Policy Languages let an organization publish the same Policy Version in several languages. Settings endpoints expose the languages an organization has configured and which one is the default; Policy Language Versions expose the per-language variants of a Policy Version, including which content formats are available for each.
List the organization's configured Policy languages and which one is the default. Returns 403 (FEATURE_FLAG_DISABLED) when the multilingual Policy versions feature is off for the organization. When the feature is on but the POLICY_LANGUAGES_ENABLED setting is off, returns 400 (VALIDATION) asking you to enable Policy languages in your organization settings.
🔒 Requires Policies: List Policies permission.
Successful
Malformed data and/or validation errors
Invalid Authorization
You are not allowed to perform this action
You must accept the Drata terms and conditions to use the API
Internal server error
{- "data": [
- {
- "language": "en-US",
- "default": true
}
]
}List Policy Version language variants. Narrow to a single Policy Version with policyVersionId, or to every Version of a Policy with policyId. Scope to the parent Version status with statuses[] — statuses[]=PUBLISHED excludes variants attached to draft Versions. One row per language variant, so a Policy Version with several languages does not multiply rows in other collections. This is the endpoint to use when you need languages across multiple Policy Versions — the policy-version list endpoint does not expand them. Downloads are not available here: use GET /policy-language-versions/{policyLanguageVersionId} with expand[]=downloadUrl or expand[]=downloadPdfUrl. Returns 403 (FEATURE_FLAG_DISABLED) when the multilingual Policy versions feature is off for the organization. This is a content read, so the POLICY_LANGUAGES_ENABLED setting does not gate it — existing variants stay listable while only the flag is on.
🔒 Requires Policies: List Policies permission.
Successful
Malformed data and/or validation errors
Invalid Authorization
You are not allowed to perform this action
Not Found
You must accept the Drata terms and conditions to use the API
Internal server error
{- "data": [
- {
- "id": 1,
- "language": "en-US",
- "default": false,
- "hasFile": true,
- "hasPdf": true,
- "hasHtml": false,
- "originalFileName": "information-security-policy-es.pdf",
- "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z",
- "policyVersion": {
- "id": 1,
- "version": 1,
- "current": true,
- "type": "UPLOADED",
- "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z",
- "renewalDate": "2025-07-01T16:45:55.246Z",
- "subVersion": 1,
- "description": "string",
- "approvedAt": "2025-07-01T16:45:55.246Z",
- "changesExplanation": "string",
- "publishedAt": "2025-07-01T16:45:55.246Z",
- "requiresAcknowledgment": true
}, - "policy": {
- "id": 1,
- "name": "Acceptable Use Policy",
- "description": "string",
- "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z",
- "assignedTo": "ALL",
- "policyStatus": "ACTIVE",
- "renewalDate": "2025-07-01T16:45:55.246Z"
},
}
], - "pagination": {
- "cursor": "string",
- "totalCount": 0
}
}List the language variants of a single Policy Version. The version-scoped view of /policy-language-versions — the rows are the same, addressed through the Policy and Policy Version that own them. Use this when you already hold both identifiers; use /policy-language-versions when you need language rows across several Versions or Policies in one call, or when you want the parent relations expanded. Narrow by the parent Version status with statuses[]. Returns 403 (FEATURE_FLAG_DISABLED) when the multilingual Policy versions feature is off for the organization — the flag is checked before the pairing, so a flag-off tenant gets the 403 rather than the 404 below. When the feature is on, returns 404 when policyVersionId is not a Version of policyId, rather than an empty list that would be indistinguishable from a Version with no variants. This is a content read, so the POLICY_LANGUAGES_ENABLED setting does not gate it.
🔒 Requires Policies: List Policies permission.
Successful
Malformed data and/or validation errors
Invalid Authorization
You are not allowed to perform this action
Not Found
You must accept the Drata terms and conditions to use the API
Internal server error
{- "data": [
- {
- "id": 1,
- "language": "en-US",
- "default": false,
- "hasFile": true,
- "hasPdf": true,
- "hasHtml": false,
- "originalFileName": "information-security-policy-es.pdf",
- "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z"
}
], - "pagination": {
- "cursor": "string",
- "totalCount": 0
}
}Get a single Policy Version language variant by its identifier, as returned in the id of a /policy-language-versions row. Returns the variant's metadata (default), or its authored HTML content when Accept: text/html is sent.
Downloads: expand[]=downloadUrl returns a short-lived signed URL for the uploaded document in its original format, and expand[]=downloadPdfUrl one for the PDF rendering. Either returns null — not an error — when this language has no content of that kind, matching hasFile / hasPdf on the same response. Requesting either is recorded as a Policy download against the selected language; reading the HTML is not. These two expands are available only here, never on the /policy-language-versions collection.
Returns 403 (FEATURE_FLAG_DISABLED) when the multilingual Policy versions feature is off for the organization. Returns 404 when the identifier is unknown, when the variant belongs to another organization, or when the variant has been deleted — those three stay collapsed so an integrator cannot probe another tenant's id space. Accept: text/html also returns 404 when this language has no authored HTML: the body is the entire response, so an empty one could be mistaken for content. Note this is stricter than GET /policies/{policyId}/policy-versions/{policyVersionId}, which answers 200 with an empty body for a Policy Version with no HTML.
Variants attached to draft Policy Versions are readable here — HTML and metadata reflect the current draft content. For a BUILDER-type variant, though, the PDF is not rendered until the version is PUBLISHED: hasPdf is false and expand[]=downloadPdfUrl returns null pre-publish, per the same not-an-error contract above. Scope to published content with statuses[]=PUBLISHED on the collection.
🔒 Requires Policies: List Policies permission.
Successful
Malformed data and/or validation errors
Invalid Authorization
You are not allowed to perform this action
Not Found
None of the media types in the Accept header can be produced
You must accept the Drata terms and conditions to use the API
Internal server error
{- "id": 1,
- "language": "en-US",
- "default": false,
- "hasFile": true,
- "hasPdf": true,
- "hasHtml": false,
- "originalFileName": "information-security-policy-es.pdf",
- "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z",
- "policyVersion": {
- "id": 1,
- "version": 1,
- "current": true,
- "type": "UPLOADED",
- "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z",
- "renewalDate": "2025-07-01T16:45:55.246Z",
- "subVersion": 1,
- "description": "string",
- "approvedAt": "2025-07-01T16:45:55.246Z",
- "changesExplanation": "string",
- "publishedAt": "2025-07-01T16:45:55.246Z",
- "requiresAcknowledgment": true
}, - "policy": {
- "id": 1,
- "name": "Acceptable Use Policy",
- "description": "string",
- "createdAt": "2025-07-01T16:45:55.246Z",
- "updatedAt": "2025-07-01T16:45:55.246Z",
- "assignedTo": "ALL",
- "policyStatus": "ACTIVE",
- "renewalDate": "2025-07-01T16:45:55.246Z"
},
}