APIZDocs

APIZ guide

Make A Shared API Read Only

Use a mandatory Structured Policy when an upstream API credential permits writes but an agent should only read. This adds an APIZ enforcement boundary; it does not change the provider credential itself.

Web Console

  1. Open Policies → Create Policy → Structured.
  2. Select the target adapter and its built-in read-only example when available.
  3. For General API, allow normalized actions http:get and http:head.
  4. Set THEN to allow with reason read_request_allowed and OTHERWISE to deny with reason write_request_not_allowed.
  5. Add fixtures for GET, HEAD, POST, PATCH, PUT, and DELETE.
  6. Publish, run the complete suite, enable the Policy, and attach it as a mandatory Client Binding Policy.

Adapter-specific read templates cover their declared read actions; they do not guess that every HTTP GET is safe. For example, GitHub Actions secret metadata is classified as dangerous despite using a read method.

CLI

The complete General API project and fixture files are maintained in the Structured Policy tutorial. Publish and attach that project with:

apiz -o json policy publish --project ./general-read-only > policy-review.json
POLICY_ID=$(jq -r '.candidate.policy_id' policy-review.json)
DRAFT_REVISION=$(jq -r '.candidate.draft_revision' policy-review.json)
POLICY_REVISION=$(jq -r '.candidate.current_published_revision' policy-review.json)
jq '{candidate, changes, evidence, traffic_effect}' policy-review.json
apiz -o json policy publish "$POLICY_ID" --project ./general-read-only \
  --expected-draft-revision "$DRAFT_REVISION" \
  --expected-policy-revision "$POLICY_REVISION" --confirm > policy.json
apiz policy test-suite "$POLICY_ID"
apiz policy enable "$POLICY_ID"
apiz client binding policy add <client-binding-id> \
  --policy "$POLICY_ID" --order 100

Verify The Boundary

Use one Temporary Credential for both checks:

  • a safe read should pass Policy and show an upstream result;
  • a harmless write-shaped request should return the configured deny reason before Secret Broker release and upstream contact.

Access Logs must show the normalized action, exact Published Revision, decision reason, and redacted upstream outcome. Do not infer read-only behavior from the upstream token's current permissions alone.

Roll Back Or Broaden Access

Detach or disable the Policy only after reviewing every Client using the Binding. To allow selected writes, add their exact adapter actions to a new tested revision while retaining default deny. Do not switch the fallback to allow merely to fix one missing operation.