<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Building Security Policy Automation

## Open Policy Agent (OPA)

### OPA CLI

| Command | Description |
|---------|-------------|
| `opa eval -d policy.rego -i input.json "data.security.deny"` | Evaluate policy against input |
| `opa test -v policy_test.rego` | Run policy unit tests |
| `opa build -b ./policies -o bundle.tar.gz` | Build policy bundle |
| `opa run --server --addr :8181` | Start OPA as HTTP server |
| `opa fmt -w policy.rego` | Format Rego file in place |

### OPA REST API

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/v1/data/{path}` | POST | Query policy decision with input |
| `/v1/policies/{id}` | PUT | Upload/update policy module |
| `/v1/policies` | GET | List loaded policies |
| `/v0/data/{path}` | POST | Legacy query endpoint |
| `/health` | GET | Health check |

## Kubernetes Policy Engines

### Kyverno

| Resource | Description |
|----------|-------------|
| `ClusterPolicy` | Cluster-wide policy definition |
| `Policy` | Namespace-scoped policy |
| `PolicyReport` | Audit results per namespace |
| `ClusterPolicyReport` | Cluster-wide audit results |

### Gatekeeper (OPA)

| Resource | Description |
|----------|-------------|
| `ConstraintTemplate` | Define parameterized policy with Rego |
| `Constraint` | Instantiate template with parameters |
| `Config` | Sync external data for policy decisions |

## Policy Document Platforms

| Platform | API | Use Case |
|----------|-----|----------|
| Confluence | REST v2 | Policy publishing and versioning |
| SharePoint | Graph API | Document distribution and attestation |
| Drata | REST API | Automated compliance evidence collection |
| Vanta | REST API | Policy management and control mapping |
