Contract
- shape
- entity
- authority
- read
- evidence
- none
- subscription
- false
- permission
- any one of: staff.read (the staff role staff_read held in the Internal org, tradehq_role.staff_role); org.admin (carried by the caller's role template in the org `org_id`); account.owner (account role owner or higher in the account of the org `org_id`); a deactivated caller is refused first
- idempotency
- safe
- emits
- none
- MCP tool
- get_security_policy
- REST
- POST https://api.containertradehq.com/v1/cap/get_security_policy
Idempotency: a read: calling again changes nothing
Inputs
| name | type | required | validation |
|---|---|---|---|
| org_id | org_id | required | tradehq-org-id; 1 to 20 characters The org whose security settings to read. |
Response
org_id· string · The org.sections· object · Every section, keyed by its name.
Full JSON Schema
{
"type": "object",
"properties": {
"org_id": {
"type": "string",
"minLength": 1,
"maxLength": 20,
"pattern": "^[A-Za-z0-9_-]{1,20}$",
"format": "tradehq-org-id",
"description": "The org.",
"x-data-class": "operational"
},
"sections": {
"type": "object",
"properties": {
"sso": {
"type": "object",
"properties": {
"section": {
"type": "string",
"enum": [
"sso",
"mfa",
"session",
"network",
"drift"
]
},
"policy": {
"oneOf": [
{
"type": "object",
"properties": {
"domains": {
"type": "array",
"items": {
"type": "object",
"properties": {
"domain": {
"type": "string"
},
"required": {
"type": "boolean"
},
"bypass_until": {
"type": [
"string",
"null"
],
"format": "date-time"
}
},
"required": [
"domain",
"required",
"bypass_until"
],
"additionalProperties": false
}
},
"connections": {
"type": "array",
"items": {
"type": "object",
"properties": {
"connection_id": {
"type": "string"
},
"jit": {
"type": "boolean"
},
"default_role_template": {
"type": [
"string",
"null"
]
},
"idp_mfa_trusted": {
"type": "boolean"
},
"allow_manual_additions": {
"type": "boolean"
}
},
"required": [
"connection_id",
"jit",
"default_role_template",
"idp_mfa_trusted",
"allow_manual_additions"
],
"additionalProperties": false
}
}
},
"required": [
"domains",
"connections"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"mode": {
"type": "string",
"enum": [
"off",
"required",
"required_for_templates"
]
},
"templates": {
"type": "array",
"items": {
"type": "string"
}
},
"grace_days": {
"type": "integer",
"minimum": 0,
"maximum": 30
},
"accept_idp_mfa": {
"type": "boolean"
}
},
"required": [
"mode",
"templates",
"grace_days",
"accept_idp_mfa"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"idle_minutes": {
"type": "integer",
"minimum": 15,
"maximum": 1440
},
"absolute_hours": {
"type": "integer",
"minimum": 1,
"maximum": 168
},
"reauth_on_role_change": {
"type": "boolean"
},
"single_session": {
"type": "boolean"
}
},
"required": [
"idle_minutes",
"absolute_hours",
"reauth_on_role_change",
"single_session"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"mode": {
"type": "string",
"enum": [
"off",
"monitor",
"enforce"
]
},
"entries": {
"type": "array",
"items": {
"type": "object",
"properties": {
"cidr": {
"type": "string"
},
"label": {
"type": "string"
}
},
"required": [
"cidr",
"label"
],
"additionalProperties": false
}
},
"applies_to": {
"type": "string",
"enum": [
"members",
"api_keys",
"both"
]
}
},
"required": [
"mode",
"entries",
"applies_to"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"action": {
"type": "string",
"enum": [
"quarantine",
"alert_only"
]
}
},
"required": [
"action"
],
"additionalProperties": false
}
]
},
"is_default": {
"type": "boolean"
},
"version": {
"type": [
"integer",
"null"
],
"minimum": 1
},
"changed_by": {
"type": [
"string",
"null"
]
},
"changed_at": {
"type": [
"string",
"null"
],
"format": "date-time"
}
},
"required": [
"section",
"policy",
"is_default",
"version",
"changed_by",
"changed_at"
],
"additionalProperties": false
},
"mfa": {
"type": "object",
"properties": {
"section": {
"type": "string",
"enum": [
"sso",
"mfa",
"session",
"network",
"drift"
]
},
"policy": {
"oneOf": [
{
"type": "object",
"properties": {
"domains": {
"type": "array",
"items": {
"type": "object",
"properties": {
"domain": {
"type": "string"
},
"required": {
"type": "boolean"
},
"bypass_until": {
"type": [
"string",
"null"
],
"format": "date-time"
}
},
"required": [
"domain",
"required",
"bypass_until"
],
"additionalProperties": false
}
},
"connections": {
"type": "array",
"items": {
"type": "object",
"properties": {
"connection_id": {
"type": "string"
},
"jit": {
"type": "boolean"
},
"default_role_template": {
"type": [
"string",
"null"
]
},
"idp_mfa_trusted": {
"type": "boolean"
},
"allow_manual_additions": {
"type": "boolean"
}
},
"required": [
"connection_id",
"jit",
"default_role_template",
"idp_mfa_trusted",
"allow_manual_additions"
],
"additionalProperties": false
}
}
},
"required": [
"domains",
"connections"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"mode": {
"type": "string",
"enum": [
"off",
"required",
"required_for_templates"
]
},
"templates": {
"type": "array",
"items": {
"type": "string"
}
},
"grace_days": {
"type": "integer",
"minimum": 0,
"maximum": 30
},
"accept_idp_mfa": {
"type": "boolean"
}
},
"required": [
"mode",
"templates",
"grace_days",
"accept_idp_mfa"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"idle_minutes": {
"type": "integer",
"minimum": 15,
"maximum": 1440
},
"absolute_hours": {
"type": "integer",
"minimum": 1,
"maximum": 168
},
"reauth_on_role_change": {
"type": "boolean"
},
"single_session": {
"type": "boolean"
}
},
"required": [
"idle_minutes",
"absolute_hours",
"reauth_on_role_change",
"single_session"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"mode": {
"type": "string",
"enum": [
"off",
"monitor",
"enforce"
]
},
"entries": {
"type": "array",
"items": {
"type": "object",
"properties": {
"cidr": {
"type": "string"
},
"label": {
"type": "string"
}
},
"required": [
"cidr",
"label"
],
"additionalProperties": false
}
},
"applies_to": {
"type": "string",
"enum": [
"members",
"api_keys",
"both"
]
}
},
"required": [
"mode",
"entries",
"applies_to"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"action": {
"type": "string",
"enum": [
"quarantine",
"alert_only"
]
}
},
"required": [
"action"
],
"additionalProperties": false
}
]
},
"is_default": {
"type": "boolean"
},
"version": {
"type": [
"integer",
"null"
],
"minimum": 1
},
"changed_by": {
"type": [
"string",
"null"
]
},
"changed_at": {
"type": [
"string",
"null"
],
"format": "date-time"
}
},
"required": [
"section",
"policy",
"is_default",
"version",
"changed_by",
"changed_at"
],
"additionalProperties": false
},
"session": {
"type": "object",
"properties": {
"section": {
"type": "string",
"enum": [
"sso",
"mfa",
"session",
"network",
"drift"
]
},
"policy": {
"oneOf": [
{
"type": "object",
"properties": {
"domains": {
"type": "array",
"items": {
"type": "object",
"properties": {
"domain": {
"type": "string"
},
"required": {
"type": "boolean"
},
"bypass_until": {
"type": [
"string",
"null"
],
"format": "date-time"
}
},
"required": [
"domain",
"required",
"bypass_until"
],
"additionalProperties": false
}
},
"connections": {
"type": "array",
"items": {
"type": "object",
"properties": {
"connection_id": {
"type": "string"
},
"jit": {
"type": "boolean"
},
"default_role_template": {
"type": [
"string",
"null"
]
},
"idp_mfa_trusted": {
"type": "boolean"
},
"allow_manual_additions": {
"type": "boolean"
}
},
"required": [
"connection_id",
"jit",
"default_role_template",
"idp_mfa_trusted",
"allow_manual_additions"
],
"additionalProperties": false
}
}
},
"required": [
"domains",
"connections"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"mode": {
"type": "string",
"enum": [
"off",
"required",
"required_for_templates"
]
},
"templates": {
"type": "array",
"items": {
"type": "string"
}
},
"grace_days": {
"type": "integer",
"minimum": 0,
"maximum": 30
},
"accept_idp_mfa": {
"type": "boolean"
}
},
"required": [
"mode",
"templates",
"grace_days",
"accept_idp_mfa"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"idle_minutes": {
"type": "integer",
"minimum": 15,
"maximum": 1440
},
"absolute_hours": {
"type": "integer",
"minimum": 1,
"maximum": 168
},
"reauth_on_role_change": {
"type": "boolean"
},
"single_session": {
"type": "boolean"
}
},
"required": [
"idle_minutes",
"absolute_hours",
"reauth_on_role_change",
"single_session"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"mode": {
"type": "string",
"enum": [
"off",
"monitor",
"enforce"
]
},
"entries": {
"type": "array",
"items": {
"type": "object",
"properties": {
"cidr": {
"type": "string"
},
"label": {
"type": "string"
}
},
"required": [
"cidr",
"label"
],
"additionalProperties": false
}
},
"applies_to": {
"type": "string",
"enum": [
"members",
"api_keys",
"both"
]
}
},
"required": [
"mode",
"entries",
"applies_to"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"action": {
"type": "string",
"enum": [
"quarantine",
"alert_only"
]
}
},
"required": [
"action"
],
"additionalProperties": false
}
]
},
"is_default": {
"type": "boolean"
},
"version": {
"type": [
"integer",
"null"
],
"minimum": 1
},
"changed_by": {
"type": [
"string",
"null"
]
},
"changed_at": {
"type": [
"string",
"null"
],
"format": "date-time"
}
},
"required": [
"section",
"policy",
"is_default",
"version",
"changed_by",
"changed_at"
],
"additionalProperties": false
},
"network": {
"type": "object",
"properties": {
"section": {
"type": "string",
"enum": [
"sso",
"mfa",
"session",
"network",
"drift"
]
},
"policy": {
"oneOf": [
{
"type": "object",
"properties": {
"domains": {
"type": "array",
"items": {
"type": "object",
"properties": {
"domain": {
"type": "string"
},
"required": {
"type": "boolean"
},
"bypass_until": {
"type": [
"string",
"null"
],
"format": "date-time"
}
},
"required": [
"domain",
"required",
"bypass_until"
],
"additionalProperties": false
}
},
"connections": {
"type": "array",
"items": {
"type": "object",
"properties": {
"connection_id": {
"type": "string"
},
"jit": {
"type": "boolean"
},
"default_role_template": {
"type": [
"string",
"null"
]
},
"idp_mfa_trusted": {
"type": "boolean"
},
"allow_manual_additions": {
"type": "boolean"
}
},
"required": [
"connection_id",
"jit",
"default_role_template",
"idp_mfa_trusted",
"allow_manual_additions"
],
"additionalProperties": false
}
}
},
"required": [
"domains",
"connections"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"mode": {
"type": "string",
"enum": [
"off",
"required",
"required_for_templates"
]
},
"templates": {
"type": "array",
"items": {
"type": "string"
}
},
"grace_days": {
"type": "integer",
"minimum": 0,
"maximum": 30
},
"accept_idp_mfa": {
"type": "boolean"
}
},
"required": [
"mode",
"templates",
"grace_days",
"accept_idp_mfa"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"idle_minutes": {
"type": "integer",
"minimum": 15,
"maximum": 1440
},
"absolute_hours": {
"type": "integer",
"minimum": 1,
"maximum": 168
},
"reauth_on_role_change": {
"type": "boolean"
},
"single_session": {
"type": "boolean"
}
},
"required": [
"idle_minutes",
"absolute_hours",
"reauth_on_role_change",
"single_session"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"mode": {
"type": "string",
"enum": [
"off",
"monitor",
"enforce"
]
},
"entries": {
"type": "array",
"items": {
"type": "object",
"properties": {
"cidr": {
"type": "string"
},
"label": {
"type": "string"
}
},
"required": [
"cidr",
"label"
],
"additionalProperties": false
}
},
"applies_to": {
"type": "string",
"enum": [
"members",
"api_keys",
"both"
]
}
},
"required": [
"mode",
"entries",
"applies_to"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"action": {
"type": "string",
"enum": [
"quarantine",
"alert_only"
]
}
},
"required": [
"action"
],
"additionalProperties": false
}
]
},
"is_default": {
"type": "boolean"
},
"version": {
"type": [
"integer",
"null"
],
"minimum": 1
},
"changed_by": {
"type": [
"string",
"null"
]
},
"changed_at": {
"type": [
"string",
"null"
],
"format": "date-time"
}
},
"required": [
"section",
"policy",
"is_default",
"version",
"changed_by",
"changed_at"
],
"additionalProperties": false
},
"drift": {
"type": "object",
"properties": {
"section": {
"type": "string",
"enum": [
"sso",
"mfa",
"session",
"network",
"drift"
]
},
"policy": {
"oneOf": [
{
"type": "object",
"properties": {
"domains": {
"type": "array",
"items": {
"type": "object",
"properties": {
"domain": {
"type": "string"
},
"required": {
"type": "boolean"
},
"bypass_until": {
"type": [
"string",
"null"
],
"format": "date-time"
}
},
"required": [
"domain",
"required",
"bypass_until"
],
"additionalProperties": false
}
},
"connections": {
"type": "array",
"items": {
"type": "object",
"properties": {
"connection_id": {
"type": "string"
},
"jit": {
"type": "boolean"
},
"default_role_template": {
"type": [
"string",
"null"
]
},
"idp_mfa_trusted": {
"type": "boolean"
},
"allow_manual_additions": {
"type": "boolean"
}
},
"required": [
"connection_id",
"jit",
"default_role_template",
"idp_mfa_trusted",
"allow_manual_additions"
],
"additionalProperties": false
}
}
},
"required": [
"domains",
"connections"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"mode": {
"type": "string",
"enum": [
"off",
"required",
"required_for_templates"
]
},
"templates": {
"type": "array",
"items": {
"type": "string"
}
},
"grace_days": {
"type": "integer",
"minimum": 0,
"maximum": 30
},
"accept_idp_mfa": {
"type": "boolean"
}
},
"required": [
"mode",
"templates",
"grace_days",
"accept_idp_mfa"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"idle_minutes": {
"type": "integer",
"minimum": 15,
"maximum": 1440
},
"absolute_hours": {
"type": "integer",
"minimum": 1,
"maximum": 168
},
"reauth_on_role_change": {
"type": "boolean"
},
"single_session": {
"type": "boolean"
}
},
"required": [
"idle_minutes",
"absolute_hours",
"reauth_on_role_change",
"single_session"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"mode": {
"type": "string",
"enum": [
"off",
"monitor",
"enforce"
]
},
"entries": {
"type": "array",
"items": {
"type": "object",
"properties": {
"cidr": {
"type": "string"
},
"label": {
"type": "string"
}
},
"required": [
"cidr",
"label"
],
"additionalProperties": false
}
},
"applies_to": {
"type": "string",
"enum": [
"members",
"api_keys",
"both"
]
}
},
"required": [
"mode",
"entries",
"applies_to"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"action": {
"type": "string",
"enum": [
"quarantine",
"alert_only"
]
}
},
"required": [
"action"
],
"additionalProperties": false
}
]
},
"is_default": {
"type": "boolean"
},
"version": {
"type": [
"integer",
"null"
],
"minimum": 1
},
"changed_by": {
"type": [
"string",
"null"
]
},
"changed_at": {
"type": [
"string",
"null"
],
"format": "date-time"
}
},
"required": [
"section",
"policy",
"is_default",
"version",
"changed_by",
"changed_at"
],
"additionalProperties": false
}
},
"required": [
"sso",
"mfa",
"session",
"network",
"drift"
],
"additionalProperties": false,
"description": "Every section, keyed by its name.",
"x-data-class": "operational"
}
},
"required": [
"org_id",
"sections"
],
"additionalProperties": false
} Refusals
security_policy_unenforced· 422 · a stored section of the org's security settings does not parse; the step that applies them refuses the org's requests with the same code until a person restores it
The platform refusals apply to every call: version, authentication, authority, validation and rate limits, each in the same envelope.
Surfaces
DesktopF
MobileF
APIF
MCPF
VoiceD4
PushN
OneBoxN
OutboundN
- Voice: degraded: visualization
- Push: emits nothing
- OneBox: no document originates a security setting
- Outbound: crosses to no counterparty
Events
None emitted.
Related
None.