> ## Documentation Index > Fetch the complete documentation index at: https://docs.celum.io/llms.txt > Use this file to discover all available pages before exploring further. # Dry run policy > Security → PQC: post-quantum readiness of the gateways' TLS, glued from **Authorisation:** `security:Read` on `krn:celum:supervisor:{name}:security:*`. **Assistant tool:** `dry_run_policy` ## OpenAPI ````yaml /openapi.json post /api/supervisors/{name}/security/policies/dry-run openapi: 3.0.3 info: description: >- The HTTP surface of the Celum backend, generated from its own router and authorisation map — so this list cannot drift from the server that serves it. **Every operation states the IAM action and resource it is authorised against.** That pairing is the part worth reading: a policy naming the right action against the wrong resource matches nothing, and fails silently. Request and response bodies come from the Go types the handlers send and decode. Where those types do not determine the shape (an interface, a map[string]any, an unknown custom encoding), the operation says so in `x-celum-schema-gap` instead of carrying a guessed schema. title: Celum API version: 1.0.0 servers: - description: Your Celum deployment url: https://{host} variables: host: default: celum.example.com description: The host your Celum backend is served from security: - sessionCookie: [] - bearerToken: [] tags: - description: AI assistant & MCP name: ai-assistant - description: Clusters & CAPI lifecycle name: capi - description: Certificates & external secrets name: certs - description: GitOps & apps name: gitops - description: IAM, audit & auth name: iam - description: Image library name: images - description: Infrastructure & supervisors name: infrastructure - description: Networking name: networking - description: Observability & platform health name: observability - description: Platform onboarding & settings name: platform-settings - description: Projects name: projects - description: Registries & mirroring name: registries - description: Security & flows name: security - description: Storage name: storage - description: Templates & addons name: templates - description: Virtualization platform (KubeVirt/CDI) name: virt - description: Virtual machines name: vms - description: Workloads & topology name: workloads paths: /api/supervisors/{name}/security/policies/dry-run: post: tags: - security summary: Dry run policy description: >- Security → PQC: post-quantum readiness of the gateways' TLS, glued from **Authorisation:** `security:Read` on `krn:celum:supervisor:{name}:security:*`. **Assistant tool:** `dry_run_policy` operationId: post_supervisors_byName_security_policies_dryRun parameters: - description: >- The supervisor's name, as registered under Administration → Supervisors. in: path name: name required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/api.DryRunRequest.Input' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/api.DryRunResponse' description: Success. '400': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: Bad Request. '401': description: Not authenticated — no valid session cookie or API token. '403': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: >- Authenticated, but no policy allows this action on this resource. The body carries the action and resource that were evaluated. '502': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: Bad Gateway. '504': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: Gateway Timeout. components: schemas: api.DryRunRequest.Input: properties: affectedNamespace: type: string affectedWorkload: type: string sinceSeconds: format: int64 type: integer yaml: type: string type: object x-go-type: backend/internal/api.DryRunRequest api.DryRunResponse: properties: mode: type: string parseError: type: string summary: properties: affectedDirection: type: string edgesAnalysed: format: int64 type: integer required: - affectedDirection - edgesAnalysed type: object unaffected: items: $ref: '#/components/schemas/api.DryRunEdge' nullable: true type: array warnings: items: $ref: '#/components/schemas/api.DryRunWarning' type: array wouldAllow: items: $ref: '#/components/schemas/api.DryRunEdge' nullable: true type: array wouldBlock: items: $ref: '#/components/schemas/api.DryRunEdge' nullable: true type: array wouldDeny: items: $ref: '#/components/schemas/api.DryRunEdge' nullable: true type: array required: - summary - unaffected - wouldAllow - wouldBlock - wouldDeny type: object x-go-type: backend/internal/api.DryRunResponse api.ErrorBody: properties: error: type: string required: - error type: object api.DryRunEdge: properties: bytes: format: int64 minimum: 0 type: integer destPort: format: int32 minimum: 0 type: integer direction: type: string l7: $ref: '#/components/schemas/api.DryRunL7' observedAction: type: string peerAddresses: items: type: string type: array peerIdentity: format: int32 minimum: 0 type: integer peerNamespace: type: string peerRedacted: type: boolean peerWorkload: type: string peerWorld: type: boolean protocol: type: string required: - bytes - destPort - direction - observedAction - protocol type: object x-go-type: backend/internal/api.DryRunEdge api.DryRunWarning: properties: detail: type: string severity: type: string title: type: string workloads: items: type: string type: array required: - detail - severity - title type: object x-go-type: backend/internal/api.DryRunWarning api.DryRunL7: properties: allowed: format: int64 minimum: 0 type: integer denied: format: int64 minimum: 0 type: integer deniedShapes: items: $ref: '#/components/schemas/api.DryRunL7Shape' type: array parsed: type: boolean requests: format: int64 minimum: 0 type: integer rules: format: int64 type: integer unrestricted: type: boolean required: - allowed - denied - parsed - requests - rules type: object x-go-type: backend/internal/api.DryRunL7 api.DryRunL7Shape: properties: count: format: int64 minimum: 0 type: integer method: type: string path: type: string required: - count - method - path type: object x-go-type: backend/internal/api.DryRunL7Shape securitySchemes: sessionCookie: description: >- The session cookie issued by the OIDC sign-in flow. This is what a browser uses. in: cookie name: k8s-gate-session type: apiKey bearerToken: description: >- An API token, minted from your own identity page. A token carries the IAM groups you held **when it was minted**, and cannot bypass deletion approval — except for guest clusters inside a project that same token created. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.