Get a policy

Returns one policy including requirement text, mapped frameworks, controls, and authorship metadata. Optional expansions via fields: aiDetectedGaps, documents, versionHistory, tickets. documents never includes Scrut-hosted or presigned file URLs. Requires scope policy:read or policy:write.

curl -X GET "https://api.scrut.io/v1/policies/f293847a-0476-4878-b999-598d2448d00d?fields=aiDetectedGaps%2Cdocuments%2CversionHistory" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN (JWT)"

import requests
import json

url = "https://api.scrut.io/v1/policies/f293847a-0476-4878-b999-598d2448d00d?fields=aiDetectedGaps%2Cdocuments%2CversionHistory"
headers = {
  "Content-Type": "application/json",
  "Authorization": "Bearer YOUR_API_TOKEN (JWT)"
}

response = requests.get(url, headers=headers)
print(response.json())

const response = await fetch("https://api.scrut.io/v1/policies/f293847a-0476-4878-b999-598d2448d00d?fields=aiDetectedGaps%2Cdocuments%2CversionHistory", {
  method: "GET",
  headers: {
  "Content-Type": "application/json",
  "Authorization": "Bearer YOUR_API_TOKEN (JWT)"
}
});

const data = await response.json();
console.log(data);

package main

import (
    "fmt"
    "net/http"
)

func main() {

    req, err := http.NewRequest("GET", "https://api.scrut.io/v1/policies/f293847a-0476-4878-b999-598d2448d00d?fields=aiDetectedGaps%2Cdocuments%2CversionHistory", nil)
    if err != nil {
        panic(err)
    }

    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN (JWT)")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    fmt.Println("Response Status:", resp.Status)
}

require 'net/http'
require 'json'

uri = URI('https://api.scrut.io/v1/policies/f293847a-0476-4878-b999-598d2448d00d?fields=aiDetectedGaps%2Cdocuments%2CversionHistory')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true

request = Net::HTTP::Get.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN (JWT)'

response = http.request(request)
puts response.body

{
  "data": {
    "policyId": "f293847a-0476-4878-b999-598d2448d00d",
    "policyCustomId": "POL-12",
    "policyName": "Information Security Policy",
    "status": "not_uploaded",
    "policyBehavior": "Requires acceptance",
    "department": "Security",
    "assignees": [
      {
        "name": "Alex Rivera",
        "email": "alex@example.com",
        "isPrimary": true
      }
    ],
    "approvers": [
      {
        "name": "Alex Rivera",
        "email": "alex@example.com"
      }
    ],
    "isRelevant": true,
    "nextReviewDate": 1704067200000,
    "policyRequirementText": "Maintain and review an information security policy at least annually.",
    "entities": [
      {
        "entityId": "8fa88e7b-eb16-4999-854a-2f407958740a",
        "entityName": "Organization Wide"
      }
    ],
    "mappedFrameworks": [
      {
        "frameworkId": "14c4c45d-6c31-4097-a02a-ad9cfd04850e",
        "frameworkName": "SOC 2"
      }
    ],
    "mappedControls": [
      {
        "controlId": "2aa1b21e-4705-47cd-b1a7-e74ed4808bc9",
        "controlCode": "DCH-14.2",
        "controlName": "Transfer Authorizations"
      }
    ],
    "mappedRequirements": [
      {
        "frameworkId": "14c4c45d-6c31-4097-a02a-ad9cfd04850e",
        "frameworkName": "SOC 2",
        "requirementId": "b7e1c4a2-6f30-4d8a-9c15-2a8e4f1b0d63",
        "requirementCode": "CC6.1",
        "requirementName": "Logical Access Security"
      }
    ],
    "notRelevantReason": "Covered by the parent information security policy.",
    "versionNumber": "3",
    "effortEstimate": "low",
    "recurrence": "annually",
    "source": "Scrut",
    "publishedBy": {
      "name": "Alex Rivera",
      "email": "alex@example.com"
    },
    "publishedOn": 1704067200000,
    "addedBy": {
      "name": "Alex Rivera",
      "email": "alex@example.com"
    },
    "addedOn": 1704067200000,
    "lastModifiedBy": {
      "name": "Alex Rivera",
      "email": "alex@example.com"
    },
    "modifiedOn": 1704067200000,
    "gapStatus": "no_gaps",
    "aiDetectedGaps": [
      "Missing annual review date"
    ],
    "documents": [
      {
        "displayName": "ISP-v3.pdf",
        "type": "File",
        "url": "https://intranet.example.com/policies/isp-v3",
        "note": "Approved by the security lead.",
        "addedBy": {
          "name": "Alex Rivera",
          "email": "alex@example.com"
        },
        "addedOn": 1704067200000,
        "updatedBy": {
          "name": "Alex Rivera",
          "email": "alex@example.com"
        },
        "updatedOn": 1704067200000
      }
    ],
    "versionHistory": [
      {
        "versionName": "v3",
        "publishedBy": {
          "name": "Alex Rivera",
          "email": "alex@example.com"
        },
        "publishedOn": 1704067200000
      }
    ],
    "tickets": [
      {
        "ticketId": "SEC-104",
        "source": "jira",
        "url": "https://jira.example/browse/SEC-104"
      }
    ]
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "validation_failed",
    "message": "Request validation failed.",
    "details": [
      {
        "field": "status",
        "message": "status contains unknown value(s): unknown"
      }
    ]
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "Missing, malformed, or invalid Bearer token.",
    "details": []
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "token_stale",
    "message": "The access token is stale; obtain a new token.",
    "details": []
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "rate_limit_exceeded",
    "message": "Rate limit exceeded.",
    "details": [
      {
        "retryAfterSec": 12
      }
    ]
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "upstream_unavailable",
    "message": "Upstream service is unavailable.",
    "details": [
      {
        "dependency": "frameworks",
        "issue": "Failed to process frameworks."
      }
    ]
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

GET

/v1/policies/{policyId}

GET

Base URLstring

Target server for requests. Edit to use your own host.

Bearer Token (JWT)

Bearer Tokenstring

Required

Machine access token from POST /oauth/token. Send Authorization: Bearer $SCRUT_ACCESS_TOKEN on every /v1 request.

path

policyIdstring

Required

Policy identifier returned by list and get endpoints.

query

fieldsstring

Optional expansions. Default get response already includes core metadata; use this to add aiDetectedGaps, documents, versionHistory, or tickets. Pass a comma-separated list (no spaces required). Allowed values: aiDetectedGaps, documents, versionHistory, tickets.