{"uid":"cap_8gXDcqDiZR8rUv-wtZDVS","slug":"plan-policy-audit-99854a94","name":"Plan Policy Audit","description":"Hold a Terraform plan to a contract the caller states: resource types forbidden or permitted, tags every resource must carry, actions that must not appear, a ceiling on destructive changes, and attribute values that must not be used. Tags are read from tags, tags_all or labels, because providers differ and reading only one would report a tagged resource as untagged. Which rules ran is published, so a contract that checked nothing is visible rather than reading as a pass.","url":"https://api.zfinia.com/x402/v1/terraform-plan-policy-audit?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"plan":{"type":"string","maxLength":4194304},"contract":{"type":"object","properties":{"required_tags":{"type":"array","items":{"type":"string","maxLength":128},"maxItems":50,"minItems":1},"forbidden_types":{"type":"array","items":{"type":"string","maxLength":128},"maxItems":200,"minItems":1},"permitted_types":{"type":"array","items":{"type":"string","maxLength":128},"maxItems":500,"minItems":1},"forbidden_actions":{"type":"array","items":{"enum":["create","update","destroy","replace"],"type":"string"},"maxItems":8,"minItems":1},"max_destructive_changes":{"type":"integer","minimum":0},"forbidden_attribute_values":{"type":"object"}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.2","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.2/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.2","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.2","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_oWZfgh36qevWlHC6gFQDz","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.2","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Validates a Terraform plan JSON against a caller-defined policy contract covering forbidden/permitted resource types, required tags, forbidden actions, max destructive changes, and forbidden attribute values","exampleAgentPrompt":"Audit this Terraform plan against our policy: no aws_s3_bucket or aws_iam_policy resources allowed, every resource must have 'env' and 'owner' tags, destroy actions are forbidden, and we can have at most 2 destructive changes total — here's the plan JSON: <plan>.","exampleUseCases":[{"title":"Block forbidden resource types in CI","prompt":"Before we apply this Terraform plan in CI, check that it doesn't create any aws_iam_role or aws_iam_policy resources, all resources carry 'team' and 'cost-center' tags, and there are zero destroy actions — here's the plan JSON."},{"title":"Enforce tag compliance for cost allocation","prompt":"Audit this Terraform plan and make sure every single resource has the tags 'project', 'env', and 'owner' — flag anything that's missing them so I can fix it before apply."},{"title":"Cap destructive changes before production deploy","prompt":"We have a rule that production deploys can have at most 3 destructive changes. Can you check this Terraform plan and tell me if it exceeds that limit, and list exactly what would be destroyed?"}],"resultDescription":"Returns a structured audit report listing which policy rules were evaluated (so an empty contract is visible rather than silently passing), each violation found including the resource address, rule broken, and relevant values, plus a summary of destructive change counts and tag compliance across all resources. Tags are checked across tags, tags_all, and labels fields to handle provider differences.","failureModes":["Plan JSON exceeds 4MB size limit — request rejected","Malformed or invalid Terraform plan JSON — parse error returned","Contract object contains unrecognized fields — rejected due to additionalProperties:false","required_tags array is empty or missing items — schema validation failure","Payment not included or insufficient — x402 payment required error","forbidden_attribute_values object malformed — validation error","Network timeout on large plans — retry with smaller plan or increased timeout"],"whenToPreferThis":"Choose this endpoint when you need to enforce a caller-defined policy contract against a Terraform plan before apply — particularly when your policy rules vary per environment, team, or deployment context and cannot be hardcoded. It is the right choice for CI/CD gates, pull request checks, or agent-driven infrastructure workflows where the policy must be expressed dynamically. Prefer it over static linting tools (tfsec, checkov) when the contract itself is data the caller supplies at runtime rather than a fixed rule set baked into tooling.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-18T06:46:06.434Z","isFirstParty":false,"canonicalSlug":"plan-policy-audit-99854a94"}