@zapier/policy-context

Shared request context types, builders, and policy condition generators — the contract between sdkapi and approvalsapi for describing requests in approval flows and policy evaluation.

Install

npm install @zapier/policy-context zod

zod (v4+) is a peer dependency.

What it provides

Three layers, each building on the previous:

1. Types — Zod schemas for HttpRequestContext, ActionRunContext, and the RequestContext discriminated union. These are the canonical shapes stored in approvalsapi and sent by sdkapi.
2. Builders — Normalize raw request parts (URL parsing, header filtering, body coercion) into validated contexts.
3. Conditions / Policies — Convert stored contexts into @zapier/policy-schema Condition[] and full Policy documents.

Usage

Build a request context

import { buildHttpRequestContext } from "@zapier/policy-context";

const context = buildHttpRequestContext({
  method: "POST",
  url: "https://api.example.com/v1/messages",
  headers: { "content-type": "application/json", authorization: "Bearer …" },
  body: '{"text":"hello"}',
});

buildHttpRequestContext normalizes the URL, filters headers through IGNORED_HEADERS (auth, cookies, etc.), and validates the result with Zod.

Generate policy conditions

import {
  buildExactHttpConditions,
  buildDomainHttpConditions,
} from "@zapier/policy-context";

const exact = buildExactHttpConditions(context); // matches this exact request
const domain = buildDomainHttpConditions(context); // matches any request to the same host

Build a complete "allow this exact request" policy

import { toExactPolicy } from "@zapier/policy-context";

const policy = toExactPolicy(context);

Connection-scoped policies

import { buildConnectionPolicy } from "@zapier/policy-context";

const policy = buildConnectionPolicy({
  connectionId: "conn_123",
  accessLevel: "read_only",
});

Subpath imports

In addition to the package root, every module is importable directly:

import { buildHttpRequestContext } from "@zapier/policy-context/builders";
import { HttpRequestContextSchema } from "@zapier/policy-context/types";

License

UNLICENSED — internal Zapier use.