getVibeSecPolicy

Get resolved VibeSec policy by scope, with optional user/group identifier.

Examples

GraphQL

query GetVibeSecPolicy($input: GetVibeSecPolicyInput!) {
  getVibeSecPolicy(input: $input) {
    governanceEnabled
    decisions {
      feature
      configured
      effective
      blockedBy
    }
    secureCoding {
      isEnabled
    }
    codeAnnotations {
      isEnabled
    }
    riskPreventionTelemetry {
      isEnabled
    }
    mcpGovernance {
      isEnabled
      defaultServerPolicy
      servers {
        id
        policy
        defaultToolPolicy
        tools {
          id
          policy
        }
      }
    }
    commandsGovernance {
      isEnabled
    }
    dependenciesGovernance {
      isEnabled
      maliciousDependencies {
        isEnabled
        rangeReachableAction
      }
      minimumVersionAge {
        isEnabled
        days
      }
    }
    mcpGuard {
      isEnabled
    }
    oxPresence {
      isEnabled
    }
    showGuidelineName {
      isEnabled
    }
    externalSaasGovernance {
      isEnabled
    }
    aiModelGovernance {
      isEnabled
    }
    promptSecretScan {
      isEnabled
      action
    }
    sensitiveDataProtection {
      isEnabled
    }
    skillsGovernance {
      isEnabled
    }
    blockMaliciousSkills {
      isEnabled
    }
  }
}

Variables

This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.

{
  "input": {
    "scope": "Org",
    "email": "[e-mail]",
    "groupName": "Platform"
  }
}

cURL

curl -X POST \
https://api.cloud.ox.security/api/apollo-gateway \
-H 'Content-Type: application/json' \
-H 'Authorization: YOUR_API_TOKEN' \
-d '{
 "query": "query GetVibeSecPolicy($input: GetVibeSecPolicyInput!) { getVibeSecPolicy(input: $input) { governanceEnabled decisions { feature configured effective blockedBy } secureCoding { isEnabled } codeAnnotations { isEnabled } riskPreventionTelemetry { isEnabled } mcpGovernance { isEnabled defaultServerPolicy servers { id policy defaultToolPolicy tools { id policy } } } commandsGovernance { isEnabled } dependenciesGovernance { isEnabled maliciousDependencies { isEnabled rangeReachableAction } minimumVersionAge { isEnabled days } } mcpGuard { isEnabled } oxPresence { isEnabled } showGuidelineName { isEnabled } externalSaasGovernance { isEnabled } aiModelGovernance { isEnabled } promptSecretScan { isEnabled action } sensitiveDataProtection { isEnabled } skillsGovernance { isEnabled } blockMaliciousSkills { isEnabled } } }",
 "variables": {
    "input": {
      "scope": "Org",
      "email": "[e-mail]",
      "groupName": "Platform"
    }
  }
}'

Node.js

const query = 'query GetVibeSecPolicy($input: GetVibeSecPolicyInput!) { getVibeSecPolicy(input: $input) { governanceEnabled decisions { feature configured effective blockedBy } secureCoding { isEnabled } codeAnnotations { isEnabled } riskPreventionTelemetry { isEnabled } mcpGovernance { isEnabled defaultServerPolicy servers { id policy defaultToolPolicy tools { id policy } } } commandsGovernance { isEnabled } dependenciesGovernance { isEnabled maliciousDependencies { isEnabled rangeReachableAction } minimumVersionAge { isEnabled days } } mcpGuard { isEnabled } oxPresence { isEnabled } showGuidelineName { isEnabled } externalSaasGovernance { isEnabled } aiModelGovernance { isEnabled } promptSecretScan { isEnabled action } sensitiveDataProtection { isEnabled } skillsGovernance { isEnabled } blockMaliciousSkills { isEnabled } } }';

fetch("https://api.cloud.ox.security/api/apollo-gateway", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  body: JSON.stringify({
    query: query,
    // This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    variables: {
      input: {
        scope: "Org",
        email: "[e-mail]",
        groupName: "Platform"
      }
    }
  })
})
.then(response => response.json())
.then(result => console.log(JSON.stringify(result, null, 2)))
.catch(error => console.error('Error:', error));

Python

import requests

query = 'query GetVibeSecPolicy($input: GetVibeSecPolicyInput!) { getVibeSecPolicy(input: $input) { governanceEnabled decisions { feature configured effective blockedBy } secureCoding { isEnabled } codeAnnotations { isEnabled } riskPreventionTelemetry { isEnabled } mcpGovernance { isEnabled defaultServerPolicy servers { id policy defaultToolPolicy tools { id policy } } } commandsGovernance { isEnabled } dependenciesGovernance { isEnabled maliciousDependencies { isEnabled rangeReachableAction } minimumVersionAge { isEnabled days } } mcpGuard { isEnabled } oxPresence { isEnabled } showGuidelineName { isEnabled } externalSaasGovernance { isEnabled } aiModelGovernance { isEnabled } promptSecretScan { isEnabled action } sensitiveDataProtection { isEnabled } skillsGovernance { isEnabled } blockMaliciousSkills { isEnabled } } }'

response = requests.post(
  "https://api.cloud.ox.security/api/apollo-gateway",
  headers={
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  json={
    "query": query,
    # This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    "variables": {
      "input": {
        "scope": "Org",
        "email": "[e-mail]",
        "groupName": "Platform"
      }
    }
  }
)

if response.status_code == 200:
    result = response.json()
    print(result)
else:
    print(f"Error: {response.status_code}")
    print(response.text)

Arguments

You can use the following argument(s) to customize your getVibeSecPolicy query.

Argument	Description	Supported fields
input GetVibeSecPolicyInput! required		scope VibeSecPolicyScope! email String groupName String

Fields

Return type: VibeSecPolicyResponse!

You can use the following field(s) to specify what information your getVibeSecPolicy query will return. Please note that some fields may have their own subfields.

Field	Description	Supported fields
governanceEnabled Boolean!	Persisted master switch for governance children. When false, every governance child cascades to effective=false with blockedBy=parent.
decisions [FeatureDecisionEntry!]!	Per-feature decision (configured vs effective + blockedBy reason) computed from the three-level AND-cascade.	feature VibeSecFeature! configured Boolean! effective Boolean! blockedBy BlockedBy
secureCoding SecureCodingConfigResponse!	Guideline injection configuration	isEnabled Boolean
codeAnnotations CodeAnnotationsConfigResponse!	Inline security annotation configuration	isEnabled Boolean
riskPreventionTelemetry RiskPreventionTelemetryConfigResponse!	Prevented-risk telemetry configuration	isEnabled Boolean
mcpGovernance McpGovernanceConfigResponse!	MCP server and tool governance configuration	isEnabled Boolean defaultServerPolicy McpGovernanceAccessMode servers [McpServerPolicyEntryResponse!]
commandsGovernance CommandsGovernanceConfigResponse!	Risky shell command governance configuration	isEnabled Boolean
dependenciesGovernance DependenciesGovernanceConfigResponse!	Dependency governance configuration	isEnabled Boolean maliciousDependencies MaliciousDependenciesConfigResponse minimumVersionAge MinimumVersionAgeConfigResponse
mcpGuard McpGuardConfigResponse!	Stdio MCP server guard configuration	isEnabled Boolean
oxPresence OxPresenceConfigResponse!	"Secured by OX" session preamble configuration	isEnabled Boolean
showGuidelineName ShowGuidelineNameConfigResponse!	Guideline-name visibility configuration	isEnabled Boolean
externalSaasGovernance ExternalSaasGovernanceConfigResponse!	External SaaS governance configuration	isEnabled Boolean
aiModelGovernance AiModelGovernanceConfigResponse!	AI model governance configuration	isEnabled Boolean
promptSecretScan PromptSecretScanConfigResponse!	When enabled, hooks scan each prompt locally, and based on policy, either block those carrying credentials or allow them but alert on Agent Activity Log. Only the secret type and an already-masked value reach the backend.	isEnabled Boolean action PromptSecretScanAction
sensitiveDataProtection SensitiveDataProtectionConfigResponse!	When enabled, only metadata is persisted to Mongo. Commands are reduced to the executable basename, file paths to the basename, and some free-text inputs are replaced with a placeholder before write.	isEnabled Boolean
skillsGovernance SkillsGovernanceConfigResponse!	Agent skill scanning configuration	isEnabled Boolean
blockMaliciousSkills BlockMaliciousSkillsConfigResponse!	Malicious skill blocking configuration	isEnabled Boolean