Policy

Read the active policy document, capture and restore immutable snapshots, and CRUD individual rules through the unified rules surface.

Drive these operations with d3x-edgectl (see the admin API overview). Path names below are historical labels for EdgeControl RPCs — they are not HTTP URLs. Every write here is hot-reloaded; no restart, no dropped requests.

Read the policy

GET /admin/policy

Returns the current active policy document — every policy rule, rate-limit rule, transformation rule, and routing rule. This endpoint is read-only: mutations go through the per-rule CRUD surface below, or through snapshot restore. See Policy schema.

Snapshots

A snapshot is a manual, immutable point-in-time capture of the full policy config. Create one before a risky change, then restore it to roll the entire policy back. See Versioning and rolling back policy for the operator workflow.

GET /admin/policy/snapshots

Lists snapshot metadata, newest first. The captured config is omitted — fetch a single snapshot to see it.

POST /admin/policy/snapshots

Captures the current live policy as a new snapshot. Body is {"name": "...", "description": "..."}; name is required. Returns the new snapshot metadata with 201 Created.

GET /admin/policy/snapshots/{id}

Returns one snapshot, including its captured config. 404 if no snapshot has that id.

DELETE /admin/policy/snapshots/{id}

Deletes one snapshot.

POST /admin/policy/snapshots/{id}/restore

Warning

Restore overwrites the entire live policy with the snapshot's captured config and does not first capture the current state. Take a snapshot of the running policy before you restore. Restore requires the admin role.

Rules

Individual policy, transformation, routing, and rate-limit rules share one unified surface at /admin/rules. Each rule carries a type discriminator — policy, transformation, routing, or rate-limit. Use these endpoints for incremental edits.

GET /admin/rules

Lists all rules across the four types, each entry carrying its type. Add ?type=policy (or another type) to narrow to one type.

POST /admin/rules

Creates a rule. The body must include type plus the type-specific fields — for a policy rule, a PolicyRule with "type": "policy" (see schema). Rule names are globally unique across all four types: 409 if any rule already owns the name.

GET /admin/rules/{name}

Returns one rule by name. The response carries an ETag for optimistic concurrency.

PUT /admin/rules/{name}

Updates one rule. If the body declares a type, it must match the existing rule's type — a PUT cannot reassign a rule's type (delete and recreate instead). Send the rule's ETag in If-Match for a guarded update.

DELETE /admin/rules/{name}

Deletes one rule by name.

Examples

Add a policy rule

Bash

Snapshot and restore

There is no d3x-edgectl snapshot subcommand today. Capture and restore through the console or a gRPC client against CreatePolicySnapshot / RestorePolicySnapshot. See Versioning and rolling back policy.

Where to go next

Policy schema — the full PolicyRule shape.
Versioning and rolling back policy — the snapshot/restore workflow.
Admin API overview — address, auth, and how mutations hot-reload.