Org-wide policy inventory, grouped by policy id
Every policy id enforced (or once enforced) anywhere in the organisation, one group per id, with every project/environment occurrence underneath it. Backs the rollup cards and table on Organisation view.
Default scope is every environment, not production — environment and productionOnly are both opt-in narrowings, never the other way around. They narrow the same axis and are mutually exclusive: passing both is a 400.
presentIn / absentFrom on each group describe coverage, not compliance — the numerator and denominator are both projects “measurable” in the current scope. Under a narrowed scope, a project with no matching environment was never measurable and is excluded from the denominator entirely, rather than counted as absent. There is deliberately no field anywhere in this response naming a project non-compliant, failing, or in violation — no standard exists yet for a project to be measured against.
lastAppliedAt on an occurrence is bounded to the trailing 90 days and the most recent 2,000 applies across the organisation (whichever limit is hit first); applyRecencyTruncated reports whether the row cap was hit, and applyRecencyCap echoes the cap that ran. A null lastAppliedAt means no apply landed inside that window — it does not mean the policy was never applied, which is what status: "never_applied" on the same occurrence means instead.
orgId in the path selects the scope: it accepts either the organisation’s slug or its id, and the caller must be a member of it or the request is refused (403). The handler reads the resolved active organisation rather than re-parsing the path segment itself, but the path segment is exactly what determined it.
Authenticated with a dashboard session (browser cookie), not x-api-key, and requires the policy:read permission, which every role (including viewer) has.
Path Parameters
Selects the scope: an organisation slug or id. The caller must be a member of it or the request is refused. See the note above.
Query Parameters
Narrow to one environment slug. Mutually exclusive with productionOnly — passing both is a 400.
64Only the literal strings "true" and "false" are accepted — any other value is a 400 schema-validation error, not a silent fall-through. "true" narrows to environments with isProduction: true; "false" or omitting the parameter leaves the scope at every environment. Mutually exclusive with environment — passing both (with productionOnly=true) is also a 400.
true, false Response
The org's policy inventory in the requested scope.
Response of GET /v1/orgs/{orgId}/policies.
Echoes the scope this response was computed under.
Every environment slug represented in the org, for populating a scope selector.
Projects measurable in the current scope — the denominator behind every group's presentIn / absentFrom.
Whether the apply-recency pass behind every lastAppliedAt hit its row cap.
The row cap the recency pass ran under (currently 2,000, over a trailing 90-day window).

