Update draft version rules in place

curl --request PATCH \
  --url https://api.meshqu.com/v1/policies/{id}/versions/{version} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-MeshQu-Tenant-Id: <api-key>' \
  --data '
{
  "expected_revision": 1,
  "rules": [
    {
      "code": "<string>",
      "name": "<string>",
      "rule_type": "presence",
      "condition": {
        "required_fields": [
          "<string>"
        ],
        "forbidden_fields": [
          "<string>"
        ],
        "min_length": {}
      },
      "severity": "low",
      "description": "<string>",
      "is_active": true,
      "when": {
        "field": "<string>",
        "equals": "<string>",
        "case_sensitive": true
      },
      "source_ref": {
        "document": "<string>",
        "section": "<string>",
        "url": "<string>"
      },
      "replaces_rule_code": "<string>"
    }
  ],
  "change_reason": "<string>"
}
'

import requests

url = "https://api.meshqu.com/v1/policies/{id}/versions/{version}"

payload = {
    "expected_revision": 1,
    "rules": [
        {
            "code": "<string>",
            "name": "<string>",
            "rule_type": "presence",
            "condition": {
                "required_fields": ["<string>"],
                "forbidden_fields": ["<string>"],
                "min_length": {}
            },
            "severity": "low",
            "description": "<string>",
            "is_active": True,
            "when": {
                "field": "<string>",
                "equals": "<string>",
                "case_sensitive": True
            },
            "source_ref": {
                "document": "<string>",
                "section": "<string>",
                "url": "<string>"
            },
            "replaces_rule_code": "<string>"
        }
    ],
    "change_reason": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "X-MeshQu-Tenant-Id": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {
    Authorization: 'Bearer <token>',
    'X-MeshQu-Tenant-Id': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    expected_revision: 1,
    rules: [
      {
        code: '<string>',
        name: '<string>',
        rule_type: 'presence',
        condition: {required_fields: ['<string>'], forbidden_fields: ['<string>'], min_length: {}},
        severity: 'low',
        description: '<string>',
        is_active: true,
        when: {field: '<string>', equals: '<string>', case_sensitive: true},
        source_ref: {document: '<string>', section: '<string>', url: '<string>'},
        replaces_rule_code: '<string>'
      }
    ],
    change_reason: '<string>'
  })
};

fetch('https://api.meshqu.com/v1/policies/{id}/versions/{version}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.meshqu.com/v1/policies/{id}/versions/{version}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'expected_revision' => 1,
    'rules' => [
        [
                'code' => '<string>',
                'name' => '<string>',
                'rule_type' => 'presence',
                'condition' => [
                                'required_fields' => [
                                                                '<string>'
                                ],
                                'forbidden_fields' => [
                                                                '<string>'
                                ],
                                'min_length' => [
                                                                
                                ]
                ],
                'severity' => 'low',
                'description' => '<string>',
                'is_active' => true,
                'when' => [
                                'field' => '<string>',
                                'equals' => '<string>',
                                'case_sensitive' => true
                ],
                'source_ref' => [
                                'document' => '<string>',
                                'section' => '<string>',
                                'url' => '<string>'
                ],
                'replaces_rule_code' => '<string>'
        ]
    ],
    'change_reason' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "X-MeshQu-Tenant-Id: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.meshqu.com/v1/policies/{id}/versions/{version}"

	payload := strings.NewReader("{\n  \"expected_revision\": 1,\n  \"rules\": [\n    {\n      \"code\": \"<string>\",\n      \"name\": \"<string>\",\n      \"rule_type\": \"presence\",\n      \"condition\": {\n        \"required_fields\": [\n          \"<string>\"\n        ],\n        \"forbidden_fields\": [\n          \"<string>\"\n        ],\n        \"min_length\": {}\n      },\n      \"severity\": \"low\",\n      \"description\": \"<string>\",\n      \"is_active\": true,\n      \"when\": {\n        \"field\": \"<string>\",\n        \"equals\": \"<string>\",\n        \"case_sensitive\": true\n      },\n      \"source_ref\": {\n        \"document\": \"<string>\",\n        \"section\": \"<string>\",\n        \"url\": \"<string>\"\n      },\n      \"replaces_rule_code\": \"<string>\"\n    }\n  ],\n  \"change_reason\": \"<string>\"\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("X-MeshQu-Tenant-Id", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://api.meshqu.com/v1/policies/{id}/versions/{version}")
  .header("Authorization", "Bearer <token>")
  .header("X-MeshQu-Tenant-Id", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"expected_revision\": 1,\n  \"rules\": [\n    {\n      \"code\": \"<string>\",\n      \"name\": \"<string>\",\n      \"rule_type\": \"presence\",\n      \"condition\": {\n        \"required_fields\": [\n          \"<string>\"\n        ],\n        \"forbidden_fields\": [\n          \"<string>\"\n        ],\n        \"min_length\": {}\n      },\n      \"severity\": \"low\",\n      \"description\": \"<string>\",\n      \"is_active\": true,\n      \"when\": {\n        \"field\": \"<string>\",\n        \"equals\": \"<string>\",\n        \"case_sensitive\": true\n      },\n      \"source_ref\": {\n        \"document\": \"<string>\",\n        \"section\": \"<string>\",\n        \"url\": \"<string>\"\n      },\n      \"replaces_rule_code\": \"<string>\"\n    }\n  ],\n  \"change_reason\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.meshqu.com/v1/policies/{id}/versions/{version}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-MeshQu-Tenant-Id"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"expected_revision\": 1,\n  \"rules\": [\n    {\n      \"code\": \"<string>\",\n      \"name\": \"<string>\",\n      \"rule_type\": \"presence\",\n      \"condition\": {\n        \"required_fields\": [\n          \"<string>\"\n        ],\n        \"forbidden_fields\": [\n          \"<string>\"\n        ],\n        \"min_length\": {}\n      },\n      \"severity\": \"low\",\n      \"description\": \"<string>\",\n      \"is_active\": true,\n      \"when\": {\n        \"field\": \"<string>\",\n        \"equals\": \"<string>\",\n        \"case_sensitive\": true\n      },\n      \"source_ref\": {\n        \"document\": \"<string>\",\n        \"section\": \"<string>\",\n        \"url\": \"<string>\"\n      },\n      \"replaces_rule_code\": \"<string>\"\n    }\n  ],\n  \"change_reason\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "policy_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "version": 123,
  "draft_revision": 1,
  "rules": [
    {
      "code": "<string>",
      "name": "<string>",
      "rule_type": "presence",
      "condition": {
        "required_fields": [
          "<string>"
        ],
        "forbidden_fields": [
          "<string>"
        ],
        "min_length": {}
      },
      "severity": "low",
      "description": "<string>",
      "is_active": true,
      "when": {
        "field": "<string>",
        "equals": "<string>",
        "case_sensitive": true
      },
      "source_ref": {
        "document": "<string>",
        "section": "<string>",
        "url": "<string>"
      },
      "replaces_rule_code": "<string>"
    }
  ],
  "active_rules_hash": "<string>",
  "is_active": true,
  "status": "draft",
  "created_at": "2023-11-07T05:31:56Z",
  "created_by": "<string>",
  "change_reason": "<string>",
  "ratified_by": "<string>",
  "ratified_at": "2023-11-07T05:31:56Z",
  "submitted_by": "<string>",
  "submitted_at": "2023-11-07T05:31:56Z",
  "rejected_by": "<string>",
  "rejected_at": "2023-11-07T05:31:56Z",
  "rejection_reason": "<string>",
  "closed_at": "2023-11-07T05:31:56Z",
  "closed_by": "<string>",
  "closed_reason": "<string>",
  "supersedes_version_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "codification_record": {
    "schema": "meshqu-codification-record/v1",
    "source": {
      "document": "<string>",
      "url": "<string>"
    },
    "clauses": [
      {
        "unit_id": "<string>",
        "locator": "<string>",
        "text": "<string>"
      }
    ],
    "ledger": [
      {
        "unit_id": "<string>",
        "disposition": "mapped",
        "note": "<string>"
      }
    ],
    "counts": {
      "clauses": 123,
      "mapped": 123,
      "ambiguous": 123,
      "unsupported": 123,
      "non_normative": 123,
      "refused": 123
    },
    "refusals": [
      {
        "unit_id": "<string>",
        "rule_code": "<string>",
        "kind": "<string>",
        "message": "<string>"
      }
    ],
    "lint": {
      "schema": "meshqu-codification-lint/v1",
      "status": "ran",
      "answerer": "jev",
      "questions_version": "<string>",
      "floor": 123,
      "clauses": [
        {
          "unit_id": "<string>",
          "findings": [
            {
              "code": "guidance_as_obligation",
              "message": "<string>",
              "evidence": {
                "confidence": 123
              }
            }
          ],
          "needs_context": true
        }
      ],
      "reason": "<string>",
      "model": "<string>",
      "elapsed_ms": 123
    }
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

Policies

Update draft version rules in place

Autosave-style mutation of an in-flight draft version. expected_revision must match the current draft_revision; a successful write increments it atomically. Replaces the rules JSONB on the existing draft row — does NOT create a new version and does NOT write an audit entry. Returns 409 with STALE_DRAFT_REVISION and the current candidate after a conflicting write, or if the target version is not a draft; returns 404 if the version does not exist for the caller’s tenant.

Two callers are admitted, on different grounds: the draft’s own author, and an authoring-capability principal whose capability names this exact version id (the draft shell minted when the capability was issued). Everyone else receives 403 FORBIDDEN_NOT_AUTHOR.

Bounded write (MCP-034): the server abandons this write if any one lock wait exceeds 2000 ms, or if it is not ready to commit 4000 ms after the server began handling the request. An abandoned write is rolled back — nothing is written — and answered 503 AUTHORING_WRITE_CONTENDED with details.committed: false and a Retry-After header. That answer is a definite non-commit, safe to retry; it is distinct from a lost response or any other 5xx, whose outcome is unknown. The bound is counted from when THIS SERVER began handling the request, which a client cannot observe, and nothing bounds how late a request reaches the server: a client whose request timed out cannot conclude from any wait that it did not commit.

PATCH

policies

{id}

versions

{version}

Update draft version rules in place

curl --request PATCH \
  --url https://api.meshqu.com/v1/policies/{id}/versions/{version} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-MeshQu-Tenant-Id: <api-key>' \
  --data '
{
  "expected_revision": 1,
  "rules": [
    {
      "code": "<string>",
      "name": "<string>",
      "rule_type": "presence",
      "condition": {
        "required_fields": [
          "<string>"
        ],
        "forbidden_fields": [
          "<string>"
        ],
        "min_length": {}
      },
      "severity": "low",
      "description": "<string>",
      "is_active": true,
      "when": {
        "field": "<string>",
        "equals": "<string>",
        "case_sensitive": true
      },
      "source_ref": {
        "document": "<string>",
        "section": "<string>",
        "url": "<string>"
      },
      "replaces_rule_code": "<string>"
    }
  ],
  "change_reason": "<string>"
}
'

import requests

url = "https://api.meshqu.com/v1/policies/{id}/versions/{version}"

payload = {
    "expected_revision": 1,
    "rules": [
        {
            "code": "<string>",
            "name": "<string>",
            "rule_type": "presence",
            "condition": {
                "required_fields": ["<string>"],
                "forbidden_fields": ["<string>"],
                "min_length": {}
            },
            "severity": "low",
            "description": "<string>",
            "is_active": True,
            "when": {
                "field": "<string>",
                "equals": "<string>",
                "case_sensitive": True
            },
            "source_ref": {
                "document": "<string>",
                "section": "<string>",
                "url": "<string>"
            },
            "replaces_rule_code": "<string>"
        }
    ],
    "change_reason": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "X-MeshQu-Tenant-Id": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {
    Authorization: 'Bearer <token>',
    'X-MeshQu-Tenant-Id': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    expected_revision: 1,
    rules: [
      {
        code: '<string>',
        name: '<string>',
        rule_type: 'presence',
        condition: {required_fields: ['<string>'], forbidden_fields: ['<string>'], min_length: {}},
        severity: 'low',
        description: '<string>',
        is_active: true,
        when: {field: '<string>', equals: '<string>', case_sensitive: true},
        source_ref: {document: '<string>', section: '<string>', url: '<string>'},
        replaces_rule_code: '<string>'
      }
    ],
    change_reason: '<string>'
  })
};

fetch('https://api.meshqu.com/v1/policies/{id}/versions/{version}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.meshqu.com/v1/policies/{id}/versions/{version}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'expected_revision' => 1,
    'rules' => [
        [
                'code' => '<string>',
                'name' => '<string>',
                'rule_type' => 'presence',
                'condition' => [
                                'required_fields' => [
                                                                '<string>'
                                ],
                                'forbidden_fields' => [
                                                                '<string>'
                                ],
                                'min_length' => [
                                                                
                                ]
                ],
                'severity' => 'low',
                'description' => '<string>',
                'is_active' => true,
                'when' => [
                                'field' => '<string>',
                                'equals' => '<string>',
                                'case_sensitive' => true
                ],
                'source_ref' => [
                                'document' => '<string>',
                                'section' => '<string>',
                                'url' => '<string>'
                ],
                'replaces_rule_code' => '<string>'
        ]
    ],
    'change_reason' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "X-MeshQu-Tenant-Id: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.meshqu.com/v1/policies/{id}/versions/{version}"

	payload := strings.NewReader("{\n  \"expected_revision\": 1,\n  \"rules\": [\n    {\n      \"code\": \"<string>\",\n      \"name\": \"<string>\",\n      \"rule_type\": \"presence\",\n      \"condition\": {\n        \"required_fields\": [\n          \"<string>\"\n        ],\n        \"forbidden_fields\": [\n          \"<string>\"\n        ],\n        \"min_length\": {}\n      },\n      \"severity\": \"low\",\n      \"description\": \"<string>\",\n      \"is_active\": true,\n      \"when\": {\n        \"field\": \"<string>\",\n        \"equals\": \"<string>\",\n        \"case_sensitive\": true\n      },\n      \"source_ref\": {\n        \"document\": \"<string>\",\n        \"section\": \"<string>\",\n        \"url\": \"<string>\"\n      },\n      \"replaces_rule_code\": \"<string>\"\n    }\n  ],\n  \"change_reason\": \"<string>\"\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("X-MeshQu-Tenant-Id", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://api.meshqu.com/v1/policies/{id}/versions/{version}")
  .header("Authorization", "Bearer <token>")
  .header("X-MeshQu-Tenant-Id", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"expected_revision\": 1,\n  \"rules\": [\n    {\n      \"code\": \"<string>\",\n      \"name\": \"<string>\",\n      \"rule_type\": \"presence\",\n      \"condition\": {\n        \"required_fields\": [\n          \"<string>\"\n        ],\n        \"forbidden_fields\": [\n          \"<string>\"\n        ],\n        \"min_length\": {}\n      },\n      \"severity\": \"low\",\n      \"description\": \"<string>\",\n      \"is_active\": true,\n      \"when\": {\n        \"field\": \"<string>\",\n        \"equals\": \"<string>\",\n        \"case_sensitive\": true\n      },\n      \"source_ref\": {\n        \"document\": \"<string>\",\n        \"section\": \"<string>\",\n        \"url\": \"<string>\"\n      },\n      \"replaces_rule_code\": \"<string>\"\n    }\n  ],\n  \"change_reason\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.meshqu.com/v1/policies/{id}/versions/{version}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-MeshQu-Tenant-Id"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"expected_revision\": 1,\n  \"rules\": [\n    {\n      \"code\": \"<string>\",\n      \"name\": \"<string>\",\n      \"rule_type\": \"presence\",\n      \"condition\": {\n        \"required_fields\": [\n          \"<string>\"\n        ],\n        \"forbidden_fields\": [\n          \"<string>\"\n        ],\n        \"min_length\": {}\n      },\n      \"severity\": \"low\",\n      \"description\": \"<string>\",\n      \"is_active\": true,\n      \"when\": {\n        \"field\": \"<string>\",\n        \"equals\": \"<string>\",\n        \"case_sensitive\": true\n      },\n      \"source_ref\": {\n        \"document\": \"<string>\",\n        \"section\": \"<string>\",\n        \"url\": \"<string>\"\n      },\n      \"replaces_rule_code\": \"<string>\"\n    }\n  ],\n  \"change_reason\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "policy_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "version": 123,
  "draft_revision": 1,
  "rules": [
    {
      "code": "<string>",
      "name": "<string>",
      "rule_type": "presence",
      "condition": {
        "required_fields": [
          "<string>"
        ],
        "forbidden_fields": [
          "<string>"
        ],
        "min_length": {}
      },
      "severity": "low",
      "description": "<string>",
      "is_active": true,
      "when": {
        "field": "<string>",
        "equals": "<string>",
        "case_sensitive": true
      },
      "source_ref": {
        "document": "<string>",
        "section": "<string>",
        "url": "<string>"
      },
      "replaces_rule_code": "<string>"
    }
  ],
  "active_rules_hash": "<string>",
  "is_active": true,
  "status": "draft",
  "created_at": "2023-11-07T05:31:56Z",
  "created_by": "<string>",
  "change_reason": "<string>",
  "ratified_by": "<string>",
  "ratified_at": "2023-11-07T05:31:56Z",
  "submitted_by": "<string>",
  "submitted_at": "2023-11-07T05:31:56Z",
  "rejected_by": "<string>",
  "rejected_at": "2023-11-07T05:31:56Z",
  "rejection_reason": "<string>",
  "closed_at": "2023-11-07T05:31:56Z",
  "closed_by": "<string>",
  "closed_reason": "<string>",
  "supersedes_version_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "codification_record": {
    "schema": "meshqu-codification-record/v1",
    "source": {
      "document": "<string>",
      "url": "<string>"
    },
    "clauses": [
      {
        "unit_id": "<string>",
        "locator": "<string>",
        "text": "<string>"
      }
    ],
    "ledger": [
      {
        "unit_id": "<string>",
        "disposition": "mapped",
        "note": "<string>"
      }
    ],
    "counts": {
      "clauses": 123,
      "mapped": 123,
      "ambiguous": 123,
      "unsupported": 123,
      "non_normative": 123,
      "refused": 123
    },
    "refusals": [
      {
        "unit_id": "<string>",
        "rule_code": "<string>",
        "kind": "<string>",
        "message": "<string>"
      }
    ],
    "lint": {
      "schema": "meshqu-codification-lint/v1",
      "status": "ran",
      "answerer": "jev",
      "questions_version": "<string>",
      "floor": 123,
      "clauses": [
        {
          "unit_id": "<string>",
          "findings": [
            {
              "code": "guidance_as_obligation",
              "message": "<string>",
              "evidence": {
                "confidence": 123
              }
            }
          ],
          "needs_context": true
        }
      ],
      "reason": "<string>",
      "model": "<string>",
      "elapsed_ms": 123
    }
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

Authorizations

Authorization

string

header

required

MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).

X-MeshQu-Tenant-Id

string

header

required

Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked.

Path Parameters

string<uuid>

required

version

integer

required

Required range: x >= 1

Body

application/json

expected_revision

integer

required

Required range: x >= 0

rules

object[]

Minimum array length: 1

Show child attributes

change_reason

string

Required string length: 1 - 1000

Response

Default Response

string<uuid>

required

policy_id

string<uuid>

required

version

integer

required

draft_revision

integer

required

Required range: x >= 0

rules

object[]

required

Show child attributes

active_rules_hash

string

required

SHA-256 hex of projectActiveRules(rules) — the same projection and hash the review-submission seal's active_rules_hash and the ratification receipt's policy_rules_hash use. Compare against a sealed subject's active_rules_hash to tell whether the ACTIVE RULES' EVALUATED CONTENT (code/condition/severity/when, in stored order) is unchanged since that seal — not whether the rule objects as a whole (name, description, source_ref, an added inactive rule) are unchanged.

Pattern: ^[0-9a-f]{64}$

is_active

boolean

required

status

required

Lifecycle status: draft → submitted → ratified → (activated, then) superseded (or back to draft on reject); discarded = soft-discarded draft (PWB-039). A pending version that ends without governing is closed: reopened (a ratified version whose content continues as a new draft), set_aside (put aside with a reason), replaced (a draft whose correction continues as a new draft) — PAL-004/005.

Available options:

draft

created_at

string<date-time>

required

created_by

string | null

required

change_reason

string | null

required

ratified_by

string

ratified_at

string<date-time>

submitted_by

string

submitted_at

string<date-time>

rejected_by

string

rejected_at

string<date-time>

rejection_reason

string

closed_at

string<date-time>

closed_by

string

closed_reason

string

supersedes_version_id

string<uuid>

Present only on a version created by draft supersession: the id of the replaced draft this version continues. Written when the version is created and never changed. Absent on every other version, including one started after a set-aside or a reopen.

codification_record

object

What the codification that produced this version accounted for. Unsigned and unhashed; NOT a sealed review package.

Show child attributes

Getting Started

Concepts

API Reference

SDK

Guides

Recipes

Security

Meta

Update draft version rules in place

Authorizations

Path Parameters

Body

Response