Policy Routes - Toolshed

List roles

GET /api/policy/roles

Response (200):

{
  "roles": []
}

POST /api/policy/roles

{
  "id": "developer",
  "name": "Developer",
  "patterns": ["github.**", "linear.issues.*", "slack.channels.list"]
}

Validated against RoleSchema from @toolshed/shared.

{
  "created": {
    "id": "developer",
    "name": "Developer",
    "patterns": ["github.**", "linear.issues.*", "slack.channels.list"]
  }
}

The response wraps the role object in a created field.

PUT /api/policy/roles/:id

Parameter	In	Required	Description
`id`	path	Yes	Role ID

Same shape as create — a full Role object.

{
  "updated": {
    "id": "developer",
    "name": "Developer",
    "patterns": ["github.**", "linear.**", "slack.**"]
  }
}

The response wraps the role object in an updated field. The id is taken from the URL path parameter.

GET /api/policy/resolve?userId=<userId>

Returns the effective set of tools a user can access based on their role.

Parameter	In	Required	Description
`userId`	query	Yes	User ID

Response (200):

{
  "userId": "user-123",
  "tools": []
}