# Plan Policy Audit

> Plan Policy Audit is a paid API for AI agents from api.zfinia.com, paid per call via x402, $0.2/call, status unknown (last checked 2026-10-18).

Validates a Terraform plan JSON against a caller-defined policy contract covering forbidden/permitted resource types, required tags, forbidden actions, max destructive changes, and forbidden attribute values

## Facts

- Endpoint: POST https://api.zfinia.com/x402/v1/terraform-plan-policy-audit?utm_source=zero.xyz
- Price: $0.2/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-18
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/plan-policy-audit-99854a94
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_8gXDcqDiZR8rUv-wtZDVS

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability plan-policy-audit-99854a94 -d '<json body>'
```

Example prompt: Audit this Terraform plan against our policy: no aws_s3_bucket or aws_iam_policy resources allowed, every resource must have 'env' and 'owner' tags, destroy actions are forbidden, and we can have at most 2 destructive changes total — here's the plan JSON: <plan>.

## When to prefer this

Choose this endpoint when you need to enforce a caller-defined policy contract against a Terraform plan before apply — particularly when your policy rules vary per environment, team, or deployment context and cannot be hardcoded. It is the right choice for CI/CD gates, pull request checks, or agent-driven infrastructure workflows where the policy must be expressed dynamically. Prefer it over static linting tools (tfsec, checkov) when the contract itself is data the caller supplies at runtime rather than a fixed rule set baked into tooling.

## Known failure modes

- Plan JSON exceeds 4MB size limit — request rejected
- Malformed or invalid Terraform plan JSON — parse error returned
- Contract object contains unrecognized fields — rejected due to additionalProperties:false
- required_tags array is empty or missing items — schema validation failure
- Payment not included or insufficient — x402 payment required error
- forbidden_attribute_values object malformed — validation error
- Network timeout on large plans — retry with smaller plan or increased timeout

## How this service works

Hold a Terraform plan to a contract the caller states: resource types forbidden or permitted, tags every resource must carry, actions that must not appear, a ceiling on destructive changes, and attribute values that must not be used. Tags are read from tags, tags_all or labels, because providers differ and reading only one would report a tagged resource as untagged. Which rules ran is published, so a contract that checked nothing is visible rather than reading as a pass.

## Output

Returns a structured audit report listing which policy rules were evaluated (so an empty contract is visible rather than silently passing), each violation found including the resource address, rule broken, and relevant values, plus a summary of destructive change counts and tag compliance across all resources. Tags are checked across tags, tags_all, and labels fields to handle provider differences.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "plan": {
   "type": "string",
   "maxLength": 4194304
  },
  "contract": {
   "type": "object",
   "properties": {
    "required_tags": {
     "type": "array",
     "items": {
      "type": "string",
      "maxLength": 128
     },
     "maxItems": 50,
     "minItems": 1
    },
    "forbidden_types": {
     "type": "array",
     "items": {
      "type": "string",
      "maxLength": 128
     },
     "maxItems": 200,
     "minItems": 1
    },
    "permitted_types": {
     "type": "array",
     "items": {
      "type": "string",
      "maxLength": 128
     },
     "maxItems": 500,
     "minItems": 1
    },
    "forbidden_actions": {
     "type": "array",
     "items": {
      "enum": [
       "create",
       "update",
       "destroy",
       "replace"
      ],
      "type": "string"
     },
     "maxItems": 8,
     "minItems": 1
    },
    "max_destructive_changes": {
     "type": "integer",
     "minimum": 0
    },
    "forbidden_attribute_values": {
     "type": "object"
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/plan-policy-audit-99854a94/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.zfinia.com](https://www.zero.xyz/host/api.zfinia.com/llms.txt)