ai-gov: vendor api (#26240)

## Description Vendored changes to AI Governance OpenAPI spec, which adds L7 HTTP rules. Once the associated PR merges, sync again. https://deploy-preview-26240--docsdocker.netlify.app/reference/api/ai-governance/latest/ ## Related issues or tickets https://github.com/docker/governor-services/pull/836 ## Reviews   - [ ] Technical review - [ ] Editorial review - [ ] Product review Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
2026-11-04 10:01:00 +00:00 · 2026-10-02 09:40:15 -07:00
1 parent 318ea7ce22
commit 1cb9a4d2c6
@@ -358,7 +358,9 @@ paths:
      summary: Create rule
      description: |
        Adds a rule to the policy's rule set. All rules in a policy must share
-        the same domain (network or filesystem); mixing domains is rejected.
+        the same domain (`network`, which includes HTTP, or `filesystem`);
+        mixing domains is rejected. A single rule cannot mix L4 network and L7
+        HTTP actions.

        **Network** actions: `connect:tcp`, `connect:udp`. Resources are
        hostnames (for example, `example.com`), wildcard subdomains (`*.example.com`
@@ -370,9 +372,13 @@ paths:
        `/data`). Use `*` to match within a single path segment and `**` to match
        recursively across segments (for example, `/data/**`).

+        **HTTP** actions identify request methods, such as `request:get` and
+        `request:post`. Use `http_resources` to identify the host, optional port,
+        and absolute path glob. HTTP rules must not supply `resources`.
+
        Changes may take up to five minutes to reach developer machines.
      requestBody:
-        description: Rule definition including actions, resources, and decision.
+        description: Rule definition including actions, matching resources, and decision.
        required: true
        content:
          application/json:
@@ -393,6 +399,16 @@ paths:
                  actions: [read, write]
                  resources: [/data]
                  decision: allow
+              http:
+                summary: HTTP rule
+                value:
+                  name: read GitHub repositories
+                  actions: [request:get, request:head]
+                  http_resources:
+                    - host: api.github.com
+                      port: 443
+                      path: /repos/docker/**
+                  decision: allow
      responses:
        "201":
          description: Rule created and added to the policy's rule set.
@@ -417,6 +433,17 @@ paths:
                    actions: [read, write]
                    resources: [/data]
                    decision: allow
+                http:
+                  summary: HTTP rule
+                  value:
+                    id: rule_08gxuos1lo3rfum2c0pmgcz09lpc
+                    name: read GitHub repositories
+                    actions: [request:get, request:head]
+                    http_resources:
+                      - host: api.github.com
+                        port: 443
+                        path: /repos/docker/**
+                    decision: allow
        "400":
          $ref: "#/components/responses/InvalidArgument"
        "401":
@@ -445,8 +472,10 @@ paths:
        old and new states.

        Changing `actions` across domains (for example, from network actions to
-        filesystem actions) is rejected. Changes may take up to five minutes to
-        reach developer machines.
+        filesystem actions) is rejected while other rules remain in the policy.
+        When changing a rule between L4 network and L7 HTTP, supply the matching
+        `resources` or `http_resources` in the same request. Changes may take up
+        to five minutes to reach developer machines.
      requestBody:
        description: Fields to update. Absent fields are left unchanged.
        required: true
@@ -620,8 +649,8 @@ components:
        type:
          type: string
          description: >
-            Identifies the policy type. `allowlist_v0` for network/filesystem
-            allowlist policies; `cedar_v1` for Cedar language policies.
+            Identifies the policy type. `allowlist_v0` for network, HTTP, and
+            filesystem allowlist policies; `cedar_v1` for Cedar language policies.
          enum: [allowlist_v0, cedar_v1]
          examples:
            - allowlist_v0
@@ -678,7 +707,7 @@ components:
    AllowlistV0:
      type: object
      description: |
-        Network or filesystem allowlist containing a list of rules. Present on
+        Network, HTTP, or filesystem allowlist containing a list of rules. Present on
        Policy when `PolicySummary.type` is `allowlist_v0`; omitted when the
        policy has no rules yet. All rules in an allowlist share the same domain.
        All rules are evaluated on every request: `deny` always wins over `allow`.
@@ -730,7 +759,12 @@ components:
    Rule:
      type: object
      description: A single allow or deny rule within an allowlist policy.
-      required: [id, name, actions, resources, decision]
+      required: [id, name, actions, decision]
+      oneOf:
+        - type: object
+          required: [resources]
+        - type: object
+          required: [http_resources]
      properties:
        id:
          type: string
@@ -745,6 +779,8 @@ components:
          $ref: "#/components/schemas/RuleActions"
        resources:
          $ref: "#/components/schemas/RuleResources"
+        http_resources:
+          $ref: "#/components/schemas/HTTPResources"
        decision:
          $ref: "#/components/schemas/RuleDecision"

@@ -770,7 +806,12 @@ components:
    CreateRuleRequest:
      type: object
      description: Fields required to create a new rule within a policy's rule set.
-      required: [name, actions, resources, decision]
+      required: [name, actions, decision]
+      oneOf:
+        - type: object
+          required: [resources]
+        - type: object
+          required: [http_resources]
      properties:
        name:
          type: string
@@ -781,12 +822,17 @@ components:
          $ref: "#/components/schemas/RuleActions"
        resources:
          $ref: "#/components/schemas/RuleResources"
+        http_resources:
+          $ref: "#/components/schemas/HTTPResources"
        decision:
          $ref: "#/components/schemas/RuleDecision"

    UpdateRuleRequest:
      type: object
      description: Partial update. Only fields present in the body are updated; absent fields are left unchanged.
+      not:
+        type: object
+        required: [resources, http_resources]
      properties:
        name:
          type: string
@@ -797,6 +843,8 @@ components:
          $ref: "#/components/schemas/RuleActions"
        resources:
          $ref: "#/components/schemas/RuleResources"
+        http_resources:
+          $ref: "#/components/schemas/HTTPResources"
        decision:
          $ref: "#/components/schemas/RuleDecision"

@@ -873,13 +921,29 @@ components:
      type: array
      items:
        type: string
-        enum: [connect:tcp, connect:udp, read, write]
+        enum:
+          - connect:tcp
+          - connect:udp
+          - read
+          - write
+          - request:get
+          - request:post
+          - request:put
+          - request:delete
+          - request:patch
+          - request:head
+          - request:options
+          - request:connect
+          - request:trace
      minItems: 1
      description: >
        Network actions: `connect:tcp`, `connect:udp`.
        Filesystem actions: `read`, `write`.
-        All actions in a rule must belong to the same domain; mixing network
-        and filesystem actions in one rule is rejected.
+        HTTP actions: `request:get`, `request:post`, `request:put`,
+        `request:delete`, `request:patch`, `request:head`, `request:options`,
+        `request:connect`, `request:trace`.
+        All actions in a rule must belong to the same layer; mixing HTTP,
+        network, or filesystem actions in one rule is rejected.
      examples:
        - ["connect:tcp", "connect:udp"]

@@ -895,9 +959,48 @@ components:
        (for example, `10.0.0.0/8` or `2001:db8::/32`). Filesystem domain:
        paths (for example, `/data`); `*` matches within one path segment,
        `**` matches recursively (for example, `/data/**`).
+        Required for network and filesystem rules and forbidden for HTTP rules.
      examples:
        - ["research.mitre.org", "cve.mitre.org"]

+    HTTPResources:
+      type: array
+      minItems: 1
+      items:
+        $ref: "#/components/schemas/HTTPResource"
+      description: >
+        HTTP request targets. Required for HTTP rules and forbidden for network
+        and filesystem rules. A request matches when any target matches.
+
+    HTTPResource:
+      type: object
+      required: [host, path]
+      properties:
+        host:
+          type: string
+          minLength: 1
+          description: >
+            Domain name or domain glob without a URL scheme or port. Use the
+            separate `port` field to restrict the target to one port.
+          examples:
+            - api.github.com
+            - "*.example.com"
+        port:
+          type: integer
+          minimum: 1
+          maximum: 65535
+          description: Optional destination port. Omit it to match every port.
+          examples:
+            - 443
+        path:
+          type: string
+          pattern: ^/
+          description: >
+            Absolute HTTP path glob. `*` matches one segment and `**` matches
+            any depth, including the bare path.
+          examples:
+            - /repos/docker/**
+
    RuleDecision:
      type: string
      enum: [allow, deny]
@@ -25028,8 +25028,8 @@
      "connection": "hosted",
      "description": "HTTP+JSON API for managing Docker governance policies and rules.\n\n**Resource model.** An organization owns one or more policies. Each policy\ncontains a list of rules grouped into a single domain: either `network` or\n`filesystem`. A policy's domain is derived from its rule actions; mixing\ndomains within a single policy is not permitted.\n\n**Lifecycle.** Create a policy with CreatePolicy, then add rules with\nCreateRule. Rules can be updated in place with UpdateRule or removed with\nDeleteRule. Deleting all rules does not delete the policy itself.\n\n**Rule evaluation.** All rules in a policy are tested against every request.\n`deny` always wins: if any rule matches with `decision: deny`, the request\nis denied regardless of any `allow` rules.\n\n**Enforcement.** Organization policies take precedence over local sandbox\npolicies and cannot be overridden by individual users.\n\n**Propagation.** Policy changes take up to five minutes to reach developer\nmachines after being written.\n\nSee the [AI Governance documentation](https://docs.docker.com/ai/sandboxes/governance/)\nfor product documentation.\n",
      "diagnostics": [],
-      "digest": "85e78016fe389c0f17d684fcda083bdb768ddedd075f1736aae9b31f155a0344",
-      "exampleCount": 53,
+      "digest": "4f9f7d5cadd50f50ba01c30333846338283e1a95d2bf7dacada0ccabc84ad19c",
+      "exampleCount": 59,
      "experimental": false,
      "guides": [],
      "id": "ai-governance",
@@ -26944,7 +26944,7 @@
          "curl": "curl \\\n  --request POST \\\n  --header \"Authorization: Bearer ${TOKEN}\" \\\n  --header 'Accept: application/json' \\\n  --header 'Content-Type: application/json' \\\n  --data-raw '{\n  \"actions\": [\n    \"read\",\n    \"write\"\n  ],\n  \"decision\": \"allow\",\n  \"name\": \"allow data directory\",\n  \"resources\": [\n    \"/data\"\n  ]\n}' \\\n  'https://hub.docker.com/v2/orgs/\u003cORG_NAME\u003e/governance/policies/\u003cPOLICY_ID\u003e/rules'",
          "curlNotes": [],
          "deprecated": null,
-          "description": "Adds a rule to the policy's rule set. All rules in a policy must share\nthe same domain (network or filesystem); mixing domains is rejected.\n\n**Network** actions: `connect:tcp`, `connect:udp`. Resources are\nhostnames (for example, `example.com`), wildcard subdomains (`*.example.com`\nfor one level, `**.example.com` for any depth), hostnames with an optional\nport (for example, `example.com:443`), or CIDRs in IPv4 or IPv6 notation\n(for example, `10.0.0.0/8` or `2001:db8::/32`).\n\n**Filesystem** actions: `read`, `write`. Resources are paths (for example,\n`/data`). Use `*` to match within a single path segment and `**` to match\nrecursively across segments (for example, `/data/**`).\n\nChanges may take up to five minutes to reach developer machines.\n",
+          "description": "Adds a rule to the policy's rule set. All rules in a policy must share\nthe same domain (`network`, which includes HTTP, or `filesystem`);\nmixing domains is rejected. A single rule cannot mix L4 network and L7\nHTTP actions.\n\n**Network** actions: `connect:tcp`, `connect:udp`. Resources are\nhostnames (for example, `example.com`), wildcard subdomains (`*.example.com`\nfor one level, `**.example.com` for any depth), hostnames with an optional\nport (for example, `example.com:443`), or CIDRs in IPv4 or IPv6 notation\n(for example, `10.0.0.0/8` or `2001:db8::/32`).\n\n**Filesystem** actions: `read`, `write`. Resources are paths (for example,\n`/data`). Use `*` to match within a single path segment and `**` to match\nrecursively across segments (for example, `/data/**`).\n\n**HTTP** actions identify request methods, such as `request:get` and\n`request:post`. Use `http_resources` to identify the host, optional port,\nand absolute path glob. HTTP rules must not supply `resources`.\n\nChanges may take up to five minutes to reach developer machines.\n",
          "id": "createRule",
          "line": 356,
          "method": "POST",
@@ -26983,7 +26983,7 @@
          "path": "/orgs/{org_name}/governance/policies/{policy_id}/rules",
          "pointer": "/paths/~1orgs~1{org_name}~1governance~1policies~1{policy_id}~1rules/post",
          "raw": {
-            "description": "Adds a rule to the policy's rule set. All rules in a policy must share\nthe same domain (network or filesystem); mixing domains is rejected.\n\n**Network** actions: `connect:tcp`, `connect:udp`. Resources are\nhostnames (for example, `example.com`), wildcard subdomains (`*.example.com`\nfor one level, `**.example.com` for any depth), hostnames with an optional\nport (for example, `example.com:443`), or CIDRs in IPv4 or IPv6 notation\n(for example, `10.0.0.0/8` or `2001:db8::/32`).\n\n**Filesystem** actions: `read`, `write`. Resources are paths (for example,\n`/data`). Use `*` to match within a single path segment and `**` to match\nrecursively across segments (for example, `/data/**`).\n\nChanges may take up to five minutes to reach developer machines.\n",
+            "description": "Adds a rule to the policy's rule set. All rules in a policy must share\nthe same domain (`network`, which includes HTTP, or `filesystem`);\nmixing domains is rejected. A single rule cannot mix L4 network and L7\nHTTP actions.\n\n**Network** actions: `connect:tcp`, `connect:udp`. Resources are\nhostnames (for example, `example.com`), wildcard subdomains (`*.example.com`\nfor one level, `**.example.com` for any depth), hostnames with an optional\nport (for example, `example.com:443`), or CIDRs in IPv4 or IPv6 notation\n(for example, `10.0.0.0/8` or `2001:db8::/32`).\n\n**Filesystem** actions: `read`, `write`. Resources are paths (for example,\n`/data`). Use `*` to match within a single path segment and `**` to match\nrecursively across segments (for example, `/data/**`).\n\n**HTTP** actions identify request methods, such as `request:get` and\n`request:post`. Use `http_resources` to identify the host, optional port,\nand absolute path glob. HTTP rules must not supply `resources`.\n\nChanges may take up to five minutes to reach developer machines.\n",
            "operationId": "createRule",
            "requestBody": {
              "content": {
@@ -27003,6 +27003,24 @@
                        ]
                      }
                    },
+                    "http": {
+                      "summary": "HTTP rule",
+                      "value": {
+                        "actions": [
+                          "request:get",
+                          "request:head"
+                        ],
+                        "decision": "allow",
+                        "http_resources": [
+                          {
+                            "host": "api.github.com",
+                            "path": "/repos/docker/**",
+                            "port": 443
+                          }
+                        ],
+                        "name": "read GitHub repositories"
+                      }
+                    },
                    "network": {
                      "summary": "Network rule",
                      "value": {
@@ -27024,7 +27042,7 @@
                  }
                }
              },
-              "description": "Rule definition including actions, resources, and decision.",
+              "description": "Rule definition including actions, matching resources, and decision.",
              "required": true
            },
            "responses": {
@@ -27047,6 +27065,25 @@
                          ]
                        }
                      },
+                      "http": {
+                        "summary": "HTTP rule",
+                        "value": {
+                          "actions": [
+                            "request:get",
+                            "request:head"
+                          ],
+                          "decision": "allow",
+                          "http_resources": [
+                            {
+                              "host": "api.github.com",
+                              "path": "/repos/docker/**",
+                              "port": 443
+                            }
+                          ],
+                          "id": "rule_08gxuos1lo3rfum2c0pmgcz09lpc",
+                          "name": "read GitHub repositories"
+                        }
+                      },
                      "network": {
                        "summary": "Network rule",
                        "value": {
@@ -27157,7 +27194,7 @@
          "url": "/reference/api/ai-governance/latest/operations/createRule/",
          "variants": [
            {
-              "description": "Rule definition including actions, resources, and decision.",
+              "description": "Rule definition including actions, matching resources, and decision.",
              "direction": "Request",
              "examples": [
                {
@@ -27176,6 +27213,26 @@
                    ]
                  }
                },
+                {
+                  "language": "json",
+                  "name": "http",
+                  "text": "{\n  \"actions\": [\n    \"request:get\",\n    \"request:head\"\n  ],\n  \"decision\": \"allow\",\n  \"http_resources\": [\n    {\n      \"host\": \"api.github.com\",\n      \"path\": \"/repos/docker/**\",\n      \"port\": 443\n    }\n  ],\n  \"name\": \"read GitHub repositories\"\n}",
+                  "value": {
+                    "actions": [
+                      "request:get",
+                      "request:head"
+                    ],
+                    "decision": "allow",
+                    "http_resources": [
+                      {
+                        "host": "api.github.com",
+                        "path": "/repos/docker/**",
+                        "port": 443
+                      }
+                    ],
+                    "name": "read GitHub repositories"
+                  }
+                },
                {
                  "language": "json",
                  "name": "network",
@@ -27224,6 +27281,27 @@
                    ]
                  }
                },
+                {
+                  "language": "json",
+                  "name": "http",
+                  "text": "{\n  \"actions\": [\n    \"request:get\",\n    \"request:head\"\n  ],\n  \"decision\": \"allow\",\n  \"http_resources\": [\n    {\n      \"host\": \"api.github.com\",\n      \"path\": \"/repos/docker/**\",\n      \"port\": 443\n    }\n  ],\n  \"id\": \"rule_08gxuos1lo3rfum2c0pmgcz09lpc\",\n  \"name\": \"read GitHub repositories\"\n}",
+                  "value": {
+                    "actions": [
+                      "request:get",
+                      "request:head"
+                    ],
+                    "decision": "allow",
+                    "http_resources": [
+                      {
+                        "host": "api.github.com",
+                        "path": "/repos/docker/**",
+                        "port": 443
+                      }
+                    ],
+                    "id": "rule_08gxuos1lo3rfum2c0pmgcz09lpc",
+                    "name": "read GitHub repositories"
+                  }
+                },
                {
                  "language": "json",
                  "name": "network",
@@ -27422,7 +27500,7 @@
          "deprecated": null,
          "description": "Deletes a rule from the policy. Returns the deleted rule. Changes may\ntake up to five minutes to reach developer machines.\n",
          "id": "deleteRule",
-          "line": 497,
+          "line": 526,
          "method": "DELETE",
          "parameters": [
            {
@@ -27712,9 +27790,9 @@
          "curl": "curl \\\n  --request PATCH \\\n  --header \"Authorization: Bearer ${TOKEN}\" \\\n  --header 'Accept: application/json' \\\n  --header 'Content-Type: application/json' \\\n  --data-raw '{\n  \"resources\": [\n    \"research.mitre.org\"\n  ]\n}' \\\n  'https://hub.docker.com/v2/orgs/\u003cORG_NAME\u003e/governance/policies/\u003cPOLICY_ID\u003e/rules/\u003cRULE_ID\u003e'",
          "curlNotes": [],
          "deprecated": null,
-          "description": "Partially updates a rule. Only fields present in the request body are\nupdated; absent fields are left unchanged. Returns the rule in both its\nold and new states.\n\nChanging `actions` across domains (for example, from network actions to\nfilesystem actions) is rejected. Changes may take up to five minutes to\nreach developer machines.\n",
+          "description": "Partially updates a rule. Only fields present in the request body are\nupdated; absent fields are left unchanged. Returns the rule in both its\nold and new states.\n\nChanging `actions` across domains (for example, from network actions to\nfilesystem actions) is rejected while other rules remain in the policy.\nWhen changing a rule between L4 network and L7 HTTP, supply the matching\n`resources` or `http_resources` in the same request. Changes may take up\nto five minutes to reach developer machines.\n",
          "id": "updateRule",
-          "line": 439,
+          "line": 466,
          "method": "PATCH",
          "parameters": [
            {
@@ -27766,7 +27844,7 @@
          "path": "/orgs/{org_name}/governance/policies/{policy_id}/rules/{rule_id}",
          "pointer": "/paths/~1orgs~1{org_name}~1governance~1policies~1{policy_id}~1rules~1{rule_id}/patch",
          "raw": {
-            "description": "Partially updates a rule. Only fields present in the request body are\nupdated; absent fields are left unchanged. Returns the rule in both its\nold and new states.\n\nChanging `actions` across domains (for example, from network actions to\nfilesystem actions) is rejected. Changes may take up to five minutes to\nreach developer machines.\n",
+            "description": "Partially updates a rule. Only fields present in the request body are\nupdated; absent fields are left unchanged. Returns the rule in both its\nold and new states.\n\nChanging `actions` across domains (for example, from network actions to\nfilesystem actions) is rejected while other rules remain in the policy.\nWhen changing a rule between L4 network and L7 HTTP, supply the matching\n`resources` or `http_resources` in the same request. Changes may take up\nto five minutes to reach developer machines.\n",
            "operationId": "updateRule",
            "requestBody": {
              "content": {
@@ -28140,7 +28218,7 @@
      ],
      "owner": "docker/governor-services",
      "product": "ai-governance",
-      "schemaCount": 43,
+      "schemaCount": 45,
      "schemaURLs": {
        "#/components/schemas/AllowlistV0": "/reference/api/ai-governance/latest/schemas/AllowlistV0/",
        "#/components/schemas/CedarV1Policy": "/reference/api/ai-governance/latest/schemas/CedarV1Policy/",
@@ -28149,6 +28227,8 @@
        "#/components/schemas/DeletePolicyResponse": "/reference/api/ai-governance/latest/schemas/DeletePolicyResponse/",
        "#/components/schemas/DeleteRuleResponse": "/reference/api/ai-governance/latest/schemas/DeleteRuleResponse/",
        "#/components/schemas/Error": "/reference/api/ai-governance/latest/schemas/Error/",
+        "#/components/schemas/HTTPResource": "/reference/api/ai-governance/latest/schemas/HTTPResource/",
+        "#/components/schemas/HTTPResources": "/reference/api/ai-governance/latest/schemas/HTTPResources/",
        "#/components/schemas/Policy": "/reference/api/ai-governance/latest/schemas/Policy/",
        "#/components/schemas/PolicySummary": "/reference/api/ai-governance/latest/schemas/PolicySummary/",
        "#/components/schemas/Rule": "/reference/api/ai-governance/latest/schemas/Rule/",
@@ -28167,7 +28247,7 @@
          "name": "AllowlistV0",
          "pointer": "/components/schemas/AllowlistV0",
          "schema": {
-            "description": "Network or filesystem allowlist containing a list of rules. Present on\nPolicy when `PolicySummary.type` is `allowlist_v0`; omitted when the\npolicy has no rules yet. All rules in an allowlist share the same domain.\nAll rules are evaluated on every request: `deny` always wins over `allow`.\n",
+            "description": "Network, HTTP, or filesystem allowlist containing a list of rules. Present on\nPolicy when `PolicySummary.type` is `allowlist_v0`; omitted when the\npolicy has no rules yet. All rules in an allowlist share the same domain.\nAll rules are evaluated on every request: `deny` always wins over `allow`.\n",
            "properties": {
              "domain": {
                "description": "The access-control domain shared by all rules in this allowlist. Derived from rule actions: network actions (`connect:tcp`, `connect:udp`) produce `network`; filesystem actions (`read`, `write`) produce `filesystem`. Present when `rules` is non-empty; absent when the allowlist has no rules.\n",
@@ -28255,6 +28335,20 @@
          "pointer": "/components/schemas/CreateRuleRequest",
          "schema": {
            "description": "Fields required to create a new rule within a policy's rule set.",
+            "oneOf": [
+              {
+                "required": [
+                  "resources"
+                ],
+                "type": "object"
+              },
+              {
+                "required": [
+                  "http_resources"
+                ],
+                "type": "object"
+              }
+            ],
            "properties": {
              "actions": {
                "$ref": "#/components/schemas/RuleActions"
@@ -28262,6 +28356,9 @@
              "decision": {
                "$ref": "#/components/schemas/RuleDecision"
              },
+              "http_resources": {
+                "$ref": "#/components/schemas/HTTPResources"
+              },
              "name": {
                "description": "Human-readable label for the rule.",
                "examples": [
@@ -28276,7 +28373,6 @@
            "required": [
              "name",
              "actions",
-              "resources",
              "decision"
            ],
            "type": "object"
@@ -28364,6 +28460,59 @@
          },
          "url": "/reference/api/ai-governance/latest/schemas/Error/"
        },
+        {
+          "name": "HTTPResource",
+          "pointer": "/components/schemas/HTTPResource",
+          "schema": {
+            "properties": {
+              "host": {
+                "description": "Domain name or domain glob without a URL scheme or port. Use the separate `port` field to restrict the target to one port.\n",
+                "examples": [
+                  "api.github.com",
+                  "*.example.com"
+                ],
+                "minLength": 1,
+                "type": "string"
+              },
+              "path": {
+                "description": "Absolute HTTP path glob. `*` matches one segment and `**` matches any depth, including the bare path.\n",
+                "examples": [
+                  "/repos/docker/**"
+                ],
+                "pattern": "^/",
+                "type": "string"
+              },
+              "port": {
+                "description": "Optional destination port. Omit it to match every port.",
+                "examples": [
+                  443
+                ],
+                "maximum": 65535,
+                "minimum": 1,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "host",
+              "path"
+            ],
+            "type": "object"
+          },
+          "url": "/reference/api/ai-governance/latest/schemas/HTTPResource/"
+        },
+        {
+          "name": "HTTPResources",
+          "pointer": "/components/schemas/HTTPResources",
+          "schema": {
+            "description": "HTTP request targets. Required for HTTP rules and forbidden for network and filesystem rules. A request matches when any target matches.\n",
+            "items": {
+              "$ref": "#/components/schemas/HTTPResource"
+            },
+            "minItems": 1,
+            "type": "array"
+          },
+          "url": "/reference/api/ai-governance/latest/schemas/HTTPResources/"
+        },
        {
          "name": "Policy",
          "pointer": "/components/schemas/Policy",
@@ -28461,7 +28610,7 @@
                "$ref": "#/components/schemas/Scope"
              },
              "type": {
-                "description": "Identifies the policy type. `allowlist_v0` for network/filesystem allowlist policies; `cedar_v1` for Cedar language policies.\n",
+                "description": "Identifies the policy type. `allowlist_v0` for network, HTTP, and filesystem allowlist policies; `cedar_v1` for Cedar language policies.\n",
                "enum": [
                  "allowlist_v0",
                  "cedar_v1"
@@ -28497,6 +28646,20 @@
          "pointer": "/components/schemas/Rule",
          "schema": {
            "description": "A single allow or deny rule within an allowlist policy.",
+            "oneOf": [
+              {
+                "required": [
+                  "resources"
+                ],
+                "type": "object"
+              },
+              {
+                "required": [
+                  "http_resources"
+                ],
+                "type": "object"
+              }
+            ],
            "properties": {
              "actions": {
                "$ref": "#/components/schemas/RuleActions"
@@ -28504,6 +28667,9 @@
              "decision": {
                "$ref": "#/components/schemas/RuleDecision"
              },
+              "http_resources": {
+                "$ref": "#/components/schemas/HTTPResources"
+              },
              "id": {
                "examples": [
                  "rule_06evsm9qjm1pdsk0a8nkfaxy7jna"
@@ -28525,7 +28691,6 @@
              "id",
              "name",
              "actions",
-              "resources",
              "decision"
            ],
            "type": "object"
@@ -28536,7 +28701,7 @@
          "name": "RuleActions",
          "pointer": "/components/schemas/RuleActions",
          "schema": {
-            "description": "Network actions: `connect:tcp`, `connect:udp`. Filesystem actions: `read`, `write`. All actions in a rule must belong to the same domain; mixing network and filesystem actions in one rule is rejected.\n",
+            "description": "Network actions: `connect:tcp`, `connect:udp`. Filesystem actions: `read`, `write`. HTTP actions: `request:get`, `request:post`, `request:put`, `request:delete`, `request:patch`, `request:head`, `request:options`, `request:connect`, `request:trace`. All actions in a rule must belong to the same layer; mixing HTTP, network, or filesystem actions in one rule is rejected.\n",
            "examples": [
              [
                "connect:tcp",
@@ -28548,7 +28713,16 @@
                "connect:tcp",
                "connect:udp",
                "read",
-                "write"
+                "write",
+                "request:get",
+                "request:post",
+                "request:put",
+                "request:delete",
+                "request:patch",
+                "request:head",
+                "request:options",
+                "request:connect",
+                "request:trace"
              ],
              "type": "string"
            },
@@ -28577,7 +28751,7 @@
          "name": "RuleResources",
          "pointer": "/components/schemas/RuleResources",
          "schema": {
-            "description": "Network domain: hostnames (for example, `example.com`), wildcard subdomains (`*.example.com` or `**.example.com`), hostnames with port (for example, `example.com:443`), or CIDRs in IPv4 or IPv6 notation (for example, `10.0.0.0/8` or `2001:db8::/32`). Filesystem domain: paths (for example, `/data`); `*` matches within one path segment, `**` matches recursively (for example, `/data/**`).\n",
+            "description": "Network domain: hostnames (for example, `example.com`), wildcard subdomains (`*.example.com` or `**.example.com`), hostnames with port (for example, `example.com:443`), or CIDRs in IPv4 or IPv6 notation (for example, `10.0.0.0/8` or `2001:db8::/32`). Filesystem domain: paths (for example, `/data`); `*` matches within one path segment, `**` matches recursively (for example, `/data/**`). Required for network and filesystem rules and forbidden for HTTP rules.\n",
            "examples": [
              [
                "research.mitre.org",
@@ -28688,6 +28862,13 @@
          "pointer": "/components/schemas/UpdateRuleRequest",
          "schema": {
            "description": "Partial update. Only fields present in the body are updated; absent fields are left unchanged.",
+            "not": {
+              "required": [
+                "resources",
+                "http_resources"
+              ],
+              "type": "object"
+            },
            "properties": {
              "actions": {
                "$ref": "#/components/schemas/RuleActions"
@@ -28695,6 +28876,9 @@
              "decision": {
                "$ref": "#/components/schemas/RuleDecision"
              },
+              "http_resources": {
+                "$ref": "#/components/schemas/HTTPResources"
+              },
              "name": {
                "description": "Human-readable label for the rule.",
                "examples": [