Get the approved provider policy

GET/v1/trust/policy

Get the approved provider policy.

Returns the organization's approved sub-processor policy (whether calls to providers outside the approved list are refused, and the list) and where sub-processor change alerts go (email, webhook). The webhook signing secret itself is never returned here, only whether one is set.

Requires an organization owner or admin (403 otherwise). Readable on every plan, so an organization whose plan no longer includes the Trust Pack controls can still see, and turn off, what it set; entitled says whether the plan includes them.

Authorization

AuthorizationBearer va_
A platform API key (va_...), created under Settings > API keys. Scoped to an organization or one workspace, with an admin or member role. Used by the management API.

Query parameters

organizationstringrequired
the organization slug

Responses

200application/json

organizationstring
The organization slug.
entitledboolean
Whether the organization's plan includes the Trust Pack controls, needed to turn the policy or alerts on.
approved_providers_enabledboolean
Whether the policy is on: calls to a provider not in approved_providers are refused before they are made.
approved_providersstring[]
The approved provider ids (for example OPENAI, ANTHROPIC); empty when none is set.
notify_emailboolean
Whether the organization's owners and admins are emailed about sub-processor changes.
webhook_urlstring
The URL that receives every sub-processor change as a signed POST; absent when no webhook is set.
webhook_secret_setboolean
Whether a webhook signing secret exists.
webhook_secretstring
The webhook signing secret (whsec_...), only in the response that created or rotated it; store it then. Each delivery carries X-VectorAxis-Timestamp (Unix seconds) and X-VectorAxis-Signature: sha256={hex}, the HMAC-SHA256 of "{timestamp}.{body}" keyed with this secret.
updated_bystring
Who last changed the policy: the user id, or api-key:{key id} for a platform API key; absent before the first change.
updated_atstring<date-time>
When the policy was last changed (ISO 8601 date-time); absent before the first change.

VectorAxis is built by GK Labs, a member of NVIDIA Inception.