Oximy Policy API

openapi: 3.1.0
info:
  title: Oximy Public Init Policy API
  version: '1.0'
  summary: Telemetry ingestion and AI-usage policy enforcement for LLM applications.
  description: The Oximy Public API backs the official Oximy SDKs. It initializes a project (settings + policy), ingests LLM telemetry events, serves the active policy configuration, and evaluates content against server-side (SLM) policy rules. This description was reconstructed faithfully from the published `oximy` npm SDK (v0.0.7) source — endpoint paths, HTTP methods, auth headers, and request and response shapes are taken verbatim from the SDK; it is not an official Oximy-published OpenAPI document.
  contact:
    name: Oximy Support
    email: support@oximy.com
    url: https://oximy.com
  x-logo:
    url: https://oximy.com
servers:
- url: https://api.oximy.com
  description: Production
security:
- bearerAuth: []
  projectId: []
tags:
- name: Policy
  description: Policy configuration and server-side rule evaluation.
paths:
  /v1/policy:
    get:
      operationId: getPolicy
      tags:
      - Policy
      summary: Get active policy
      description: Returns the current policy configuration (version, mode, rules) for the project.
      responses:
        '200':
          description: Policy configuration.
          content:
            application/json:
              schema:
                type: object
                properties:
                  policy:
                    $ref: '#/components/schemas/PolicyConfig'
        '401':
          description: Missing or invalid API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /v1/evaluate:
    post:
      operationId: evaluatePolicy
      tags:
      - Policy
      summary: Evaluate content against SLM policy rules
      description: Evaluates request or response content against server-side (SLM-tier) policy rules — AI-powered PII detection, prompt-injection detection, and custom content classification. Supports single-rule and batch-rule request shapes.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EvaluateRequest'
      responses:
        '200':
          description: Evaluation result.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EvaluateResponse'
        '401':
          description: Missing or invalid API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    PolicyRule:
      type: object
      properties:
        id:
          type: string
        enabled:
          type: boolean
        name:
          type: string
        description:
          type: string
        tier:
          type: string
          enum:
          - local
          - slm
        target:
          type: object
          properties:
            scope:
              type: string
              enum:
              - input
              - output
              - tool_call
              - tool_result
              - mcp
            path:
              type: string
        severity:
          type: string
          enum:
          - low
          - medium
          - high
          - critical
    EvaluateResponse:
      type: object
      properties:
        triggered:
          type: boolean
        confidence:
          type: number
        matches:
          type: array
          items:
            type: object
            additionalProperties: true
        transformedContent:
          type: string
        detections:
          type: array
          items:
            type: object
            properties:
              type:
                type: string
              value:
                type: string
              start:
                type: integer
              end:
                type: integer
              confidence:
                type: number
    EvaluateRequest:
      type: object
      description: SLM rule evaluation request. The SDK sends either a single-rule shape (rule_id + content + context) or a batch shape (projectId + requestId + content + rules[]).
      properties:
        projectId:
          type: string
        requestId:
          type: string
        rule_id:
          type: string
        content:
          type: string
        rules:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
              match:
                type: object
                additionalProperties: true
              action:
                type: object
                additionalProperties: true
              target:
                type: object
                additionalProperties: true
        context:
          type: object
          additionalProperties: true
    PolicyMode:
      type: string
      enum:
      - shadow
      - quarantine
      - enforce
    Error:
      type: object
      description: Fallback error envelope (SDK-side OximyError shape).
      properties:
        code:
          type: string
          enum:
          - init_failed
          - telemetry_failed
          - policy_fetch_failed
          - policy_evaluation_failed
          - invalid_config
          - network_error
          - timeout
          - unknown
        message:
          type: string
        details:
          type: object
          additionalProperties: true
    PolicyConfig:
      type: object
      properties:
        version:
          type: integer
        mode:
          $ref: '#/components/schemas/PolicyMode'
        rules:
          type: array
          items:
            $ref: '#/components/schemas/PolicyRule'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Project API key presented as `Authorization: Bearer <apiKey>`. Keys use the `ox_` prefix.'
    projectId:
      type: apiKey
      in: header
      name: X-Project-Id
      description: Project identifier (`proj_` prefix). Sent alongside the bearer key on init and event ingestion.