# The gate policy for a scope

GET

/v1/agents/{agentId}/gate-policy

```sh
curl --request GET \
  --url 'https://example.com/v1/agents/example/gate-policy?scopeKind=tenant' \
  --header 'Authorization: Bearer <token>'
```

The gate policy a promotion of the agent for the scope would be checked against: the most specific scope with an active policy (a segment path’s longer prefixes first, then its project, the project’s org, the tenant), at its latest active version. `policy: null` when none applies.

## Authorizations

- **[bearerAuth](https://docs.kindgi.com/v0.1.8/reference/api.md#bearerauth)**

## Parameters

### Path Parameters

**agentId**

required

string

AgentId — dotted namespace (`acme.drafting`).

### Query Parameters

**scopeKind**

string

Allowed values: tenant org project segment

Only one scope: `tenant`, `org` or `project` (with `scopeId`), or `segment` (with `scopeId` and `segment`).

**scopeId**

string

\>= 1 characters

Required IF scopeKind is `org` or `project`. MUST be absent if scopeKind=`tenant` (tenant is implicit from the session). Malformed combinations return 400 scope-invalid.

**segment**

Array\<string>

One step of the segment path, `key:value`; repeat it in order, coarse to fine.

## Responses

### 200

The policy, or null.

application/json

object

**policy**

required

One of:

- **object**

  object

  **id**

  required

  string

  **version**

  required

  string

  **agentId**

  required

  string

  **scope**

  required

  One of: discriminator: kind

  - **object**

    The agent’s default for the whole tenant.

    object

    **kind**

    required

    string

    Allowed values: tenant

  - **object**

    An org’s projects.

    object

    **kind**

    required

    string

    Allowed values: org

    **orgId**

    required

    string format: uuid

  - **object**

    One project.

    object

    **kind**

    required

    string

    Allowed values: project

    **projectId**

    required

    string format: uuid

  - **object**

    A segment path within a project: it covers every run whose path starts with it.

    object

    **kind**

    required

    string

    Allowed values: segment

    **projectId**

    required

    string format: uuid

    **path**

    required

    Array\<object>

    \>= 1 items <= 8 items

    object

    **key**

    required

    Lowercase, like an identifier: `company`, `contact-role`.

    string

    /^\[a-z]\[a-z0-9\_-]{0,63}$/

    **value**

    required

    string

    \>= 1 characters <= 256 characters

  **spec**

  required

  What a promotion must show. Every part is optional; an empty spec checks nothing. A promotion must name a comparison (`evalRunId`) exactly when the spec has `comparison`, `evidence`, `metrics`, `replay` or `onlyRestrictedClasses`. Unknown keys are refused.

  object

  **comparison**

  object

  **maxAgeHours**

  number

  \> 0

  **suite**

  object

  **id**

  required

  string

  **version**

  string

  **evidence**

  The judged evidence behind each gated metric; for a metric with `maxDrop`, the baseline’s too.

  object

  **minCases**

  integer

  **minWeight**

  number

  **metrics**

  Array\<object>

  object

  **name**

  required

  string

  Allowed values: weightedYesShare judgedCoverage weightedPrecisionAtK

  **k**

  `weightedPrecisionAtK` only: the summary’s `k` must be this.

  integer

  \>= 1 <= 100

  **minCandidate**

  number

  <= 1

  **maxDrop**

  How far the candidate may fall below the baseline (the live version).

  number

  <= 1

  **replay**

  Each knob left out of the block is 0. No block: no replay checks.

  object

  **maxDiverged**

  integer

  **maxErrors**

  integer

  **maxRefusedWrites**

  integer

  **maxStopped**

  integer

  **approvals**

  A passing promotion waits for a reviewer.

  object

  **role**

  Default `senior`.

  string

  Allowed values: standard senior admin

  **separateApprover**

  Default `true`.

  boolean

  **onlyRestrictedClasses**

  Only restricted judge classes count: the comparison must be weighted `restricted-only`, so a class anyone may assert can’t move the gate.

  boolean

  **description**

  string

  **createdAt**

  required

  string format: date-time

  **unregisteredAt**

  string format: date-time

- **null**

  null

##### Example

```json
{
  "policy": {
    "scope": {
      "kind": "tenant"
    },
    "spec": {
      "metrics": [
        {
          "name": "weightedYesShare"
        }
      ],
      "approvals": {
        "role": "standard"
      }
    }
  }
}
```

### 400

Missing or malformed scope.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 401

Missing / malformed / expired / revoked bearer token.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

## See also

- [`GET /v1/agents/{agentId}`: Fetch the latest version of an agent](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsget.md)
- [`GET /v1/agents/{agentId}/versions`: List versions of an agent](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentslistversions.md)
- [`POST /v1/agents/{agentId}/versions`: Derive an agent version with data-block pins swapped](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsderiveversion.md)
- [`GET /v1/agents/{agentId}/versions/{version}`: Fetch a specific agent version](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsgetversion.md)
- [Every error code](https://docs.kindgi.com/v0.1.8/reference/errors.md)