> ## Documentation Index > Fetch the complete documentation index at: https://docs.zespan.com/llms.txt > Use this file to discover all available pages before exploring further. # Recent policy applies across every project in the org > Every policy apply across every project in the organisation, newest first, cursor-paginated. Backs the **Recent applies** section on [Organisation view](/dashboard/policies#organisation-view). `origin` is the **entrypoint** that ran the apply — `cli` or `ui` — which is a different fact from a policy's **owner** (`git` or `zespan`, returned as `origin` on an occurrence in the policies response above). A dashboard-authored (`zespan`-owned) policy can be applied by either entrypoint, and a `git`-owned policy applied in CI still reports `origin: "cli"` here; never read one field as the other. `policyIds` is extracted from the apply's manifest server-side — the manifest itself is the largest column on the row and is never returned. `orgId` in the path selects the scope — see the note on the policies endpoint above; the same resolution applies here. **Authenticated with a dashboard session (browser cookie), not `x-api-key`**, and requires the `policy:read` permission, which every role (including viewer) has. ## OpenAPI ````yaml /api-reference/openapi.yaml get /v1/orgs/{orgId}/policy-applies openapi: 3.1.0 info: title: Zespan Public API version: 1.0.0 description: > The Zespan Public API covers the endpoints that customers call directly or through the Zespan SDKs: trace ingestion (native and OpenTelemetry), prompt management, datasets and dataset runs, and the runtime guardrails check. All endpoints authenticate with a project API key sent in the `x-api-key` header. Create and manage API keys from the project settings in the Zespan dashboard. servers: - url: https://api.zespan.com description: Zespan production API security: - ApiKeyAuth: [] tags: - name: Ingestion description: Send traces and events to Zespan. - name: OpenTelemetry description: OTLP-compatible ingestion endpoints. - name: Prompts description: Manage versioned prompts and their labels, tags, and folders. - name: Datasets description: Read datasets and manage dataset runs used for experiments and scoring. - name: Guardrails description: Runtime guardrail evaluation. - name: SDK / CLI support description: > Small support endpoints consumed by the SDKs and @zespan/cli rather than called directly by application code. - name: Blast Radius description: > The prompt/agent/model/policy/evaluator/alert dependency graph backing the pre-release impact check and the evaluator-delete gate in the dashboard. Session-authenticated (dashboard cookie), not `x-api-key`. - name: Outcomes description: > Report business outcomes (a deflected ticket, an avoided refund, an SLA met) attributed to a trace, and read them back summarized by agent or model, joined to real trace cost. Backs the Value dashboard page. The ingest endpoint is `x-api-key`-authenticated like the rest of ingestion; the two read endpoints are session-authenticated (dashboard cookie) like Blast Radius. - name: Compliance description: > Generate audit-ready evidence documents (a per-agent Compliance Card, or SOC 2 control evidence) from recorded platform data, and re-verify a generated document's citations against live data. Session-authenticated (dashboard cookie), not `x-api-key`, gated by `compliance:read` / `compliance:generate` permissions and the Pro plan or above (the framework listing is the one exception — no project scope and no plan gate, since a customer deciding whether to upgrade needs to see what they'd get). - name: Models description: > Per-model usage, cost, latency, and error-rate rollups for a project, including the lifecycle overlay described under the Model Lifecycle tag. Session-authenticated (dashboard cookie), not `x-api-key`, gated by `dashboard:read`. - name: Model Lifecycle description: > Findings from the daily model deprecation scan, which matches models a project actually calls against a curated, bundled catalogue of provider-announced deprecation and retirement dates. Every figure on a finding (call volume, cost, affected agents/prompts, cost comparison against a named successor) is measured from real trace data — there is no quality-delta or regression-comparison endpoint, because nothing in this API invokes a model on the caller's behalf. Session-authenticated (dashboard cookie), not `x-api-key`: reading findings and the catalogue requires `dashboard:read`, dismissing a finding requires `alerts:manage`. - name: Policies description: > The organisation-wide policy rollup backing the top-level **Policies** entry in the org admin sidebar: every policy id across every project, grouped by id, plus the org's recent apply history. These endpoints report what is deployed — they never declare a project non-compliant, because no standard exists yet for a project to be measured against. `orgId` in the path selects the scope: it accepts either the organisation's slug or its id, and both routes 403 if the caller is not a member of it. Session-authenticated (dashboard cookie), not `x-api-key`, gated by `policy:read`, which every role has. paths: /v1/orgs/{orgId}/policy-applies: get: tags: - Policies summary: Recent policy applies across every project in the org description: > Every policy apply across every project in the organisation, newest first, cursor-paginated. Backs the **Recent applies** section on [Organisation view](/dashboard/policies#organisation-view). `origin` is the **entrypoint** that ran the apply — `cli` or `ui` — which is a different fact from a policy's **owner** (`git` or `zespan`, returned as `origin` on an occurrence in the policies response above). A dashboard-authored (`zespan`-owned) policy can be applied by either entrypoint, and a `git`-owned policy applied in CI still reports `origin: "cli"` here; never read one field as the other. `policyIds` is extracted from the apply's manifest server-side — the manifest itself is the largest column on the row and is never returned. `orgId` in the path selects the scope — see the note on the policies endpoint above; the same resolution applies here. **Authenticated with a dashboard session (browser cookie), not `x-api-key`**, and requires the `policy:read` permission, which every role (including viewer) has. operationId: getOrgPolicyApplies parameters: - name: orgId in: path required: true schema: type: string description: > Selects the scope: an organisation slug or id. The caller must be a member of it or the request is refused. See the note above. - name: limit in: query schema: type: integer minimum: 1 maximum: 200 default: 50 - name: cursor in: query schema: type: string description: The `id` of the last apply from the previous page. responses: '200': description: One page of the org's apply history, newest first. content: application/json: schema: $ref: '#/components/schemas/OrgPolicyAppliesResponse' '403': description: Not authenticated with a dashboard session, or lacks `policy:read`. content: application/json: schema: $ref: '#/components/schemas/Error' security: [] components: schemas: OrgPolicyAppliesResponse: type: object description: Response of `GET /v1/orgs/{orgId}/policy-applies`. properties: applies: type: array items: $ref: '#/components/schemas/OrgPolicyApply' nextCursor: type: string nullable: true description: Pass as `cursor` to fetch the next page; `null` on the last page. required: - applies - nextCursor Error: type: object properties: error: type: string description: Human-readable error message. example: Unauthorized code: type: string description: Machine-readable error code, when present. example: rate_limit_exceeded required: - error OrgPolicyApply: type: object properties: id: type: string project: type: object properties: id: type: string name: type: string required: - id - name environment: type: object properties: id: type: string nullable: true slug: type: string required: - id - slug actorUserId: type: string actorType: type: string origin: type: string enum: - cli - ui description: > The **entrypoint** that ran this apply. Not a policy's owner — see `origin` on `OrgPolicyOccurrence` for that (`git` / `zespan`). A `zespan`-owned policy can be applied by either entrypoint, and a `git`-owned policy applied in CI still reports `"cli"` here. forced: type: boolean createdCount: type: integer updatedCount: type: integer deletedCount: type: integer createdAt: type: string format: date-time policyIds: type: array items: type: string description: >- Policy ids extracted from the apply's manifest server-side. The manifest itself is never returned. required: - id - project - environment - actorUserId - actorType - origin - forced - createdCount - updatedCount - deletedCount - createdAt - policyIds securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- Project API key. Manage keys in the Zespan dashboard under project settings. ````