Load Prebuilt Policy

Load a prebuilt policy pack with ready-made compliance rules for AML, GDPR, or SOC2

POST /api/policies/prebuilt

Load Prebuilt Policy

cURL

curl --request POST \
  --url https://api.example.com/api/policies/prebuilt \
  --header 'Content-Type: application/json' \
  --data '{
  "type": {}
}'

200

{
  "policy": {
    "id": "<string>",
    "name": "<string>",
    "type": "<string>",
    "prebuilt_type": "<string>",
    "rules_count": 123,
    "rules": [
      {
        "rule_id": "<string>",
        "name": "<string>",
        "type": "<string>",
        "description": "<string>",
        "severity": {},
        "threshold": {},
        "time_window": {},
        "conditions": {},
        "policy_excerpt": "<string>",
        "policy_section": "<string>"
      }
    ],
    "created_at": "<string>"
  },
  "error": "<string>",
  "message": "<string>",
  "details": [
    {}
  ]
}

Overview

This endpoint creates a new policy using prebuilt rule sets for common compliance frameworks. Choose from Anti-Money Laundering (AML), GDPR data protection, or SOC2 security controls.

Authentication

Requires a valid session token. Returns 401 UNAUTHORIZED if not authenticated.

Request

type · enum · required

Policy pack type to load.

Options:

• aml - Anti-Money Laundering compliance rules
• gdpr - GDPR data protection and privacy rules
• soc2 - SOC2 security and operational controls

Content Type

application/json

Example Request

curl -X POST https://yourdomain.com/api/policies/prebuilt \
  -H "Content-Type: application/json" \
  -H "Cookie: session=your_session_token" \
  -d '{
    "type": "aml"
  }'

Response

policy · object

The created policy with prebuilt rules

id · string

UUID of the created policy

name · string

Policy name (e.g., “AML Compliance Policy”)

type · string

Always prebuilt for prebuilt policies

prebuilt_type · string

The selected prebuilt type: aml, gdpr, or soc2

rules_count · number

Total number of rules in the policy

rules · array

Array of prebuilt compliance rules

rule_id · string

Unique rule identifier in UPPER_SNAKE_CASE

name · string

Human-readable rule name

type · string

Rule category (e.g., structuring, velocity, encryption)

description · string

Detailed description of the rule

severity · enum

Rule severity: CRITICAL, HIGH, or MEDIUM

threshold · number | null

Numeric threshold for threshold-based rules

time_window · number | null

Time window in hours for temporal rules

conditions · object

Rule evaluation logic with recursive AND/OR conditions

policy_excerpt · string

Reference to the compliance regulation

policy_section · string

Section reference (e.g., “31 CFR § 1010.314”)

created_at · string

ISO 8601 timestamp of policy creation

Success Response

{
  "policy": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "name": "AML Compliance Policy",
    "type": "prebuilt",
    "prebuilt_type": "aml",
    "rules_count": 12,
    "rules": [
      {
        "rule_id": "STRUCTURING_PATTERN",
        "name": "Transaction Structuring Detection",
        "type": "structuring",
        "description": "Detects multiple transactions just below reporting threshold",
        "severity": "CRITICAL",
        "threshold": 10000,
        "time_window": 24,
        "conditions": {
          "AND": [
            {
              "field": "amount",
              "operator": "greater_than",
              "value": 9000
            },
            {
              "field": "amount",
              "operator": "less_than",
              "value": 10000
            }
          ]
        },
        "policy_excerpt": "31 CFR § 1010.314 - Structured transactions to evade BSA reporting",
        "policy_section": "31 CFR § 1010.314"
      }
    ],
    "created_at": "2026-02-28T10:30:00Z"
  }
}

Error Responses

error · string

Error code identifier

message · string

Human-readable error message

details · array

Validation error details (for VALIDATION_ERROR)

400 Bad Request

{
  "error": "VALIDATION_ERROR",
  "message": "Invalid request body",
  "details": [
    {
      "code": "invalid_enum_value",
      "expected": ["aml", "gdpr", "soc2"],
      "received": "hipaa",
      "path": ["type"],
      "message": "Invalid enum value. Expected 'aml' | 'gdpr' | 'soc2', received 'hipaa'"
    }
  ]
}

401 Unauthorized

{
  "error": "UNAUTHORIZED",
  "message": "Authentication required"
}

500 Internal Server Error

{
  "error": "INTERNAL_ERROR",
  "message": "Failed to create policy"
}

{
  "error": "INTERNAL_ERROR",
  "message": "Failed to insert rules"
}

Prebuilt Policy Types

AML (Anti-Money Laundering)

Includes rules for:

• Transaction structuring detection
• Rapid fund movement patterns
• High-risk jurisdiction monitoring
• Unusual transaction patterns
• Smurfing detection

GDPR (General Data Protection Regulation)

Includes rules for:

• Data retention limits
• Consent verification
• Right to erasure compliance
• Cross-border data transfer restrictions
• Encryption requirements

SOC2 (Service Organization Control 2)

Includes rules for:

• Access control violations
• Multi-factor authentication enforcement
• Encryption at rest and in transit
• Audit logging requirements
• Password policy compliance

Notes

• All rules are set to is_active: true by default
• Rules can be toggled or modified after creation using the rules management endpoints
• The policy type field is set to prebuilt to distinguish from PDF-ingested policies
• The prebuilt_type field stores the original pack type for reference