# Dry run policy evaluation

Evaluate a Rego policy against recent entity inputs without persisting results (dry run). Requires CREATE permission when identifier is omitted; EDIT when identifier is present.

Endpoint: POST /pm/api/v1/policies/dry-run
Version: 1.0
Security: 

## Query parameters:

  - `accountIdentifier` (string)
    Harness account ID
    Example: "eBqAoNchMLKigC_qZ5EdC"

  - `orgIdentifier` (string)
    Harness organization ID
    Example: "test-org"

  - `projectIdentifier` (string)
    Harness project ID
    Example: "test-project"

## Header parameters:

  - `x-api-key` (string)
    Harness PAT key used to perform authorization
    Example: "Aut consequatur nemo perferendis earum."

## Request fields (application/json):

  - `action` (string)
    Optional action filter (e.g. onrun, onsave). Restricts history replay to evaluations with this action.
    Example: "onrun"

  - `entityOrgIdentifier` (string)
    Optional analysis org. Must stay within the policy scope hierarchy. Omit at account-level policy to replay account-wide.
    Example: "default"

  - `entityProjectIdentifier` (string)
    Optional analysis project. Omit at org-level policy to replay all projects in the org. Requires entityOrgIdentifier when the policy is account-level.
    Example: "project_alpha"

  - `identifier` (string)
    Policy identifier for edit mode. Used for RBAC and existence check only. Returns 404 if not found.
    Example: "my-pipeline-policy"

  - `rego` (string, required)
    Rego source to evaluate. Always required — UI sends the current editor content (inline or GitX-loaded) on both create and edit.
    Example: "package policy\ndeny[\"must approve\"] { input.status != \"approved\" }"

  - `type` (string, required)
    Entity type to evaluate against (e.g. pipeline, featureFlag). Required.
    Example: "pipeline"

## Response 200 fields (application/json):

  - `results` (array, required)
    Per-entity evaluation results
    Example: [{"deny_messages":["Earum quo id sunt.","Molestiae sequi accusamus velit libero a.","Blanditiis ea quis qui quia et cumque."],"entity":"pipeline:my-pipeline","error":"Quibusdam maxime dicta magnam quia.","source":"history","source_evaluation_id":12345,"status":"error"},{"deny_messages":["Earum quo id sunt.","Molestiae sequi accusamus velit libero a.","Blanditiis ea quis qui quia et cumque."],"entity":"pipeline:my-pipeline","error":"Quibusdam maxime dicta magnam quia.","source":"history","source_evaluation_id":12345,"status":"error"},{"deny_messages":["Earum quo id sunt.","Molestiae sequi accusamus velit libero a.","Blanditiis ea quis qui quia et cumque."],"entity":"pipeline:my-pipeline","error":"Quibusdam maxime dicta magnam quia.","source":"history","source_evaluation_id":12345,"status":"error"},{"deny_messages":["Earum quo id sunt.","Molestiae sequi accusamus velit libero a.","Blanditiis ea quis qui quia et cumque."],"entity":"pipeline:my-pipeline","error":"Quibusdam maxime dicta magnam quia.","source":"history","source_evaluation_id":12345,"status":"error"}]

  - `results.deny_messages` (array)
    Deny messages produced by the Rego policy
    Example: ["Quidem ut nisi.","Aut ut nihil libero."]

  - `results.entity` (string, required)
    Entity identifier that was evaluated
    Example: "pipeline:my-pipeline"

  - `results.error` (string)
    Error message when evaluation failed (e.g. GCS fetch timeout, parse error)
    Example: "Et est labore."

  - `results.source` (string, required)
    Origin of the input: history or sample_payload
    Example: "history"

  - `results.source_evaluation_id` (integer)
    ID of the history evaluation this input was replayed from (only set when source=history)
    Example: 12345

  - `results.status` (string, required)
    Evaluation status: pass, fail, or error
    Enum: "pass", "fail", "error"

  - `summary` (object, required)
    Aggregate counts for a dry-run evaluation
    Example: {"errors":0,"failed":4,"passed":20,"total":25}

  - `summary.errors` (integer, required)
    Number of entities that could not be evaluated due to infrastructure errors

  - `summary.failed` (integer, required)
    Number of entities that triggered at least one deny rule
    Example: 4

  - `summary.passed` (integer, required)
    Number of entities that passed all deny rules
    Example: 20

  - `summary.total` (integer, required)
    Total number of entities evaluated
    Example: 25

## Response 400 fields (application/json):

  - `fault` (boolean, required)
    Is the error a server-side fault?
    Example: true

  - `id` (string, required)
    ID is a unique identifier for this particular occurrence of the problem.
    Example: "123abc"

  - `message` (string, required)
    Message is a human-readable explanation specific to this occurrence of the problem.
    Example: "parameter 'p' must be an integer"

  - `name` (string, required)
    Name is the name of this class of errors.
    Example: "bad_request"

  - `temporary` (boolean, required)
    Is the error temporary?

  - `timeout` (boolean, required)
    Is the error a timeout?
    Example: true

## Response 409 fields (application/json):

  - `message` (string, required)
    Human-readable warning message
    Example: "Quidem est."

  - `referenced_by` (array, required)
    Policy sets that reference this policy
    Example: [{"account_id":"Eius illum.","identifier":"Et iusto ea adipisci quo sint.","name":"Tenetur repellendus delectus illo eaque.","org_id":"Rerum ut in non voluptas.","project_id":"Natus autem inventore ut ea voluptates sunt."},{"account_id":"Eius illum.","identifier":"Et iusto ea adipisci quo sint.","name":"Tenetur repellendus delectus illo eaque.","org_id":"Rerum ut in non voluptas.","project_id":"Natus autem inventore ut ea voluptates sunt."},{"account_id":"Eius illum.","identifier":"Et iusto ea adipisci quo sint.","name":"Tenetur repellendus delectus illo eaque.","org_id":"Rerum ut in non voluptas.","project_id":"Natus autem inventore ut ea voluptates sunt."}]

  - `referenced_by.account_id` (string, required)
    Harness account ID
    Example: "Sunt quas."

  - `referenced_by.identifier` (string, required)
    Identifier of the referencing policy set
    Example: "Dicta et rerum non."

  - `referenced_by.name` (string, required)
    Name of the referencing policy set
    Example: "Sunt aliquam modi tempora dolore."

  - `referenced_by.org_id` (string)
    Harness organization ID
    Example: "Consequatur est ad qui ex excepturi non."

  - `referenced_by.project_id` (string)
    Harness project ID
    Example: "Rerum esse labore."