINS
                    objects:
                    - type: column
                      identifiers:
                      - database:
                          name: MY_DATABASE
                        schema:
                          name: MY_SCHEMA
                        table:
                          wildcard: true
                        column:
                          wildcard: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OltpPolicyResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalError'
  /policy/accessManagement/snowflake/{policy_id}:
    put:
      operationId: updateAccessManagementPolicySnowflake
      tags:
      - policy
      summary: Updates an existing access management policy for a Snowflake datasource.
      parameters:
      - name: policy_id
        in: path
        required: true
        schema:
          type: string
        description: The unique identifier for the policy.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessManagementPolicyUpdate'
            examples:
              BasicAccessManagementPolicy:
                summary: Basic Access Management Policy
                description: This is a basic access management policy that will grant read access to the database MY_DATABASE for the role SECURITYADMIN.
                value:
                  policy_name: My Basic Policy Is Updated
                  description: This is a basic policy that doesn't do much.
                  rules:
                  - actors:
                    - type: role
                      condition: equals
                      identifiers:
                      - SECURITYADMIN
                    objects:
                    - type: database
                      condition: equals
                      identifiers:
                      - MY_DATABASE
                    access:
                    - name: read
      responses:
        '202':
          description: Successfully updated the policy.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    example: true
                  data:
                    type: object
                    properties:
                      policy_id:
                        type: string
                        example: GRANT#afe0b9c9-3a29-4de5-95d4-25a39787e157#DATABASE_TYPE#9
                      policy:
                        $ref: '#/components/schemas/AccessManagementPolicyResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalError'
  /policy/accessManagement/triggerCheck/{policy_id}:
    put:
      operationId: triggerAccessManagementPolicyCheck
      tags:
      - policy
      summary: Trigger a manual check for a grant policy
      description: This endpoint triggers a manual run for a grant policy and updates its status to pending.
      parameters:
      - name: policy_id
        in: path
        required: true
        schema:
          type: string
        description: The unique identifier for the policy.
      responses:
        '202':
          description: Successfully triggered the manual check for the policy.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    example: true
                  data:
                    type: object
                    properties:
                      policy_id:
                        type: string
                        example: GRANT#afe0b9c9-3a29-4de5-95d4-25a39787e157#DATABASE_TYPE#9
                      policy:
                        $ref: '#/components/schemas/AccessManagementPolicyResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
       

# --- truncated at 32 KB (94 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/altr/refs/heads/main/openapi/altr-policy-api-openapi.yml