> ## Documentation Index > Fetch the complete documentation index at: https://docs.parmanasystems.com/llms.txt > Use this file to discover all available pages before exploring further. # Get the policy a capability's requests must declare right now > Tells an agent what a request for a capability must declare and carry right now: the policy name and version, the policy's description, and its signals (every fact the rules read with its type, the facts that must equal a value of the in... ## OpenAPI ````yaml openapi.bundled.yaml GET /policies/in-effect openapi: 3.1.0 info: title: Parmana API version: 1.0.0 description: > Parmana sits between an AI agent and the systems it acts on. An agent sends a Business Transaction: who authorized it, what action it wants, and the facts that justify it. Parmana evaluates the policy bound to the action, checks any signed human approval the policy requires, releases the action to the connector only if the policy approves, and returns a signed Execution Trust Record anyone can verify. **Authentication.** Send `Authorization: Bearer ` on every request. The only routes that need no key are the probes, the documents and the independent verification routes: `GET /health`, `GET /ready`, `GET /openapi.yaml`, `GET /openapi.json`, `GET /api-manifest.json`, `GET /documentation`, `GET /reference`, `GET /parmana-handbook.pdf`, `GET /handbook/download-leads`, `POST /handbook/download-leads`, `POST /refusal/verify`, `POST /execution-intents/verify`, `POST /audit/verify`, `GET /keys/{keyId}` and `GET /.well-known/jwks.json`. A missing or unknown key returns `401` before anything else runs. The server holds only a hash of each key. See [Authentication](/api-reference/authentication). **Two kinds of key.** An agent or service key may invoke only the capabilities listed on it. A human key (`credentialHolderType: USER`) is required for governance: proposing and approving policies, approvers and external connectors, and repairing Execution Intents. Approving or rejecting a change also needs a step up authorization signed with the checker's own step up key, and the checker must not be the person who proposed it. **Ownership.** Every lookup by `businessTransactionId` is scoped to the key that submitted the transaction. A transaction submitted by another key returns the same `404` as one that does not exist. **Try it live.** The first server below is the public sandbox, `https://parmana-sandbox.vercel.app`: the same code as production with its own database, keys and demo approver, whose one action, `sandbox:receipt`, acts on nothing. Every "Try it" panel calls it with the published demo key prefilled. The demo key may invoke only `sandbox:receipt`, so other capabilities return `403` and governance routes return `403 NON_HUMAN_CALLER_DENIED`. Everything sent to the sandbox is visible to every visitor. See [Playground](/playground). Production needs a key issued by its operator. **Start here:** the [Playground](/playground) (no install), the [Quickstart](/quickstart), then [Integrate Parmana](/agents/integrate) for agents and [Connect any external system](/guides/connect-any-external-system) for your own endpoint. contact: name: Parmana Systems email: founder@parmanasystems.com license: name: Proprietary, source-available for evaluation only, see LICENSE url: https://github.com/pavancharak/parmana/blob/main/LICENSE servers: - url: https://parmana-sandbox.vercel.app description: >- Public sandbox (the docs playground). Same code as production, demo data only, acts on nothing. Demo key prefilled. - url: https://parmana-api-real.vercel.app description: Production. Needs a key issued by the operator. - url: http://localhost:3000 description: Local (packages/api, PORT env var, default 3000) security: - bearerAuth: [] tags: - name: Execution description: >- Executes a Business Transaction through the complete Execution Trust pipeline - name: Transactions description: Business Transaction creation and retrieval - name: Verification description: Deterministic verification of an Execution Trust Record - name: Receipts description: Cryptographically signed Execution Trust Receipts - name: Trust Records description: Execution Trust Record retrieval - name: Replay description: Deterministic replay of a recorded Execution Trust Record - name: Policies description: Policy existence/readability check - name: Policy Governance description: Maker-checker proposal, listing, approval, and rejection of policy changes - name: Approvers description: Maker-checker for the keys trusted to sign approvals, without a deploy - name: External Connectors description: >- Maker-checker for binding a capability to an operator's HTTPS endpoint and its policy, without a deploy (ADR-0013) - name: Business Signal Sources description: >- Maker-checker for the business systems Parmana asks for the facts a policy needs, without a deploy (RFC-0023) - name: Authority Grants description: >- Maker-checker for which agent may have which action decided, within which limits, until when (RFC-0023) - name: Sandbox description: >- Routes that exist only on the public sandbox (ADR-0014), for trying Parmana from a browser - name: Refusal Records description: >- Durable, signed evidence that a policy decision rejected a transaction (RFC-0021) - name: Execution Intents description: >- A signed statement, stored before an action is released, of exactly what is about to be released, plus the operator tools to find and repair a released action that has no signed Trust Record (ADR-0012) - name: Audit description: >- Signed caller-authentication audit events, independently third-party-verifiable - name: System description: Operational endpoints paths: /policies/in-effect: get: tags: - Policies summary: Get the policy a capability's requests must declare right now description: > Tells an agent what a request for a capability must declare and carry right now: the policy name and version, the policy's description, and its signals (every fact the rules read with its type, the facts that must equal a value of the intent, and the facts that need a signed human approval with what that approval must name). Call it before every `POST /execute` instead of hard coding a version: approving a new version changes the answer with no deploy. The rule conditions are never returned. Allowed for a key that may invoke the capability, and for human keys. operationId: getPolicyInEffect parameters: - name: capability in: query required: true description: The action, as in `intent.action`, for example `paytm:refund`. schema: type: string example: paytm:refund responses: '200': description: What to declare and carry. content: application/json: schema: type: object required: - capability - policy - description - signals properties: capability: type: string policy: type: object required: - name - version - schemaVersion properties: name: type: string version: type: string schemaVersion: type: string description: type: - string - 'null' description: The policy author's description for people, or null. authorityGrantRequired: type: boolean const: true description: > Present only when the policy requires it. Your key needs a current authority grant for this capability, made through maker checker (/authority-grants), and each request must be within the grant's limits. signals: type: object description: What a request under this policy must carry. required: - facts - schema - bound - approval properties: facts: type: array items: type: string description: >- Every fact the policy's rules read, sorted. Send each in the request's signals. schema: type: object additionalProperties: type: string description: >- The declared type of each signal (boolean, number, string). bound: type: object additionalProperties: type: string description: > Signals that must equal a value of the Intent, as signal name to path (for example refundAmount to parameters.amount). A mismatch is refused. approval: type: object additionalProperties: type: object required: - resourceId properties: resourceId: type: string description: >- Where the resource the approval names is in the request, target or a parameters path. value: type: string description: >- Where the amount the approval must cover is, when there is one. description: > Signals that count as true only with a signed approval in signals.approvalArtifact, and what that approval must name. sourced: type: object additionalProperties: type: object required: - source - claim - subject properties: source: type: string description: The registered business system the server asks. claim: type: string description: What the server asks it. subject: type: string description: >- Where the business object is in the request, target or a parameters path. maxAgeSeconds: type: integer description: How old the source's answer may be. description: > Present only when the policy has any. Facts the server asks a business system for itself; you need not send them, and a value you send that differs from the source's is refused. examples: refund: summary: The refund capability under customer-refund 1.2.0 value: capability: paytm:refund policy: name: customer-refund version: 1.2.0 schemaVersion: 1.0.0 description: >- Authorizes customer refunds. Every refund above 0 and up to 100000 needs a signed manager approval for that order, covering that amount. signals: facts: - fraudCheckPassed - managerApproved - refundAmount - refundEligible schema: refundEligible: boolean managerApproved: boolean fraudCheckPassed: boolean refundAmount: number bound: refundAmount: parameters.amount approval: managerApproved: resourceId: parameters.orderId value: parameters.amount '400': description: The `capability` query parameter is missing. content: application/json: schema: $ref: '#/components/schemas/error.schema' examples: missingCapability: summary: Real captured response value: error: >- capability is required, for example ?capability=paytm:refund. '401': $ref: '#/components/responses/Unauthorized' '403': description: '`CAPABILITY_NOT_ALLOWED`: your key may not invoke this capability.' content: application/json: schema: $ref: '#/components/schemas/error.schema' examples: capabilityNotAllowed: summary: >- Real captured response, a key allowed only slack:post-message value: error: Caller is not permitted to invoke this capability. code: CAPABILITY_NOT_ALLOWED '404': description: >- `CAPABILITY_NOT_BOUND`: no policy is bound to this capability, so no request for it can succeed. content: application/json: schema: $ref: '#/components/schemas/error.schema' examples: capabilityNotBound: summary: Real captured response value: error: No policy is bound to capability "test:fixture-execute". code: CAPABILITY_NOT_BOUND '409': description: >- `NO_APPROVED_POLICY_VERSION`: no version of the bound policy has been approved yet, so every request is refused. A person must propose and approve one. content: application/json: schema: $ref: '#/components/schemas/error.schema' examples: noApprovedVersion: summary: Real captured response value: error: >- Every request for "paytm:refund" is refused right now: no version of policy "customer-refund", which capability "paytm:refund" requires, has been approved through policy governance. code: NO_APPROVED_POLICY_VERSION '503': description: >- `POLICY_VERSION_UNAVAILABLE`: the version in effect could not be read, so every request is refused meanwhile. Retry later. content: application/json: schema: $ref: '#/components/schemas/error.schema' examples: lookupFailed: summary: >- Real captured response, the policy version store was unreachable value: error: >- Every request for "paytm:refund" is refused right now: the version of policy "customer-refund" in effect for capability "paytm:refund" could not be looked up: database unreachable. code: POLICY_VERSION_UNAVAILABLE x-codeSamples: - lang: bash label: cURL source: >- curl "https://parmana-api-real.vercel.app/policies/in-effect?capability=paytm%3Arefund" \ -H "Authorization: Bearer $PARMANA_API_KEY" - lang: typescript label: TypeScript source: |- import { ParmanaClient } from "@parmana/sdk"; const client = new ParmanaClient({ endpoint: "https://parmana-api-real.vercel.app", apiKey: process.env.PARMANA_API_KEY!, }); const inEffect = await client.policyInEffect("paytm:refund"); console.log(inEffect.policy, inEffect.signals.approval); - lang: python label: Python source: |- import os from parmana import ParmanaClient client = ParmanaClient( endpoint="https://parmana-api-real.vercel.app", api_key=os.environ["PARMANA_API_KEY"], ) in_effect = client.policy_in_effect("paytm:refund") print(in_effect.policy, in_effect.signals.approval) components: schemas: error.schema: title: Error Response description: >- Shared error envelope produced by packages/api/src/middleware/error-handler.ts and by every route's inline validation checks. error is always a plain human-readable string (never a nested object). code is present only when the failure was a RuntimeError subclass reaching the centralized error handler (VerificationFailedError, ReceiptGenerationError, or an uncategorized RuntimeError); it is absent from every inline route-level check (businessTransactionId format/required checks) and from BusinessTransactionValidationError, PolicyValidationError, SignalValidationError, PolicyNotFoundError, DuplicateBusinessTransactionError, and the generic 500 fallback. POST /policies/validate does NOT use this envelope at all. See its own response schema. For the triggering condition and recommended caller action behind any specific error/code/status combination, see the Error catalog at /api-reference/error-catalog. type: object additionalProperties: false required: - error properties: error: type: string description: Human-readable error message. code: type: string description: >- Stable machine-readable error code. Only present for errors that reach the handler as a RuntimeError. examples: - RUNTIME_ERROR - VERIFICATION_FAILED - RECEIPT_GENERATION_FAILED - POLICY_DENIED - CAPABILITY_NOT_ALLOWED - RATE_LIMITED - AUDIT_UNAVAILABLE - SIGNING_UNAVAILABLE - CONNECTOR_NOT_REGISTERED - EXECUTION_RECORD_INCOMPLETE - EXECUTION_INTENT_UNAVAILABLE - EXECUTION_INTENT_RESULT_NOT_RECORDED - EXECUTION_INTENT_NOT_FOUND - EXECUTION_INTENTS_NOT_ENABLED - EXECUTION_INTENT_NOT_RESOLVABLE - EXECUTION_INTENT_RESOLUTION_INVALID - NON_HUMAN_CALLER_DENIED - EXECUTION_OUTCOME_UNKNOWN - AUTHORIZATION_NO_LONGER_VALID executionStatus: type: string enum: - EXECUTION_UNKNOWN - NOT_EXECUTED description: >- RFC-0023 phase 4. EXECUTION_UNKNOWN with EXECUTION_OUTCOME_UNKNOWN: the action was released and the call failed, so whether it ran is unknown; never reported as failed, and the Execution Intent stays ERRORED until a person resolves it. NOT_EXECUTED with AUTHORIZATION_NO_LONGER_VALID: the release was refused because a business condition or the authority grant it rested on no longer held, and nothing was sent. examples: - error: businessTransactionId must be a valid UUID. - error: >- Business Transaction 'eed2a972-1bf5-4166-8472-761f76fbf1b2' already exists. - error: >- Execution rejected: Vendor payment rejected because the assessed payment risk exceeds the maximum permitted threshold. code: RUNTIME_ERROR responses: Unauthorized: description: >- The `Authorization` header is missing, is not a bearer key, or names a key the server does not know. Nothing ran. Send a valid key. content: application/json: schema: $ref: '#/components/schemas/error.schema' examples: authRequired: summary: Real captured response, missing or invalid Authorization header value: error: authentication required securitySchemes: bearerAuth: type: http scheme: bearer x-default: 2VfYWCzt_cBAPK-8uufX6ordfY2JuQhFPsohuEumKME description: > Caller API key issued by scripts/generate-api-key.ts. Sent as Authorization: Bearer . Verified against a stored SHA-256 hash in constant time by packages/api/src/auth/StaticKeyAuthenticator.ts. Required on every route not listed as exempt in this document's top-level description. See /api-reference/authentication. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.