cURL

curl --request POST \
  --url https://api.openlayer.com/v1/workspaces/3fa85f64-5717-4562-b3fc-2c963f66afa6/rules \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "name": "Annual model risk review",
    "description": "Each high-risk project is reviewed and signed off once a year.",
    "scope": "project",
    "type": "evidence",
    "evidenceType": "document",
    "renewalCadenceDays": 365
  }'

{
  "id": "7c9a1e2b-3d4f-4a5b-8c6d-7e8f9a0b1c2d",
  "workspaceId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "name": "Monitoring enabled",
  "scope": "project",
  "type": "platform",
  "dateCreated": "2026-03-22T11:31:01.185Z",
  "dateUpdated": "2026-03-22T11:31:01.185Z",
  "description": "Each project must have Openlayer monitoring mode enabled.",
  "evidenceType": "document",
  "renewalCadenceDays": 90,
  "automationType": "monitoring_mode_enabled",
  "automationParams": {},
  "deactivated": false,
  "assigneeId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "tags": [
    {
      "id": "6e8a0c2d-4f5b-4a3c-9d7e-8f0a1b2c3d4e",
      "workspaceId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "creatorId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "name": "Evaluation",
      "immutable": false,
      "dateCreated": "2026-03-22T11:31:01.185Z",
      "dateUpdated": "2026-03-22T11:31:01.185Z",
      "color": "<string>"
    }
  ],
  "frameworks": [
    {
      "id": "<unknown>",
      "name": "<unknown>",
      "avatar": "<unknown>",
      "builtInSlug": "<unknown>",
      "enabled": "<unknown>"
    }
  ],
  "results": [
    {
      "id": "5b7d9f1a-2c3e-4d5f-8a6b-9c0d1e2f3a4b",
      "workspaceId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "ruleId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "status": "passing",
      "deactivated": false,
      "dateCreated": "2026-03-22T11:31:01.185Z",
      "dateUpdated": "2026-03-22T11:31:01.185Z",
      "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "statusMessage": "<string>",
      "dateLastEvaluated": "2023-11-07T05:31:56Z",
      "dateOfNextEvaluation": "2023-11-07T05:31:56Z",
      "dateOfLatestEvidence": "2023-11-07T05:31:56Z",
      "dateOfRenewal": "2023-11-07T05:31:56Z",
      "deactivatedReason": "<string>",
      "assigneeId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "blockedBy": [],
      "blocking": []
    }
  ],
  "resultsSummary": {
    "passing": 1,
    "total": 1
  },
  "immutable": true
}

{
  "code": 123,
  "error": "<string>"
}

Governance

Create a rule

Create a governance rule in a workspace.

A rule is one requirement. Its type decides how it is satisfied, and the two types accept different fields:

platform rules are evaluated automatically from the state of your workspace. Set automationType to the signal to check. Their scope must be project, and evidenceType and renewalCadenceDays must be omitted or null.
evidence rules are satisfied by attaching evidence. Set evidenceType to the kind of evidence that satisfies them. automationType and automationParams must be omitted or null.

A new rule belongs to no framework. Map it to one from the Openlayer app.

cURL

curl --request POST \
  --url https://api.openlayer.com/v1/workspaces/3fa85f64-5717-4562-b3fc-2c963f66afa6/rules \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "name": "Annual model risk review",
    "description": "Each high-risk project is reviewed and signed off once a year.",
    "scope": "project",
    "type": "evidence",
    "evidenceType": "document",
    "renewalCadenceDays": 365
  }'

{
  "id": "7c9a1e2b-3d4f-4a5b-8c6d-7e8f9a0b1c2d",
  "workspaceId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "name": "Monitoring enabled",
  "scope": "project",
  "type": "platform",
  "dateCreated": "2026-03-22T11:31:01.185Z",
  "dateUpdated": "2026-03-22T11:31:01.185Z",
  "description": "Each project must have Openlayer monitoring mode enabled.",
  "evidenceType": "document",
  "renewalCadenceDays": 90,
  "automationType": "monitoring_mode_enabled",
  "automationParams": {},
  "deactivated": false,
  "assigneeId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "tags": [
    {
      "id": "6e8a0c2d-4f5b-4a3c-9d7e-8f0a1b2c3d4e",
      "workspaceId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "creatorId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "name": "Evaluation",
      "immutable": false,
      "dateCreated": "2026-03-22T11:31:01.185Z",
      "dateUpdated": "2026-03-22T11:31:01.185Z",
      "color": "<string>"
    }
  ],
  "frameworks": [
    {
      "id": "<unknown>",
      "name": "<unknown>",
      "avatar": "<unknown>",
      "builtInSlug": "<unknown>",
      "enabled": "<unknown>"
    }
  ],
  "results": [
    {
      "id": "5b7d9f1a-2c3e-4d5f-8a6b-9c0d1e2f3a4b",
      "workspaceId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "ruleId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "status": "passing",
      "deactivated": false,
      "dateCreated": "2026-03-22T11:31:01.185Z",
      "dateUpdated": "2026-03-22T11:31:01.185Z",
      "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "statusMessage": "<string>",
      "dateLastEvaluated": "2023-11-07T05:31:56Z",
      "dateOfNextEvaluation": "2023-11-07T05:31:56Z",
      "dateOfLatestEvidence": "2023-11-07T05:31:56Z",
      "dateOfRenewal": "2023-11-07T05:31:56Z",
      "deactivatedReason": "<string>",
      "assigneeId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "blockedBy": [],
      "blocking": []
    }
  ],
  "resultsSummary": {
    "passing": 1,
    "total": 1
  },
  "immutable": true
}

{
  "code": 123,
  "error": "<string>"
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your workspace API key. See Find your API key for more information.

Path Parameters

workspaceId

string<uuid>

required

The workspace id.

Body

application/json

name

any

required

scope

any

required

type

any

required

description

any

evidenceType

any

renewalCadenceDays

any

automationType

any

automationParams

any

deactivated

any

assigneeId

any

tagIds

any

Response

Rule created.

string<uuid>

required

read-only

The rule id.

Example:

"7c9a1e2b-3d4f-4a5b-8c6d-7e8f9a0b1c2d"

workspaceId

string<uuid>

required

read-only

The id of the workspace the rule belongs to.

name

string

required

The rule name.

Maximum string length: 255

Example:

"Monitoring enabled"

scope

enum<string>

required

Whether the rule is evaluated once for the whole workspace, or once per project the rule's frameworks apply to.

Available options:

project,

workspace

Example:

"project"

type

enum<string>

required

platform rules are evaluated automatically from the state of your Openlayer workspace. evidence rules are satisfied by attaching evidence.

Available options:

platform,

evidence

Example:

"platform"

dateCreated

string<date-time>

required

read-only

The creation date.

Example:

"2026-03-22T11:31:01.185Z"

dateUpdated

string<date-time>

required

read-only

The last update date.

Example:

"2026-03-22T11:31:01.185Z"

description

string | null

What the rule requires.

Example:

"Each project must have Openlayer monitoring mode enabled."

evidenceType

enum<string> | null

The kind of evidence that satisfies the rule. null for platform rules.

Available options:

document,

text,

url,

categoryValue,

null

renewalCadenceDays

integer | null

How often evidence must be renewed, in days. Once evidence is older than this, the rule result becomes due_soon and then failing.

Required range: x >= 1

Example:

90

automationType

string | null

Which workspace signal a platform rule checks, for example monitoring_mode_enabled, test_setup, or project_owner_set. null for evidence rules.

Example:

"monitoring_mode_enabled"

automationParams

object | null

Configuration for the platform check, when the automation takes parameters.

deactivated

boolean

default:false

Whether the rule is excluded from compliance calculations.

assigneeId

string<uuid> | null

The user responsible for satisfying the rule.

Reference

SDKs

CLI

REST API

Create a rule

Authorizations

Path Parameters

Body

Response