> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # Read the auto-remediation policy > The bearer-token twin of the browser read, authorised the same way it is: any authenticated member of the organisation, with no named permission, because the portal already shows this document to every member. The PUT that writes the policy stays a browser session + CSRF + organisation-admin lane and has no token twin. An organisation that never configured a policy reads the disabled default document (enabled false, autonomy_level 'propose', updated_at null) rather than a 404. ## OpenAPI ````yaml https://platform.ankra.app/openapi.json get /api/v1/org/ai-remediation/policy openapi: 3.1.0 info: title: FastAPI version: 0.1.0 servers: - url: https://platform.ankra.app security: [] tags: - name: Clusters description: Create, inspect and manage clusters, and the stacks deployed on them. - name: Managed Clusters description: Provider-managed control planes, driven through one common surface. - name: Imported Clusters description: Clusters that already existed and were connected to Ankra. - name: Cluster Access description: Kubeconfigs, service-account tokens and per-cluster access grants. - name: Kubernetes description: Read and act on the Kubernetes objects inside a cluster. - name: AWS Clusters description: >- Provision and manage self-managed k3s / kubeadm clusters on AWS EC2 in your own VPC. - name: DigitalOcean Clusters description: Provision and manage DigitalOcean Kubernetes clusters. - name: Hetzner Clusters description: Provision and manage Hetzner Kubernetes clusters. - name: OVH Clusters description: Provision and manage OVH Kubernetes clusters. - name: Scaleway Clusters description: Provision and manage Scaleway Kapsule clusters. - name: UpCloud Clusters description: Provision and manage UpCloud Kubernetes clusters. - name: Applications description: Deploy, configure and observe applications across the fleet. - name: Stack Profiles description: Reusable stack definitions, their versions and sharing. - name: Services description: >- Versioned service packages and explicit sharing. Runtime admission is separate from publication. - name: Charts description: Browse the chart catalogue behind stacks and addons. - name: Helm description: Helm registries, credentials and the charts they expose. - name: Executions description: Long-running platform executions and their jobs. - name: Operations description: Cancel in-flight cluster operations and their jobs. - name: Chat description: Conversational sessions, plans and confirmable actions. - name: AI Agent Runs description: Autonomous agent runs and their outcomes. - name: AI Tickets description: The AI ticket board, its sync connections and settings. - name: AI Playbooks description: Reusable playbooks the AI lanes execute. - name: AI Conditions description: Conditions that gate AI autonomy. - name: AI Remediation description: >- The organisation's auto-remediation policy: what the AI lanes may fix by themselves, and who approves the rest. - name: AI Engineering Handoffs description: Work the AI lanes escalate to a human engineer. - name: AI Environment description: The environment and base stacks AI demos deploy into. - name: Security description: Findings, advisories, SBOMs, compliance and posture. - name: Cost description: Cluster and fleet cost, rate cards and cost settings. - name: Billing description: Subscription and spend caps. - name: Organisation description: Members, invitations, audit logs and organisation settings. - name: Account Tokens description: Personal access tokens for the API and CLI. - name: Credentials description: The shared credential store. - name: AWS Credentials description: >- AWS credentials: access keys or CloudFormation-onboarded STS roles for cost, EKS and self-managed provisioning. - name: Azure Credentials description: Azure credentials and SSH keys. - name: DigitalOcean Credentials description: DigitalOcean credentials and SSH keys. - name: Hetzner Credentials description: Hetzner credentials and SSH keys. - name: OVH Credentials description: OVH credentials and SSH keys. - name: Scaleway Credentials description: Scaleway credentials. - name: UpCloud Credentials description: UpCloud credentials and SSH keys. - name: Data Source Credentials description: Credentials for metrics and log sources. - name: DNS Credentials description: Credentials for DNS providers. - name: Object Storage Buckets description: >- Buckets Ankra creates and manages on an organisation's own provider credentials. - name: DNS description: DNS zones and records, including custom organisation zones. - name: Cloudflare description: Cloudflare domains and the credentials behind them. - name: Variables description: Organisation- and cluster-scoped variables. - name: SOPS description: Encrypt and decrypt values with the organisation SOPS config. - name: Alerts description: Alert integrations and ingest credentials. - name: Notifications description: Notification routes and their delivery targets. - name: Support description: Support tickets. - name: AI Settings description: Organisation AI provider, model catalog and per-function model settings paths: /api/v1/org/ai-remediation/policy: get: tags: - AI Remediation summary: Read the auto-remediation policy description: >- The bearer-token twin of the browser read, authorised the same way it is: any authenticated member of the organisation, with no named permission, because the portal already shows this document to every member. The PUT that writes the policy stays a browser session + CSRF + organisation-admin lane and has no token twin. An organisation that never configured a policy reads the disabled default document (enabled false, autonomy_level 'propose', updated_at null) rather than a 404. operationId: getRemediationPolicyToken responses: '200': description: The policy document, stored or defaulted. content: application/json: schema: $ref: '#/components/schemas/AiRemediationPolicy' '400': description: >- Missing or malformed bearer authentication, or an unparseable X-Ankra-Organisation-Id. '401': description: Unknown, expired or revoked token. '403': description: >- X-Ankra-Organisation-Id names an organisation the token's user is not a member of. '500': description: Internal error. No database details are returned. security: - BearerAuth: [] components: schemas: AiRemediationPolicy: type: object description: >- The organisation's auto-remediation policy: whether Ankra may act on an incident by itself, how far, which tools are overridden, who may approve and which clusters are in scope. An organisation that never configured one reads the disabled default document rather than a 404, so `updated_at` is the only field that tells "nobody has configured this" apart from "somebody configured it this way": the column is NOT NULL, so a null one means there is no policy row at all. properties: enabled: type: boolean title: Enabled description: >- false leaves auto-remediation switched off entirely, whatever the rest of the document says. autonomy_level: type: string enum: - read_only - propose - auto title: Autonomy Level description: >- read_only observes, propose asks an approver first, auto acts unattended. tier_overrides: type: object additionalProperties: type: string enum: - auto - approval - never title: Tier Overrides description: >- Per-tool overrides of the autonomy level, keyed by tool name. A tool absent here follows autonomy_level. slack_webhook_id: anyOf: - type: string format: uuid - type: 'null' title: Slack Webhook Id description: >- The Slack integration that carries the approve/deny cards; null means approvals are portal-only. approver_user_ids: items: type: string format: uuid type: array title: Approver User Ids description: >- The members who may decide a pending action. Empty means every organisation admin may. max_actions_per_incident: type: integer title: Max Actions Per Incident cooldown_minutes: type: integer title: Cooldown Minutes cluster_allow_list: anyOf: - items: type: string format: uuid type: array - type: 'null' title: Cluster Allow List description: >- Absent (null) and empty are opposite states, not degrees of the same one: null admits every cluster, an empty list admits none. updated_at: anyOf: - type: string format: date-time - type: 'null' title: Updated At description: >- null exactly when no policy row exists, so this is what "is auto-remediation configured at all?" is keyed off. required: - enabled - autonomy_level - tier_overrides - slack_webhook_id - approver_user_ids - max_actions_per_incident - cooldown_minutes - cluster_allow_list - updated_at title: AiRemediationPolicy securitySchemes: BearerAuth: bearerFormat: PAT scheme: bearer type: http ````