OOTB policies API reference

Out-of-the-box (OOTB) policies are pre-built policies included in the HCP Terraform policy catalog. They cover common compliance and governance use cases across major cloud providers and services. Each OOTB policy has a fixed external ID (prefixed ootbpol-) and can be referenced when constructing policy sets.

This API provides an endpoint to retrieve details about a specific OOTB policy by its external ID.

Show an OOTB policy

GET /ootb-policies/:external_id

Parameter	Description
`:external_id`	The external ID of the OOTB policy (prefix `ootbpol-`).

Query Parameters

Parameter	Description
`organization_name`	Required. The name of the organization making the request.
`include`	Optional. The library that contains the policy. `ootb-policy-libraries` is the only supported value at the moment.

Status	Response	Reason
200	JSON API document (`type: "ootb-policies"`)	The request was successful
404	JSON API error object	Policy not found, or user unauthorized to perform action

Sample Request

curl --request GET \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/vnd.api+json" \
  "https://app.terraform.io/api/v2/ootb-policies/ootbpol-xxxxxxxxxxxxxxxx?organization_name=my-organization&include=ootb-policy-libraries"

Sample Response

{
  "data": {
    "id": "ootbpol-xxxxxxxxxxxxxxxx",
    "type": "ootb-policies",
    "attributes": {
      "name": "s3-bucket-versioning-enabled",
      "description": "Ensures that S3 buckets have versioning enabled.",
      "kind": "sentinel",
      "provider": "aws",
      "service": "s3",
      "slug": "s3-bucket-versioning-enabled",
      "governed-resources": [
        "aws_s3_bucket"
      ],
      "control-source": "https://github.com/hashicorp/policy-library-aws-s3-terraform"
    },
    "relationships": {
      "ootb-policy-libraries": {
        "data": [
          {
            "type": "ootb-policy-libraries",
            "id": "aws-s3"
          }
        ]
      }
    },
    "links": {
      "download": "https://app.terraform.io/api/v2/ootb-policies/ootbpol-xxxxxxxxxxxxxxxx/download"
    }
  }
}

Attributes

Attribute	Type	Nullable	Description
`name`	string	No	The name of the policy.
`description`	string	Yes	Human-readable description of the policy's purpose.
`kind`	string	No	The policy engine type. Valid values: `sentinel`, `tfpolicy`.
`provider`	string	No	Cloud provider the policy targets, returned lower-cased (e.g. `aws`, `azure`, `gcp`).
`service`	string	No	Cloud service the policy targets (e.g. `s3`, `iam`, `compute`).
`slug`	string	No	URL-friendly unique identifier for the policy.
`governed-resources`	array[string]	No	Array of Terraform resource types this policy governs (e.g. `["aws_s3_bucket"]`).
`control-source`	string	Yes	Source location (documentation or repository URL) for this policy, taken from the latest version's library policy. `null` when no active library release is available.

Relationships

Relationship	Description
`ootb-policy-libraries`	Libraries this policy belongs to. Each item contains a `type` of `ootb-policy-libraries` and an `id` equal to the library's slug.

Links

Link	Description
`download`	URL to download the latest available policy source. The link is always present.

Error responses

Error responses follow the JSON API error object format and use the standard HTTP status codes described in the HCP Terraform API documentation.

{
  "errors": [
    {
      "status": "404",
      "title": "Not Found",
      "detail": "Resource not found"
    }
  ]
}