# Preview team security policy Evaluates a team policy as enabled without saving it. Organization REST preview is not available; organization tokens must select a team through the team-scoped path. Service details are limited to readable projects. Aggregate counts may include inaccessible services; outcome counts sample at most 2,000 matches and compilationErrorCount describes the returned page. Body page/perPage paginate services; pagination.count is the total visible match count. Authentication values are redacted. Existing policies may retain passwords using empty strings. Required permission: Account > Networking > SecurityPolicies > Read **Request body:** {object} - `policyInternalId`: (string) (pattern: ^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$) (min length: 3) (max length: 100) - `spec`: {object} - `enabled`: (boolean) (required) - `priority`: (integer) (required) - `paths`: [array of] {object} - `path`: (string) (required) (min length: 1) - `matchMode`: (string) (required) (enum: exact, pathPrefix) - `accessMode`: (string) (required) (enum: protected, unprotected) - `securityPolicies`: {object} - `orPolicies`: {object} - `ip`: [array of] {object} - `addresses`: [array of] (string) (pattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))?$) - `action`: (string) (required) (enum: ALLOW, DENY) - `headers`: [array of] (multiple options) {object} - `regexMode`: (boolean) - `name`: (string) (required) (pattern: ^[a-zA-Z0-9_\-%$+]+$) - `value`: (string) (required) | {object} - `regexMode`: (boolean) - `name`: (string) (required) - `value`: (string) (required) - `credentials`: [array of] {object} - `username`: (string) (required) (pattern: ^[a-zA-Z](-?[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*)?$) (min length: 3) (max length: 39) - `password`: (string) (required) - `type`: (string) (required) (enum: basic-auth) - `sso`: {object} - `organizationId`: (string) (required) - `directoryGroupIds`: [array of] (string) - `allowAnyOrgUsers`: (boolean) - `validateInternalTraffic`: (boolean) - `setCookieOnRootDomain`: (boolean) - `noindexRedirect`: (boolean) - `allowInternalTrafficViaPublicDns`: (boolean) - `requiredPolicies`: {object} - `ip`: [array of] {object} - `addresses`: [array of] (string) (pattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))?$) - `action`: (string) (required) (enum: ALLOW, DENY) - `headers`: [array of] (multiple options) {object} - `regexMode`: (boolean) - `name`: (string) (required) (pattern: ^[a-zA-Z0-9_\-%$+]+$) - `value`: (string) (required) | {object} - `regexMode`: (boolean) - `name`: (string) (required) - `value`: (string) (required) - `credentials`: [array of] {object} - `username`: (string) (required) (pattern: ^[a-zA-Z](-?[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*)?$) (min length: 3) (max length: 39) - `password`: (string) (required) - `type`: (string) (required) (enum: basic-auth) - `sso`: {object} - `organizationId`: (string) (required) - `directoryGroupIds`: [array of] (string) - `allowAnyOrgUsers`: (boolean) - `validateInternalTraffic`: (boolean) - `setCookieOnRootDomain`: (boolean) - `noindexRedirect`: (boolean) - `allowInternalTrafficViaPublicDns`: (boolean) - `targets`: {object} - `projects`: {object} - `mode`: (string) (required) (enum: all, selected) - `ids`: [array of] (string) - `workloads`: {object} - `mode`: (string) (required) (enum: all, selected) - `items`: [array of] {object} - `projectId`: (string) (required) - `serviceId`: (string) (required) - `tags`: {object} - `enabled`: (boolean) (required) - `items`: [array of] (string) - `matchCondition`: (string) (required) (enum: or, and) - `exclusions`: {object} - `projects`: [array of] (string) - `workloads`: [array of] {object} - `projectId`: (string) (required) - `serviceId`: (string) (required) - `reason`: (string) (max length: 500) - `page`: (integer) - `perPage`: (integer) **Response body:** {object} - `data`: {object} - `matchedCount`: (integer) (required) - `inaccessibleCount`: (integer) (required) - `excludedCount`: (integer) (required) - `unsupportedCount`: (integer) (required) - `compilationErrorCount`: (integer) (required) - `wouldApplyCount`: (integer) (required) - `shadowedCount`: (integer) (required) - `conflictCount`: (integer) (required) - `outcomesSampled`: (boolean) (required) - `services`: [array of] {object} - `projectId`: (string) (required) (min length: 24) (max length: 24) - `projectInternalId`: (string) (required) - `serviceId`: (string) (required) (min length: 24) (max length: 24) - `serviceInternalId`: (string) (required) - `serviceType`: (string) (required) (enum: combined, deployment) - `result`: (string) (required) (enum: wins, shadowed, conflict) - `winningPathCount`: (integer) (required) - `shadowedPathCount`: (integer) (required) - `noPublicHttpPort`: (boolean) (required) - `compilationError`: (boolean) (required) - `conflict`: {object} - `priority`: (integer) (required) - `policyInternalIds`: [array of] (string) - `compilationIssues`: [array of] {object} - `portName`: (string) (required) - `paths`: [array of] {object} - `path`: (string) (required) - `routingMode`: (string) (required) (enum: exact, prefix, regex) - `priority`: (integer) - `reason`: (string) (required) (enum: compiledPathEntryLimit, effectiveConfigurationTooLarge, priorityTie) - `policyInternalIds`: [array of] (string) - `policyIds`: [array of] (string) (min length: 24) (max length: 24) - `usage`: [array of] {object} - `portName`: (string) (required) - `compiledPathEntries`: (integer) (required) - `encodedBytes`: (integer) (required) - `teamCandidates`: [array of] {object} - `policyId`: (string) (required) (min length: 24) (max length: 24) - `policyInternalId`: (string) (required) - `paths`: [array of] {object} - `path`: (string) (required) (min length: 1) - `matchMode`: (string) (required) (enum: exact, pathPrefix) - `accessMode`: (string) (required) (enum: protected, unprotected) - `priority`: (integer) (required) - `organizationCandidates`: [array of] {object} - `policyId`: (string) (required) (min length: 24) (max length: 24) - `policyInternalId`: (string) (required) - `paths`: [array of] {object} - `path`: (string) (required) (min length: 1) - `matchMode`: (string) (required) (enum: exact, pathPrefix) - `accessMode`: (string) (required) (enum: protected, unprotected) - `organizationPriority`: (integer) (required) - `inheritanceMode`: (string) (required) (enum: enforced, default) - `effectivePorts`: [array of] {object} - `portName`: (string) (required) - `pathRegions`: [array of] {object} - `paths`: [array of] {object} - `path`: (string) (required) - `routingMode`: (string) (required) (enum: exact, prefix, regex) - `accessMode`: (string) (required) (enum: protected, unprotected) - `source`: {object} - `sourceType`: (string) (required) (enum: organization, team, service, system) - `sourceEntityId`: (string) (required) (min length: 24) (max length: 24) - `policyId`: (string) (min length: 24) (max length: 24) - `policyInternalId`: (string) - `shadowed`: [array of] {object} - `sourceType`: (string) (required) (enum: organization, team, service, system) - `sourceEntityId`: (string) (required) (min length: 24) (max length: 24) - `policyId`: (string) (min length: 24) (max length: 24) - `policyInternalId`: (string) - `reason`: (string) (required) (enum: lowerPriority, organizationEnforced, teamReplacedOrganizationDefault, defaultOverrodeEnforced, excluded, serviceFallbackShadowed, protectionReduction, compilerFailClosed) - `securityPolicies`: {object} - `orPolicies`: {object} - `ip`: [array of] {object} - `addresses`: [array of] (string) - `action`: (string) (required) (enum: ALLOW, DENY) - `headers`: [array of] {object} - `name`: (string) (required) - `regexMode`: (boolean) - `valueConfigured`: (boolean) (required) - `credentials`: [array of] {object} - `username`: (string) (required) - `type`: (string) (required) (enum: basic-auth) - `passwordConfigured`: (boolean) (required) - `sso`: {object} - `organizationId`: (string) (required) - `directoryGroupIds`: [array of] (string) - `allowAnyOrgUsers`: (boolean) - `validateInternalTraffic`: (boolean) - `setCookieOnRootDomain`: (boolean) - `noindexRedirect`: (boolean) - `allowInternalTrafficViaPublicDns`: (boolean) - `requiredPolicies`: {object} - `ip`: [array of] {object} - `addresses`: [array of] (string) - `action`: (string) (required) (enum: ALLOW, DENY) - `headers`: [array of] {object} - `name`: (string) (required) - `regexMode`: (boolean) - `valueConfigured`: (boolean) (required) - `credentials`: [array of] {object} - `username`: (string) (required) - `type`: (string) (required) (enum: basic-auth) - `passwordConfigured`: (boolean) (required) - `sso`: {object} - `organizationId`: (string) (required) - `directoryGroupIds`: [array of] (string) - `allowAnyOrgUsers`: (boolean) - `validateInternalTraffic`: (boolean) - `setCookieOnRootDomain`: (boolean) - `noindexRedirect`: (boolean) - `allowInternalTrafficViaPublicDns`: (boolean) - `protectionReductions`: [array of] {object} - `portName`: (string) (required) - `paths`: [array of] {object} - `path`: (string) (required) - `routingMode`: (string) (required) (enum: exact, prefix, regex) - `source`: {object} - `sourceType`: (string) (required) (enum: organization, team, service, system) - `sourceEntityId`: (string) (required) (min length: 24) (max length: 24) - `policyId`: (string) (min length: 24) (max length: 24) - `policyInternalId`: (string) - `pagination`: {object} - `page`: (integer) (required) - `perPage`: (integer) (required) - `count`: (integer) (required) ## API reference POST /v1/security-policies/preview POST /v1/teams/{teamId}/security-policies/preview ### Example request Request body ```curl curl --header "Content-Type: application/json" \ --header "Authorization: Bearer NORTHFLANK_API_TOKEN" \ --request POST \ --data '{"spec":{"securityPolicies":{"orPolicies":{"headers":[{"regexMode":false,"name":"headerName","value":"headerValue"}]},"requiredPolicies":{"headers":[{"regexMode":false,"name":"headerName","value":"headerValue"}]}},"enabled":false,"priority":0,"paths":[{"path":"string","matchMode":"exact"}],"accessMode":"protected","targets":{"projects":{"mode":"all","ids":[]},"workloads":{"mode":"all","items":[]},"tags":{"enabled":false,"items":[],"matchCondition":"or"}},"exclusions":{"projects":[],"workloads":[]}}}' \ https://api.northflank.com/v1/security-policies/preview ``` ```javascript const payload = { "spec": { "securityPolicies": { "orPolicies": { "headers": [ { "regexMode": false, "name": "headerName", "value": "headerValue" } ] }, "requiredPolicies": { "headers": [ { "regexMode": false, "name": "headerName", "value": "headerValue" } ] } }, "enabled": false, "priority": 0, "paths": [ { "path": "string", "matchMode": "exact" } ], "accessMode": "protected", "targets": { "projects": { "mode": "all", "ids": [] }, "workloads": { "mode": "all", "items": [] }, "tags": { "enabled": false, "items": [], "matchCondition": "or" } }, "exclusions": { "projects": [], "workloads": [] } } } const response = await fetch('https://api.northflank.com/v1/security-policies/preview', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${NORTHFLANK_API_TOKEN}` }, body: JSON.stringify(payload) }) const json = await response.json() console.log(json) ``` ```python import requests url = "https://api.northflank.com/v1/security-policies/preview" payload = {"spec":{"securityPolicies":{"orPolicies":{"headers":[{"regexMode":false,"name":"headerName","value":"headerValue"}]},"requiredPolicies":{"headers":[{"regexMode":false,"name":"headerName","value":"headerValue"}]}},"enabled":false,"priority":0,"paths":[{"path":"string","matchMode":"exact"}],"accessMode":"protected","targets":{"projects":{"mode":"all","ids":[]},"workloads":{"mode":"all","items":[]},"tags":{"enabled":false,"items":[],"matchCondition":"or"}},"exclusions":{"projects":[],"workloads":[]}}} headers = {"Content-Type": "application/json", "Authorization": "Bearer NORTHFLANK_API_TOKEN"} response = requests.request("POST", url, headers = headers, json = payload) print(response.json()) ``` ```go package main import ( "bytes" "fmt" "io/ioutil" "net/http" ) func main() { url := "https://api.northflank.com/v1/security-policies/preview" var jsonStr = []byte(`{"spec":{"securityPolicies":{"orPolicies":{"headers":[{"regexMode":false,"name":"headerName","value":"headerValue"}]},"requiredPolicies":{"headers":[{"regexMode":false,"name":"headerName","value":"headerValue"}]}},"enabled":false,"priority":0,"paths":[{"path":"string","matchMode":"exact"}],"accessMode":"protected","targets":{"projects":{"mode":"all","ids":[]},"workloads":{"mode":"all","items":[]},"tags":{"enabled":false,"items":[],"matchCondition":"or"}},"exclusions":{"projects":[],"workloads":[]}}}`) req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonStr)) req.Header.Set("Content-Type", "application/json") req.Header.Set("Authorization", "Bearer NORTHFLANK_API_TOKEN") client := &http.Client{} resp, err := client.Do(req) if err != nil { panic(err) } defer resp.Body.Close() fmt.Println("Response status:", resp.Status) fmt.Println("Response headers:", resp.Header) body, _ := ioutil.ReadAll(resp.Body) fmt.Println("Response body:", string(body)) } ``` ### Example Response 200 OK: Team policy preview with redacted authentication values. ```json undefined ``` ## CLI reference $ northflank preview security-policy Options: - `-f --file `: Path to a JSON/YAML resource definition file - `-i --input `: JSON/YAML resource definition string (takes precedence over --file) - `--verbose `: Verbose output - `--quiet `: No console output - `-o --output `: Output formatting ```json { "spec": { "securityPolicies": { "orPolicies": { "headers": [ { "regexMode": false, "name": "headerName", "value": "headerValue" } ] }, "requiredPolicies": { "headers": [ { "regexMode": false, "name": "headerName", "value": "headerValue" } ] } }, "enabled": false, "priority": 0, "paths": [ { "path": "string", "matchMode": "exact" } ], "accessMode": "protected", "targets": { "projects": { "mode": "all", "ids": [] }, "workloads": { "mode": "all", "items": [] }, "tags": { "enabled": false, "items": [], "matchCondition": "or" } }, "exclusions": { "projects": [], "workloads": [] } } } ``` ### Example Response Team policy preview with redacted authentication values. ```json undefined ``` ## JavaScript client reference ### Example request With an organization token, add `parameters.teamId`. [Organization API access](/docs/v1/api/use-the-api#organization-api-access). ```javascript await apiClient.preview.securityPolicy({ data: { "spec": { "securityPolicies": { "orPolicies": { "headers": [ { "regexMode": false, "name": "headerName", "value": "headerValue" } ] }, "requiredPolicies": { "headers": [ { "regexMode": false, "name": "headerName", "value": "headerValue" } ] } }, "enabled": false, "priority": 0, "paths": [ { "path": "string", "matchMode": "exact" } ], "accessMode": "protected", "targets": { "projects": { "mode": "all", "ids": [] }, "workloads": { "mode": "all", "items": [] }, "tags": { "enabled": false, "items": [], "matchCondition": "or" } }, "exclusions": { "projects": [], "workloads": [] } } } }); ``` ### Example Response Team policy preview with redacted authentication values. ```json { "rawResponse": "...", "request": "...", "error": "..." } ``` ## Python client reference ### Example request [Set up the Python client](/docs/v1/api/use-the-python-client#usage). With an organization token, add `team_id`. [Organization API access](/docs/v1/api/use-the-api#organization-api-access). Python SDK 2.1.0 has no generated method for this endpoint. Use the API example for this request. Previous: [Put security policy](/docs/v1/api/team/security-policies/put-security-policy) Next: [Get security policy](/docs/v1/api/team/security-policies/get-security-policy)