> ## Documentation Index > Fetch the complete documentation index at: https://docs.meshqu.com/llms.txt > Use this file to discover all available pages before exploring further. # Submit policy version for review > Transitions a draft policy version to "submitted" state. Requires the actor to be the draft author. Blocks if another draft or submitted version exists for the same policy. The request body is intentionally omitted from the schema so callers may invoke this endpoint with no body (Fastify rejects `undefined` bodies when a body schema is attached). ## OpenAPI ````yaml /api/openapi.json post /v1/policies/{id}/versions/{version}/submit openapi: 3.1.0 info: title: MeshQu API description: >- Governance infrastructure for policy-aware AI decisions. MeshQu does not run tools. It governs decisions about them. version: 1.9.0 contact: name: MeshQu Support email: support@meshqu.com license: name: Proprietary servers: - url: https://api.meshqu.com description: Deployed environment security: - apiKey: [] tenantId: [] tags: - name: Operations description: Health, readiness, metrics, and signing keys - name: Policies description: Policy management - name: Policy Groups description: Policy group management - name: Decisions description: Policy evaluation and recording - name: Chains description: Decision chain verification and sealing - name: Receipts description: Public receipt and bundle retrieval - name: Forms description: Attestation forms and public submission - name: Alerts description: Alert management and webhooks - name: Audit description: Audit log retrieval and verification - name: API Keys description: API key administration - name: Admin description: Tenant and platform administration - name: Dashboard description: Console dashboard data - name: Metrics description: Decision and overview metrics - name: Fields description: Field catalogue - name: Settings description: Tenant settings - name: Rule Creation Logs description: Rule authoring telemetry paths: /v1/policies/{id}/versions/{version}/submit: post: tags: - Policies summary: Submit policy version for review description: >- Transitions a draft policy version to "submitted" state. Requires the actor to be the draft author. Blocks if another draft or submitted version exists for the same policy. The request body is intentionally omitted from the schema so callers may invoke this endpoint with no body (Fastify rejects `undefined` bodies when a body schema is attached). operationId: postV1PoliciesByIdVersionsByVersionSubmit parameters: - schema: format: uuid type: string in: path name: id required: true - schema: minimum: 1 type: integer in: path name: version required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: id: format: uuid type: string policy_id: format: uuid type: string version: type: integer rules: type: array items: type: object properties: code: minLength: 1 maxLength: 50 type: string name: minLength: 1 maxLength: 200 type: string description: maxLength: 1000 type: string rule_type: anyOf: - type: string enum: - presence - type: string enum: - temporal - type: string enum: - threshold - type: string enum: - list - type: string enum: - expression condition: anyOf: - additionalProperties: true type: object properties: required_fields: type: array items: type: string forbidden_fields: type: array items: type: string min_length: type: object additionalProperties: type: integer - additionalProperties: true type: object properties: field: type: string not_expired: type: boolean not_future: type: boolean reference_field: type: string max_days_after: type: integer min_days_before: type: integer - additionalProperties: true type: object properties: field: type: string min: type: number max: type: number greater_than: type: number less_than: type: number - additionalProperties: true type: object properties: field: type: string allowed: type: array items: type: string forbidden: type: array items: type: string case_sensitive: type: boolean - additionalProperties: true type: object properties: expression: type: string severity: anyOf: - type: string enum: - low - type: string enum: - medium - type: string enum: - high - type: string enum: - critical is_active: default: true type: boolean when: anyOf: - additionalProperties: false type: object properties: field: type: string equals: anyOf: - type: string - type: number - type: boolean required: - field - equals - additionalProperties: false type: object properties: field: type: string in: type: array items: anyOf: - type: string - type: number required: - field - in - additionalProperties: false type: object properties: field: type: string exists: type: boolean required: - field - exists - additionalProperties: false type: object properties: all: type: array items: 83abff0b-e22a-4f98-ae9c-b4e78ccc21bb required: - all - additionalProperties: false type: object properties: any: type: array items: 83abff0b-e22a-4f98-ae9c-b4e78ccc21bb required: - any source_ref: type: object properties: document: maxLength: 500 type: string section: maxLength: 200 type: string url: maxLength: 2000 type: string replaces_rule_code: maxLength: 50 description: >- Advisory lineage: rule code this replaces (not included in snapshot hash) type: string required: - code - name - rule_type - condition - severity is_active: type: boolean status: description: >- Lifecycle status: draft → submitted → ratified → superseded (or back to draft on reject) anyOf: - type: string enum: - draft - type: string enum: - submitted - type: string enum: - ratified - type: string enum: - superseded ratified_by: type: string ratified_at: format: date-time type: string submitted_by: type: string submitted_at: format: date-time type: string rejected_by: type: string rejected_at: format: date-time type: string rejection_reason: type: string created_at: format: date-time type: string created_by: anyOf: - type: string - type: 'null' change_reason: anyOf: - type: string - type: 'null' required: - id - policy_id - version - rules - is_active - status - created_at - created_by - change_reason '400': description: Default Response content: application/json: schema: type: object properties: error: type: object properties: code: description: Error code type: string message: description: Human-readable message type: string details: description: Additional error details required: - code - message correlation_id: description: Request correlation ID type: string required: - error '403': description: Default Response content: application/json: schema: type: object properties: error: type: object properties: code: description: Error code type: string message: description: Human-readable message type: string details: description: Additional error details required: - code - message correlation_id: description: Request correlation ID type: string required: - error '404': description: Default Response content: application/json: schema: type: object properties: error: type: object properties: code: description: Error code type: string message: description: Human-readable message type: string details: description: Additional error details required: - code - message correlation_id: description: Request correlation ID type: string required: - error '409': description: Default Response content: application/json: schema: type: object properties: error: type: object properties: code: description: Error code type: string message: description: Human-readable message type: string details: description: Additional error details required: - code - message correlation_id: description: Request correlation ID type: string required: - error components: securitySchemes: apiKey: type: http scheme: bearer bearerFormat: mqu_ description: >- MeshQu API key passed as a bearer token: `Authorization: Bearer mqu_…`. Mint one in the console (Settings → API keys). tenantId: type: apiKey name: X-MeshQu-Tenant-Id in: header description: >- Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked. ````