Resolve policy

Resolve a single policy by ID. Optionally pin to an immutable published version. Registry publications include canonical_content and its RFC 8785 SHA-256 content_digest; a version that was never published returns not found.

GET /api/policies/resolve

Resolve policy

cURL

curl --request GET \
  --url https://agenticadvertising.org/api/policies/resolve

200

{
  "policy_id": "gdpr_consent",
  "version": "1.0.0",
  "name": "GDPR Consent Requirements",
  "description": "Requirements for valid consent under GDPR",
  "category": "regulation",
  "enforcement": "must",
  "jurisdictions": [
    "EU",
    "EEA"
  ],
  "region_aliases": {
    "EU": [
      "DE",
      "FR",
      "IT"
    ]
  },
  "policy_categories": [
    "age_restricted",
    "pharmaceutical_advertising"
  ],
  "channels": [
    "display",
    "video"
  ],
  "governance_domains": [
    "campaign",
    "creative"
  ],
  "effective_date": "2025-05-25T00:00:00.000Z",
  "sunset_date": "<string>",
  "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
  "source_name": "EUR-Lex",
  "issuer": {
    "domain": "<string>",
    "name": "<string>"
  },
  "acceptance_profile": {
    "profile_id": "<string>",
    "version": "<string>",
    "content_digest": "<string>",
    "policy_refs": [
      {
        "policy_id": "<string>",
        "version": "<string>",
        "content_digest": "<string>"
      }
    ],
    "coverage": "partial",
    "rules": [
      {
        "rule_id": "<string>",
        "subject_category": "<string>",
        "applies_to": [
          "account"
        ],
        "disposition": "allowed",
        "subject_facets": [
          "<string>"
        ],
        "advertiser_roles": [
          "<string>"
        ],
        "jurisdictions": [
          "<string>"
        ],
        "jurisdiction_groups": [
          "<string>"
        ],
        "requirements": [
          {
            "kind": "category_declaration",
            "declaration": "<string>",
            "description": "<string>"
          }
        ],
        "policy_ids": [
          "<string>"
        ],
        "description": "<string>",
        "effective_at": "2023-11-07T05:31:56Z",
        "expires_at": "2023-11-07T05:31:56Z",
        "ext": {}
      }
    ],
    "scope": {
      "subject_categories": [
        "<string>"
      ],
      "applies_to": [
        "account"
      ],
      "jurisdictions": [
        "<string>"
      ],
      "jurisdiction_groups": [
        "<string>"
      ],
      "all_jurisdictions": true
    },
    "region_aliases": {},
    "description": "<string>",
    "ext": {}
  },
  "content_digest": "<string>",
  "canonical_content": {},
  "policy": "Data subjects must provide freely given, specific, informed and unambiguous consent...",
  "guidance": "<string>",
  "exemplars": {
    "pass": [
      {
        "scenario": "Ad for alcohol shown during children's programming",
        "explanation": "Violates watershed timing rules for alcohol advertising"
      }
    ],
    "fail": [
      {
        "scenario": "Ad for alcohol shown during children's programming",
        "explanation": "Violates watershed timing rules for alcohol advertising"
      }
    ]
  },
  "ext": {},
  "source_type": "registry",
  "review_status": "pending",
  "created_at": "2026-03-01T12:00:00.000Z",
  "updated_at": "2026-03-01T12:00:00.000Z"
}

Query Parameters

policy_id · string · required

Example:

"gdpr_consent"

version · string

Return null if the current version does not match

Response

200

application/json

Policy resolved

policy_id · string · required

Example:

"gdpr_consent"

version · string · required

Example:

"1.0.0"

name · string · required

Example:

"GDPR Consent Requirements"

description · string | null · required

Example:

"Requirements for valid consent under GDPR"

category · enum<string> · required

Available options: regulation, standard

enforcement · enum<string> · required

Available options: must, should, may

jurisdictions · string[] · required

Example:

["EU", "EEA"]

region_aliases · object · required

Show child attributes

Example:

{ "EU": ["DE", "FR", "IT"] }

policy_categories · string[] · required

Example:

[
  "age_restricted",
  "pharmaceutical_advertising"
]

channels · string[] | null · required

Example:

["display", "video"]

governance_domains · string[] · required

Example:

["campaign", "creative"]

effective_date · string | null · required

Example:

"2025-05-25T00:00:00.000Z"

sunset_date · string | null · required

source_url · string | null · required

Example:

"https://eur-lex.europa.eu/eli/reg/2016/679/oj"

source_name · string | null · required

Example:

"EUR-Lex"

issuer · object | null · required

Machine-readable identity of the authoritative policy issuer

Show child attributes

acceptance_profile · object | null · required

Version-pinned structured acceptance profile published with an authoritative registry policy

Show child attributes

content_digest · string | null · required

SHA-256 of the RFC 8785 (JCS) serialization of canonical_content. Present for immutable registry publications; null for legacy or community policies.

Pattern: ^sha256:[a-f0-9]{64}$

canonical_content · object | null · required

Exact immutable registry policy document covered by content_digest. This excludes acceptance_profile, which has its own digest. Consumers MUST canonicalize this object with RFC 8785 before verifying content_digest.

Show child attributes

policy · string · required

Example:

"Data subjects must provide freely given, specific, informed and unambiguous consent..."

guidance · string | null · required

exemplars · object | null · required

Show child attributes

ext · object | null · required

Show child attributes

source_type · enum<string> · required

Available options: registry, community

review_status · enum<string> · required

Available options: pending, approved

created_at · string · required

Example:

"2026-03-01T12:00:00.000Z"

updated_at · string · required

Example:

"2026-03-01T12:00:00.000Z"