Available
Public API v1
Public read and discovery.
/api/v1PolicyWatcher
Loading verified public evidence
The page will appear when its current evidence state is available.
Enterprise integration surface
Integrations
Integrations use published evidence records through APIs, connectors and package surfaces. Microsoft, Google, AWS and Office implementations share the publication gate and data boundary. Scraped portal HTML is excluded.
Integration data flow
The central contract is the control point. Status labels describe delivery state in text and color.
AvailablePilot readyPlannedCommercial later
Pilot ready
Enterprise API + APIM
Tenant-authenticated system access.
/api/v2Pilot ready
Power Platform
Composable workflow automation.
6 read actionsAvailable
Agent Evidence Gateway
One flattened public contract.
3 read operations PolicyWatcher core
Publication GateOnly reviewed, public evidence passes
Tenant BoundaryVerified Entra identity for v2
Evidence contract
OpenAPI 3.0.3Planned
Teams and M365
Dedicated collaboration experience.
SSO tab + cardsSource ready
Copilot · Vertex AI · Amazon Quick
Tenant-hosted agent packages.
one OpenAPI contractSource ready
Word task pane
Local clause classification.
derived topics onlyCommercial later
Marketplace
Procurement, plans, and lifecycle.
SaaS offerIntegration selection
- 01Public read and discovery
- Public API v1Available
- 02Aggregate operational readiness
- Publication Readiness APIAvailable
- 03Portable multi-change evidence
- Evidence CollectionsAvailable
- 04Review-system handoff
- Vendor-neutral handoff manifestAvailable
- 05Change automation polling
- Public change event feedAvailable
- 06Polling continuity rehearsal
- Event Feed Continuity LabAvailable
- 07Receiver signature testing
- Webhook Readiness KitAvailable
- 08Operator-controlled push
- Configured Webhook DeliveryPilot ready
- 09Tenant-authenticated system access
- Enterprise API v2Pilot ready
- 10Workflow automation
- Power Platform connectorPilot ready
- 11Cross-cloud agent evidence
- Agent Evidence GatewayAvailable
- 12Tenant conversation
- Copilot, Vertex AI and Amazon Quick packagesSource ready
- 13Clause evidence review
- PolicyWatcher for WordSource ready
- 14In-workflow collaboration
- Teams cards and tabPlanned
- 15Federated tool access
- MCPPlanned
- 16Procurement and billing
- Microsoft MarketplaceCommercial later
Integration catalog
Each entry names its audience, role, boundary, and concrete route or artifact.
Available
Public, bounded surfaces in the current product.
Agent Evidence Gateway
Inspect agent contract- Audience
- Microsoft 365 Copilot, Vertex AI Agent Builder and Amazon Quick pilots
- Role
- Returns deterministic, source-linked public change and Observatory briefs through one OpenAPI 3.0 contract.
- Boundary
- Anonymous, read-only public evidence only. No confidential prompts, tenant data, raw policy text or model-generated verdicts.
/api/v1/agent/openapi.jsonPublic API v1
Developer directory- Audience
- Developers, researchers, public-interest tools
- Role
- Anonymous discovery of the integration manifest, curated Observatory registry, publication readiness and portable evidence bundles.
- Boundary
- Read-only public metadata, publication-aware gates and bounded rate policies. Publication readiness is database-derived and no-store.
/api/v1/manifest | /api/v1/publication-readiness | /schemas/publication-readiness/v1Public evidence surfaces
Release feeds- Audience
- Browsers, newsroom tools, downstream readers
- Role
- Human-readable evidence views plus JSON and RSS release feeds.
- Boundary
- Only already-public records and release metadata. No private retrieval state.
/change/{id} | /press-kit/feed.jsonShareable evidence collections
Open collections- Audience
- Researchers, editors, governance reviewers, developers
- Role
- Selects up to 12 exact public changes and exports deterministic evidence bundles or a vendor-neutral review handoff.
- Boundary
- Only canonical public evidence leaves the browser. Local title, review states, assignees and due dates are excluded.
/collections | /api/v1/evidence-collectionsCollaboration handoff manifest
Build a handoff- Audience
- GRC, ticketing and collaboration workflow owners
- Role
- Provides deterministic work-item titles, acceptance criteria, evidence links and digests for authorized human import.
- Boundary
- Creates no third-party record, assignment, deadline, notification or delivery confirmation.
/api/v1/evidence-collections?changes={ids}&format=handoffPublic change event feed
Open event feed- Audience
- Automation owners, researchers and integration developers
- Role
- Polls already-published change events through stable event IDs and a forward-only opaque cursor.
- Boundary
- No subscription, push delivery, recipient data, delivery receipt or signed webhook claim.
/api/v1/change-events?limit=25&lang=enEvent Feed Continuity Lab
Open continuity workbench- Audience
- Polling consumer developers and integration reviewers
- Role
- Inspects bounded event windows, stores a strict browser-local checkpoint and explicitly resumes from its opaque cursor.
- Boundary
- No hosted consumer, exhaustive-monitoring claim, server-side replay store, delivery receipt or push delivery.
/developers/event-continuity | /schemas/event-continuity-checkpoint/v1Webhook Readiness Kit
Open verification workbench- Audience
- Integration developers and security reviewers
- Role
- Tests the candidate HMAC-SHA256 receiver contract locally with one editable vector and eight deterministic positive and negative fixtures.
- Boundary
- No endpoint registration, subscriptions, production secrets, push delivery, retries or delivery confirmation.
/developers/webhook-readiness | /api/v1/webhook-verification-kit | /api/v1/webhook-conformance-suiteBrowser extension
Browser extension- Audience
- Reviewers working from a provider policy page
- Role
- Moves a page-level review into the existing PolicyWatcher evidence workflow.
- Boundary
- The extension does not turn third-party page content into an enterprise API response.
/browser-extensionEmbeddable change card
- Audience
- Publishers and evidence-aware websites
- Role
- Frames one public change card through a purpose-built embed route.
- Boundary
- The main portal stays frame-protected. Only the dedicated card route is embeddable.
/embed/change/{id}Pilot ready
Implemented in source; tenant activation still requires configuration.
Enterprise API v2
Inspect OpenAPI- Audience
- Enterprise applications, IT and identity administrators
- Role
- Tenant-bound access to companies, changes, continuity, and governance signals.
- Boundary
- Verified Entra tenant, delegated scope or app role, private no-store responses.
/api/v2/openapi.jsonAzure API Management edge
- Audience
- Platform engineering and API operations
- Role
- Gateway policy for token validation, request correlation, and controlled origin access.
- Boundary
- APIM does not replace origin authorization. The origin verifies the Entra token again.
docs/azure/apim-policy.xmlPower Platform connector
- Audience
- Power Automate, Power Apps, Logic Apps, Copilot Studio
- Role
- Six read actions over the same v2 evidence contract, ready for a test tenant pilot.
- Boundary
- Two Entra applications and environment configuration are required before import.
integrations/power-platform/policywatcher-v2Microsoft 365 Copilot evidence agent
- Audience
- Licensed Microsoft 365 Copilot users and tenant administrators
- Role
- Declarative agent 1.8 and API plugin 2.4 package for cited public evidence dialogue inside the customer tenant.
- Boundary
- Source package only: not AppSource-published, tenant-enabled or certified. Private access remains on Entra-authenticated API v2.
integrations/microsoft-copilot/policywatcher-evidence-agentVertex AI Agent Builder tool
- Audience
- Google Cloud agent builders and project administrators
- Role
- OpenAPI tool and tool-first playbook instructions for the same deterministic public evidence contract.
- Boundary
- Source package only: not deployed into a customer Google Cloud project and no PolicyWatcher dataset is copied by the package.
integrations/google-agent-builder/policywatcher-evidence-toolAmazon Quick OpenAPI connector
- Audience
- AWS account owners and Amazon Quick authors
- Role
- Three-operation OpenAPI connector constrained to one JSON endpoint contract and flattened responses.
- Boundary
- Source package only: not deployed or shared in an AWS account. Amazon Q Business remains a legacy path for existing customers only.
integrations/amazon-quick/policywatcher-evidence-connectorPolicyWatcher Contract Evidence Review for Word
Preview task pane- Audience
- Legal, procurement and GRC reviewers working in Word
- Role
- Classifies an explicitly selected clause locally and searches public evidence with controlled topic labels only.
- Boundary
- Selected clause text is not sent or stored. The add-in maps evidence; it does not verify, approve or legally assess a contract.
/office-addin/contract-review | integrations/office-wordConfigured webhook delivery
- Audience
- Integration and security operations teams
- Role
- Sends eligible public change events to deployment-configured HTTPS destinations through a signed persistent outbox.
- Boundary
- No public registration, tenant self-service, endpoint challenge, automatic key rotation, guaranteed delivery or SLA.
/admin/webhook-delivery | policy.change.publishedPlanned
Architected next paths; not delivered or enabled today.
Self-service webhook lifecycle
- Audience
- Tenant administrators and integration owners
- Role
- Tenant-managed endpoint registration, challenge verification, secret rotation and delivery-health controls.
- Boundary
- The configured pilot does not establish tenant identity, self-service provisioning or a delivery commitment.
Future tenant delivery control planeTeams and Microsoft 365
- Audience
- Legal, GRC, procurement, and business owners
- Role
- Dedicated SSO tab, Adaptive Cards, and evidence deep links inside collaboration flows.
- Boundary
- Requires a purpose-built route. The whole portal is not iframe-ready.
Dedicated M365 surface, not portal HTML fetchingFederated MCP connector
- Audience
- Copilot administrators and knowledge architects
- Role
- Real-time search and fetch from PolicyWatcher without copying records into an index.
- Boundary
- Authenticated read tools, tenant controls, and source-of-truth links are required.
search | fetch | query toolsSynchronized Copilot connector
- Audience
- Organizations requiring Microsoft 365 indexed discovery
- Role
- Optional external content indexing for tenant search and Copilot grounding.
- Boundary
- Needs ACLs, delete propagation, retention review, and stale-record controls.
Optional path after governance reviewCommercial later
Distribution and lifecycle work after the enterprise foundation.
Microsoft Marketplace SaaS
- Audience
- Enterprise procurement and cloud marketplace buyers
- Role
- Discovery, commercial plans, purchasing, and access to the PolicyWatcher service.
- Boundary
- A Marketplace offer distributes the SaaS. It does not embed the portal as the product.
Listing first | transactable offer laterProvisioning and entitlements
- Audience
- Tenant owners, billing, and customer success
- Role
- Subscription activation, plan mapping, lifecycle events, and tenant entitlement checks.
- Boundary
- Requires a production tenant model, support process, audit history, and lifecycle webhooks.
Fulfillment API + subscription lifecycleAPI access comparison
The agent gateway supports cited public dialogue across clouds. v2 remains the authenticated foundation for private enterprise workflows.
| Dimension | Public API v1 | Enterprise API v2 |
|---|---|---|
| Access | Public internet | Allowlisted Entra tenant |
| Audience | Public developers and researchers | Enterprise apps, users, and automation |
| Use case | Discovery and curated registry reads | Evidence, continuity, and governance workflows |
| Authentication | None, anonymous read-only | policywatcher.read or PolicyWatcher.Read.All |
| Data boundary | Public metadata and curated references | Evidence-gated records with verified tenant context |
| Contract | /api/v1/manifest | /api/v2/openapi.json |
| Readiness | Available | Pilot ready |
Private Microsoft tenant pilot
API v2 pilot checklist
The pilot uses identifiers and controlled configuration. A client secret belongs in a protected secret store and must never be pasted into a document, issue, chat, or generated artifact.
Open machine-readable contract- 01Register the protected API
Create the PolicyWatcher Enterprise API app, expose policywatcher.read, and define PolicyWatcher.Read.All.
- 02Register the connector client
Create a separate Power Platform connector app and grant the delegated API permission.
- 03Allowlist the test tenant
Configure the pilot tenant ID and API audiences on the PolicyWatcher origin.
- 04Choose the API front door
Use the public HTTPS origin for a controlled smoke test, or the preferred APIM URL.
- 05Identify the Power Platform environment
Use the test Environment ID to keep the connector and flows isolated.
- 06Import and connect
Generate the source-controlled connector package, import it, and complete interactive consent.
- 07Prove rejection paths
Test wrong tenant, wrong audience, missing scope or role, and direct-origin rejection once APIM is enforced.
Security and data boundary
Data shared with integrations
API consumers receive structured records that have passed the publication controls used by public evidence views. PolicyWatcher portal HTML remains outside the API contract.
Provider source
Publication Gate
Bounded record
Never returned to API consumers
- Raw policy text
- Raw snapshot text or non-public fingerprints
- Private retrieval diagnostics
- Credentials
- Administrator logs
Next entry point
Related integration resources
Inspect the public agent contract, validate a source package in an isolated tenant or cloud project, or use v2 for authenticated enterprise workflows.