Policies

Register

POST /v1/policies

name string required

Policy name using the schema naming rules.

version string required

Immutable version tag.

definition object required

OPA definition with engine, entrypoint, modules and optional data.

Successful registration returns 201 with policy_id and digest. Names and versions follow the schema registry naming rules. Save the returned policy_id; do not reconstruct it from an alias or presume a different tenant can access it.

routing.rego

Download routing.rego

package routing
default allow := false
allow if {
  input.output.department in input.state.allowed_departments
  duplicate_consistent
}
duplicate_consistent if { not input.output.duplicate }
duplicate_consistent if { input.output.department == "billing" }

Before you run this example

Call https://api.blatent.ai from your server. Set your API key in the same terminal where you run the example:

export BLATENT_API_KEY='YOUR_SERVICE_KEY'

Python requires Python 3.10+ and HTTPX:

python -m pip install "httpx>=0.28,<1"

TypeScript requires Node.js 24+ and uses its built-in fetch. The cURL examples require curl and jq.

Save the displayed files and the selected client in one directory. Run the client there with python example.py, node example.ts or bash example.sh. Downloads use the example's name in place of example.

Download Python

Python
TypeScript
cURL

import json
import os
from pathlib import Path
import httpx

request = {
    "name": "support/routing",
    "version": "0.0.1",
    "definition": {
        "engine": "opa",
        "entrypoint": "data.routing.allow",
        "modules": {
            "routing.rego": Path("routing.rego").read_text(encoding="utf-8"),
        },
    },
}
with httpx.Client(
    base_url="https://api.blatent.ai",
    headers={"Authorization": f"Bearer {os.environ['BLATENT_API_KEY']}"},
    timeout=195,
) as client:
    response = client.post("/v1/policies", json=request)
    response.raise_for_status()
    print(json.dumps(response.json()["policy_id"]))

import { readFileSync } from "node:fs";

const request = {
    "name": "support/routing",
    "version": "0.0.1",
    "definition": {
        "engine": "opa",
        "entrypoint": "data.routing.allow",
        "modules": {
            "routing.rego": readFileSync("routing.rego", "utf8"),
        },
    },
};
const response = await fetch(
  "https://api.blatent.ai" + "/v1/policies",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.BLATENT_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify(request),
    signal: AbortSignal.timeout(195_000),
  },
);
if (!response.ok) throw new Error(`HTTP ${response.status}: ${await response.text()}`);
console.log(JSON.stringify((await response.json()).policy_id));

set -eu

body=$(jq -n --argjson body '{"name":"support/routing","version":"0.0.1","definition":{"engine":"opa","entrypoint":"data.routing.allow","modules":{}}}' \
  --rawfile f0 'routing.rego' \
  '$body | setpath(["definition","modules","routing.rego"]; $f0)')
curl --fail-with-body --silent --show-error \
  "https://api.blatent.ai/v1/policies" \
  -H "Authorization: Bearer $BLATENT_API_KEY" \
  -H 'Content-Type: application/json' \
  --data-binary "$body"

The Python/TypeScript examples print the returned ID; cURL prints the response. In later resolve requests, set policy_id to that value and omit policy. The inline policy example shows the remaining request fields.

The same definition may be registered at the same version again. Different content returns 409 VERSION_CONFLICT. Change the version when you change the modules, data, entrypoint, description or evaluator identity. Policy aliases are not exposed.

Definition

Field	Contract
`engine`	Required: `opa`
`entrypoint`	Required: a specific rule path such as `data.routing.allow`; its result must be Boolean true
`modules`	Required: object mapping 1–64 filenames to Rego source strings
`data`	Optional immutable JSON object available through Rego `data`
`feedback_entrypoint`	Optional specific rule path returning an array of diagnostics for output fields
`description`	Optional guidance for the model, 1–16,384 UTF-8 bytes. The model reads it instead of the Rego source. OPA still checks every output.

Module filenames must be nonempty and at most 256 bytes; combined filenames and source are limited to 512 KiB. Further registration and execution resource limits may apply.

Rego uses OPA's evaluator for collections, strings, regex, arithmetic and other permitted builtins. Network access, randomness, environment-dependent functions and diagnostic printing are not generally available. Unsupported capabilities fail compilation. Request time is fixed for the logical request; Rego regex does not replace JSON Schema's pattern semantics.

Feedback returns at most eight objects, each containing exactly code, scope and message. scope is an array of object keys or nonnegative array indices identifying the output location. Codes are 1–64 bytes and messages 1–512 bytes; paths have at most 64 components. String components are at most 256 bytes; integer indices are at most 2,147,483,647. The selected feedback mode sends these deliberate diagnostics to the model after denial. Feedback never grants permission.

Inspect

GET /v1/policies/{reference}

Use a version (support/routing:0.0.1) or digest (support/routing@sha256:…) belonging to the authenticated tenant. The response includes policy_id and digest. An unknown/inaccessible reference returns 404 POLICY_NOT_FOUND.

A changed evaluator identity invalidates old versions rather than silently reinterpreting them. Keep your policy source in version control alongside the application that uses it.

Register​

Definition​

Inspect​

Register

Definition

Inspect