Every CEL policy evaluation receives a type field indicating the kind of change being evaluated. The type value determines what keys are available in referencedResources and request. Use type to guard a policy so it only runs for the change types it is designed to handle.
For an Entity change that is part of a Module installation, referencedResources also includes module and moduleRelease keys for the associated Module.
All change types populate request with type-specific fields. The available fields for each type are described below.
All entries in referencedResources have the following four fields:
| Field | Type | Description |
|---|---|---|
rid | string | The resource identifier (RID). Pass this to require_role() or require_operation() to gate approval on a user's permissions for this resource. |
name | string | The display name of the resource, such as an Environment name or Product ID. |
labels | map | Labels applied to the resource. Keys and values are strings. Empty if no labels are applied. |
authorRoles | set | Roles held by the change author on this resource. Each entry is a role ID string such as "entity:operator". Empty if the author holds no roles. |
Most entries also have a resource field containing the full resource object serialized as a map. Fields within resource vary by resource type. For example, referencedResources.artifactRegistry.resource.registryType holds the registry type for artifact registry entities. The resource field is empty for the following change types:
CREATE_PIPELINECREATE_TEAMCREATE_EGRESS_POLICIESDELETE_EGRESS_POLICIESMODIFY_VULNERABILITY_SUPPRESSIONSREMOVE_VULNERABILITY_SUPPRESSIONSMODIFY_SPACE_SETTINGSMODIFY_RESOURCE_OVERRIDE_SPACE_SETTINGSCREATE_ENTITYTriggered when an Entity is added to an Environment.
Available referencedResources keys: environment, product (if the Entity has a Product assigned)
Available request fields:
| Field | Type | Description |
|---|---|---|
apolloEntityId | string | Unique identifier for the Entity. |
apolloEntityType | string | Entity type, such as "service", "daemon", or "network-security". |
releaseChannel | string | The Release Channel assigned to this Entity. Absent if the Entity inherits the Environment default. |
configOverrides | map | The product-specific configuration for this Entity. Keys are version strings; values are the configuration map for that version. |
entity | map | The serialized entity settings. Present for Entities declared in deployment config (services, daemons, Helm charts, and similar); empty for tracked assets. See entity sub-fields. |
asset | map | The serialized asset settings. Present for tracked assets; empty for Entities declared in deployment config. See asset sub-fields. |
UPDATE_ENTITYTriggered when an Entity's application configuration is modified.
Available referencedResources keys: environment, installation, product (if the Entity has a Product assigned)
Available request fields:
| Field | Type | Description |
|---|---|---|
apolloEntityId | string | Unique identifier for the Entity. |
apolloEntityType | string | Entity type, such as "service", "daemon", or "network-security". |
releaseChannel | string | The Release Channel assigned to this Entity. Absent if the Entity inherits the Environment default. |
configOverrides | map | The proposed product-specific configuration for this Entity after the update. Same structure as for CREATE_ENTITY. See network-security configOverrides for the network-security Entity type. |
entity | map | The serialized Entity settings. Present for Entities declared in deployment config; empty for tracked assets. See entity sub-fields. |
asset | map | The serialized asset settings. Present for tracked assets; empty for Entities declared in deployment config. See asset sub-fields. |
UPDATE_ENTITY_SETTINGSTriggered when an Entity's operational settings are modified, such as its Release Channel. Also produced when an Entity is marked for deletion.
Available referencedResources keys: environment, installation, product (if the Entity has a Product assigned)
Available request fields:
| Field | Type | Description |
|---|---|---|
apolloEntityId | string | Unique identifier for the Entity. |
apolloEntityType | string | Entity type, such as "service", "daemon", or "network-security". |
releaseChannel | string | The Release Channel assigned to this Entity after the update. Absent if the Entity inherits the Environment default. |
configOverrides | map | The product-specific configuration for this Entity. Keys are version strings; values are the configuration map for that version. |
entity | map | The serialized entity settings. Present for Entities declared in deployment config; empty for tracked assets. See entity sub-fields. |
asset | map | The serialized asset settings. Present for tracked assets; empty for Entities declared in deployment config. See asset sub-fields. |
DELETE_ENTITYTriggered when an Entity is removed from the deployment configuration.
Available referencedResources keys: environment, installation, product (if the Entity has a Product assigned)
Available request fields:
| Field | Type | Description |
|---|---|---|
apolloEntityId | string | Unique identifier for the Entity being deleted. |
apolloEntityType | string | Entity type, such as "service" or "daemon". |
entity sub-fieldsThe entity field is a map containing the serialized entity settings. It is present for Entities declared in deployment config (services, daemons, Helm charts, and similar) and empty for tracked assets.
| Field | Type | Description |
|---|---|---|
entityLocator | object | Entity-type-specific locator identifying the Entity within its Environment. |
releaseChannel | string | The Entity's Release Channel. Absent if the Entity inherits the Environment default. |
maintenanceWindows | object | Maintenance window schedule configured on this Entity. Absent if not set. |
dependencyStackOverrides | map | Per-dependency configuration overrides, keyed by Product ID. |
ignoredDependencies | set | Product IDs of dependencies that Apollo should ignore for this Entity. |
rolloutStrategy | object | Rollout strategy override. Absent if using the default. |
tracks | set | Asset tracks. Applicable to tracked assets only. |
product | string | Product ID explicitly set on this Entity. Absent if not overridden. |
targetInfrastructureType | string | Infrastructure type override. Absent if not set. |
markedForDeletion | boolean | Whether this Entity is marked for deletion. Absent if not marked. |
markedForUninstallation | object | Configuration for uninstalling this Entity. Absent if not set. |
helmReleaseName | string | Helm release name. Applicable to Helm chart Entities only. |
k8sNamespace | string | Kubernetes namespace. Applicable to Helm chart Entities only. |
accountId | string | AWS account ID. Applicable to Terraform module Entities only. |
foundrySpace | string | Foundry space. Applicable to Foundry product Entities only. |
dependencyGroups | set | Dependency groups. Applicable to Helm charts, Terraform modules, and Foundry products. |
dependencyGroupOverrides | map | Dependency group overrides, keyed by Product ID. |
asset sub-fieldsThe asset field is a map containing the serialized asset settings. It is present for tracked assets and empty for Entities declared in deployment config.
| Field | Type | Description |
|---|---|---|
locator | string | Product ID of the tracked asset. |
dependencyStackOverrides | map | Per-dependency configuration overrides, keyed by Product ID. |
ignoredDependencies | set | Product IDs of dependencies that Apollo should ignore for this asset. |
markedForDeletion | boolean | Whether this asset is marked for deletion. Absent if not marked. |
markedForUninstallation | object | Configuration for uninstalling this asset. Absent if not set. |
network-security configOverridesFor network-security entities, configOverrides is not a version-keyed map. It is the serialized declared state of the network security rule, structured as a union with a type discriminator field. The only current variant is "v1".
| Field | Type | Description |
|---|---|---|
type | string | The rule variant. Currently always "v1". |
v1 | object | The rule contents. See sub-fields below. |
v1 sub-fields:
| Field | Type | Description |
|---|---|---|
description | string | A human-readable description of the rule. |
ruleDetails | object | The rule type and configuration. Has a type field identifying the variant. Access the variant as v1.ruleDetails.<type>, for example v1.ruleDetails.egressRule. |
quarantined | Boolean | If true, the rule is treated as withdrawn. Absent if not set. |
ruleDetails variants:
| Variant | Description |
|---|---|
egressRule | Outbound traffic rule. Has dest (a union with type of "cidrs" or "domain"; access the value as dest.cidrs (set of CIDR strings) or dest.domain (string)), ports (a set of port entries, each with type of "port" or "portRange"; access as port (integer) or portRange.start/portRange.end), and namespaces (set of strings). |
httpsIngressRule | HTTPS ingress rule by domain. Has domain (string), allowedCidrs (set of objects with justification (string) and cidrs (set of strings)), and allowedCountryCodes (set of objects with justification (string) and countryCodes (set of strings)). |
httpsPortIngressRule | HTTPS ingress rule by port. Has port (integer), allowedCidrs, and allowedCountryCodes. Same structure as httpsIngressRule. |
tcpIngressRule | TCP ingress rule. Has ports (set of integers) and allowedCidrs. |
udpIngressRule | UDP ingress rule. Has ports (set of integers) and allowedCidrs. |
SET_ENTITY_MAINTENANCE_WINDOWSTriggered when maintenance windows are set on a standard Entity type such as a service or daemon.
Available referencedResources keys: environment, installation, product (if applicable)
Available request fields:
| Field | Type | Description |
|---|---|---|
entity | string | Unique identifier for the Entity. |
downtimeWindows | set | Downtime maintenance windows being set. Each entry has schedule (a cron expression string), zoneId (timezone string), duration (ISO-8601 duration string), and description (string). |
noDowntimeWindows | set | No-downtime maintenance windows being set. Same structure as downtimeWindows. |
existingRevisionNumber | integer | Revision number for conflict detection. Absent when creating maintenance windows for the first time. |
REMOVE_ENTITY_MAINTENANCE_WINDOWSTriggered when maintenance windows are removed from a standard Entity type.
Available referencedResources keys: environment, installation, product (if applicable)
Available request fields:
| Field | Type | Description |
|---|---|---|
entity | string | Unique identifier for the Entity. |
CREATE_ENTITY_MAINTENANCE_WINDOW_OVERRIDETriggered when a maintenance window override is created for a standard Entity type.
Available referencedResources keys: environment, installation, product (if applicable)
Available request fields:
| Field | Type | Description |
|---|---|---|
entity | string | Unique identifier for the Entity. |
startTime | timestamp | Start time of the override window. |
endTime | timestamp | End time of the override window. |
type | string | Window type: "DOWNTIME" or "NO_DOWNTIME". |
SET_GENERIC_ENTITY_MAINTENANCE_WINDOWSTriggered when maintenance windows are set on a generic Entity type such as a network security configuration.
Available referencedResources keys: environment, installation
Available request fields:
| Field | Type | Description |
|---|---|---|
entity | string | Unique identifier for the Entity. |
downtimeWindows | set | Downtime maintenance windows being set. Each entry has schedule (a cron expression string), zoneId (timezone string), duration (ISO-8601 duration string), and description (string). |
noDowntimeWindows | set | No-downtime maintenance windows being set. Same structure as downtimeWindows. |
existingRevisionNumber | integer | Revision number for conflict detection. Absent when creating maintenance windows for the first time. |
REMOVE_GENERIC_ENTITY_MAINTENANCE_WINDOWSTriggered when maintenance windows are removed from a generic Entity type.
Available referencedResources keys: environment, installation
Available request fields:
| Field | Type | Description |
|---|---|---|
entity | string | Unique identifier for the Entity. |
CREATE_GENERIC_ENTITY_MAINTENANCE_WINDOW_OVERRIDETriggered when a maintenance window override is created for a generic Entity type.
Available referencedResources keys: environment, installation
Available request fields:
| Field | Type | Description |
|---|---|---|
entity | string | Unique identifier for the Entity. |
startTime | timestamp | Start time of the override window. |
endTime | timestamp | End time of the override window. |
type | string | Window type: "DOWNTIME" or "NO_DOWNTIME". |
UPDATE_ENVIRONMENT_SETTINGSTriggered when Environment-level settings are modified, such as the default Release Channel.
Available referencedResources keys: environment
Available request fields:
| Field | Type | Description |
|---|---|---|
deploymentId | string | The Environment ID. |
settings | map | The Environment-level operational settings after the change. Includes the default Release Channel, maintenance windows, and ownership settings, but not Entity entries. |
UPDATE_ENVIRONMENT_CONFIGTriggered when the Environment configuration file is modified.
Available referencedResources keys: environment
Available request fields:
| Field | Type | Description |
|---|---|---|
config | map | The full Environment configuration file contents after the change. |
UPDATE_EXTERNAL_DEPENDENCIESTriggered when external dependency configuration is modified.
Available referencedResources keys: environment
Available request fields:
| Field | Type | Description |
|---|---|---|
config | map | The full external dependencies configuration file contents after the change. |
UPDATE_ENVIRONMENT_PROPERTIESTriggered when Environment operational properties are modified, such as ownership, accreditation level, or operational responsibility settings.
Available referencedResources keys: environment
Available request fields:
| Field | Type | Description |
|---|---|---|
deploymentId | string | The Environment ID. |
owner | string | The owner team RID. Absent if not being changed. |
enableOperationalResponsibility | boolean | Whether operational responsibility is enabled for this Environment. |
coOwner | set | RIDs of co-owner teams. |
accreditation | string | The Environment accreditation level, such as "STANDARD" or "FEDRAMP_HIGH". |
registerToNamespaces | set | Namespace IDs the Environment is registered to. |
supportOverride | string | Support override level. Absent if not set. |
DELETE_ENVIRONMENTTriggered when an Environment is deleted.
Available referencedResources keys: environment
Available request fields:
| Field | Type | Description |
|---|---|---|
deployment | string | The Environment ID being deleted. |
namespaces | set | Namespace IDs the Environment is being unregistered from. |
EXIT_BOOTSTRAP_MODETriggered when an Environment exits bootstrap mode.
Available referencedResources keys: environment
Available request fields: None. Use referencedResources.environment to access the Environment.
MODIFY_SPACE_SETTINGSTriggered when space-level settings are modified.
Available referencedResources keys: Varies by setting; keyed by the resource being changed.
Available request fields:
| Field | Type | Description |
|---|---|---|
settingName | string | The identifier of the space setting being modified, such as "allow-upgrades". Use this to scope a policy to a specific setting. |
MODIFY_RESOURCE_OVERRIDE_SPACE_SETTINGSTriggered when resource-level overrides for space settings are modified.
Available referencedResources keys: Varies by setting; keyed by the resource being changed.
Available request fields:
| Field | Type | Description |
|---|---|---|
settingName | string | The identifier of the space setting override being modified. Use this to scope a policy to a specific setting. |
CREATE_PIPELINETriggered when a new pipeline is created.
Available referencedResources keys: pipelineRoot
Available request fields:
| Field | Type | Description |
|---|---|---|
settings | map | The pipeline settings. Sub-fields are described below. |
settings sub-fields:
| Field | Type | Description |
|---|---|---|
id | string | The pipeline name, unique within the space. |
description | string | The pipeline description. |
schedule | object | When bundles are created. Has a type field such as "never" or "cron". Schedules of type "cron" also include a cron sub-field. |
transferMechanism | string | The mechanism used to transfer bundles, such as "diode". |
connections | map | Transfer targets connected to this pipeline. Keys are transfer target IDs; values are sets of connection type strings. |
globalSelectors | object | Resource selectors specifying what is included in bundles produced by this pipeline. |
UPDATE_PIPELINETriggered when an existing pipeline's settings are modified.
Available referencedResources keys: bundlingpipeline
Available request fields:
| Field | Type | Description |
|---|---|---|
pipelineRid | string | The RID of the pipeline being updated. |
settings | map | The proposed pipeline settings after the update. Sub-fields are the same as for CREATE_PIPELINE. |
UPDATE_PIPELINE_TRANSFER_TARGETTriggered when a pipeline's transfer target connections are modified.
Available referencedResources keys: transferTarget (always); bundlingpipeline (only when an existing pipeline's connections are being updated, not when a new pipeline is being created with connections)
Available request fields: None. Transfer target details are available in referencedResources.transferTarget.
DELETE_PIPELINETriggered when a pipeline is deleted.
Available referencedResources keys: bundlingpipeline
Available request fields:
| Field | Type | Description |
|---|---|---|
pipelineRid | string | The RID of the pipeline being deleted. |
ARCHIVE_PIPELINETriggered when a pipeline is archived.
Available referencedResources keys: bundlingpipeline
Available request fields:
| Field | Type | Description |
|---|---|---|
pipelineRid | string | The RID of the pipeline being archived. |
UNARCHIVE_PIPELINETriggered when a pipeline is unarchived.
Available referencedResources keys: bundlingpipeline
Available request fields:
| Field | Type | Description |
|---|---|---|
pipelineRid | string | The RID of the pipeline being unarchived. |
CREATE_TEAMTriggered when a new team is created.
Available referencedResources keys: teamRoot
Available request fields:
| Field | Type | Description |
|---|---|---|
name | string | The immutable team slug, unique within the space. |
admins | set | Admin group locators. Each entry has name (string) and realm (string). |
members | set | Member group locators. Each entry has name (string) and realm (string). |
adminUsers | set | Admin user locators. Each entry has name (string) and realm (string). |
memberUsers | set | Member user locators. Each entry has name (string) and realm (string). |
UPDATE_TEAMTriggered when a team's membership or settings are modified.
Available referencedResources keys: team
Available request fields:
| Field | Type | Description |
|---|---|---|
teamRid | string | The RID of the team being updated. |
admins | set | Updated admin group locators. Each entry has name (string) and realm (string). |
members | set | Updated member group locators. Each entry has name (string) and realm (string). |
adminUsers | set | Updated admin user locators. Each entry has name (string) and realm (string). |
memberUsers | set | Updated member user locators. Each entry has name (string) and realm (string). |
DELETE_TEAMTriggered when a team is deleted.
Available referencedResources keys: team
Available request fields:
| Field | Type | Description |
|---|---|---|
teamRid | string | The RID of the team being deleted. |
CREATE_PRODUCT_SETTINGSTriggered when Product settings are created for a Product.
Available referencedResources keys: product
Available request fields:
| Field | Type | Description |
|---|---|---|
productId | string | The Product ID these settings are for. |
orTeam | string | The owner and operational responsibility team RID. |
operationalResponsibilityExcludedEnvironments | set | Environment IDs excluded from operational responsibility for this Product. |
UPDATE_PRODUCT_SETTINGSTriggered when existing Product settings are modified.
Available referencedResources keys: product
Available request fields:
| Field | Type | Description |
|---|---|---|
productId | string | The Product ID whose settings are being updated. |
orTeam | string | The owner and operational responsibility team RID. |
operationalResponsibilityExcludedEnvironments | set | Environment IDs excluded from operational responsibility for this Product. |
DELETE_PRODUCT_SETTINGSTriggered when Product settings are deleted.
Available referencedResources keys: product
Available request fields:
| Field | Type | Description |
|---|---|---|
product | string | The Product ID whose settings are being deleted. |
CREATE_EGRESS_POLICIESTriggered when egress policies are created.
Available referencedResources keys: egressPolicyRoot
Available request fields:
| Field | Type | Description |
|---|---|---|
data | list | The egress policies being created. Each entry has the fields described in the table below. |
Each entry in data has the following fields:
| Field | Type | Description |
|---|---|---|
address | object | The destination network address. Has a type field ("dns" or "cidr"). For DNS entries, access the hostname as address.dns (a string). For CIDR entries, access the block as address.cidr (a string). |
port | object | The port configuration. Has a port field (integer). Optionally has portRangeEnd (integer) if specifying a port range. |
transportProtocol | string | The transport protocol, such as "TLS", "TCP", or "HTTP". |
network | object | The network routing type. Has a type field such as "direct", "privateLink", "secureTunnels", "agent", "bucketEndpoint", "catalogBucket", or "bcap". |
description | string | An optional description of the policy. Absent if not provided. |
DELETE_EGRESS_POLICIESTriggered when egress policies are deleted.
Available referencedResources keys: egressPolicyRoot
Available request fields:
| Field | Type | Description |
|---|---|---|
data | set | The RIDs of the egress policies being deleted. Each entry is a string. |
CREATE_TERMINAL_ACCESS_GRANTTriggered when a terminal access grant is created.
Available referencedResources keys: environment
Available request fields:
| Field | Type | Description |
|---|---|---|
environment | string | The Environment ID for which terminal access is being requested. |
data | map | The terminal access grant details. Contents vary by grant type. |
MODIFY_VULNERABILITY_SUPPRESSIONSTriggered when vulnerability suppressions are added or modified.
Available referencedResources keys: vulnerabilitySuppression
Available request fields:
| Field | Type | Description |
|---|---|---|
spaceRid | string | The RID of the space. |
vulnerabilitySuppressions | list | CVE-based suppressions being added or modified. Each entry has the fields described below. |
scannerSuppressions | map | Suppressions keyed by scanner name. Values are lists of suppression entries (same structure as vulnerabilitySuppressions entries). |
imageNameVulnerabilitySuppressions | map | Suppressions keyed by exact image name. Values are lists of suppression entries. |
imagePrefixVulnerabilitySuppressions | map | Suppressions keyed by image name prefix. Values are lists of suppression entries. |
productIdVulnerabilitySuppressions | map | Suppressions keyed by Product ID. Values are lists of suppression entries. |
imageEndOfSupportLifeSuppressions | map | End-of-support-life suppressions keyed by image name. Values are suppression objects (same suppression structure as below, without vulnerabilitiesToSuppress). |
Each entry in vulnerabilitySuppressions (and the other suppression lists) has the following fields:
| Field | Type | Description |
|---|---|---|
suppression | object | The suppression metadata. Has rationale (string), category (string), and validUntil (timestamp). |
vulnerabilitiesToSuppress | set | CVE IDs covered by this suppression entry. Each entry is a string such as "CVE-2021-44228". |
REMOVE_VULNERABILITY_SUPPRESSIONSTriggered when vulnerability suppressions are removed.
Available referencedResources keys: vulnerabilitySuppression
Available request fields:
| Field | Type | Description |
|---|---|---|
spaceRid | string | The RID of the space. |
vulnerabilitySuppressions | set | CVE IDs being removed. Each entry is a string such as "CVE-2021-44228". |
scannerSuppressions | map | Scanner suppressions being removed. Keys are scanner names; values are sets of CVE ID strings. |
imageNameVulnerabilitySuppressions | map | Image name suppressions being removed. Keys are image names; values are sets of CVE ID strings. |
imagePrefixVulnerabilitySuppressions | map | Image prefix suppressions being removed. Keys are image name prefixes; values are sets of CVE ID strings. |
productIdVulnerabilitySuppressions | map | Product suppressions being removed. Keys are Product IDs; values are sets of CVE ID strings. |
imageEndOfSupportLifeSuppressions | set | Image names whose end-of-support-life suppressions are being removed. |
CREATE_MANAGEMENT_OVERRIDETriggered when a management override is created.
Available referencedResources keys: None
Available request fields:
| Field | Type | Description |
|---|---|---|
name | string | The unique management override identifier. |
owner | string | The RID of the team that will own this override. |
products | set | Product IDs covered by this override. |
services | set | Service locators covered by this override. Each entry has stack (string) and serviceName (string). |
UPDATE_MANAGEMENT_OVERRIDETriggered when a management override is modified.
Available referencedResources keys: None
Available request fields:
| Field | Type | Description |
|---|---|---|
name | string | The management override identifier being updated. |
owner | string | The RID of the team that owns this override. |
products | set | Updated product IDs covered by this override. |
services | set | Updated service locators covered by this override. Each entry has stack (string) and serviceName (string). |
DELETE_MANAGEMENT_OVERRIDETriggered when a management override is deleted.
Available referencedResources keys: None
Available request fields:
| Field | Type | Description |
|---|---|---|
name | string | The management override identifier being deleted. |