# uip gov aops-policy

> Syntax and options for `uip gov aops-policy`'s policy CRUD, product catalog, license-type catalog, and Form.io template commands.

`uip gov aops-policy` manages UiPath AOps governance policies — product configuration rules (e.g. a StudioX policy restricting which project settings are allowed) authored as a filled-in Form.io form and assigned across tenants/users/groups. This page covers the authoring side: the policy record itself (`list`/`get`/`create`/`update`/`delete`), plus the read-only reference catalogs (`product`, `license-type`) and the `template` commands that generate the fillable form-data blueprint a policy's `data` payload is built from. For assigning a policy to a subject and resolving what actually applies at runtime, see [`aops-policy deployment` and `deployed-policy`](./uip-gov-aops-policy-deployment.md). For the parent tool overview and Access Policies, see [`uip gov`](./uip-gov.md).

:::note
Typical flow: `template get <product>` → edit the emitted form-data.json → `policy create --product-name <product> --name <name> --input form-data.json` → [`deployment tenant configure`](./uip-gov-aops-policy-deployment.md) (or user/group) to roll it out.
:::

## Synopsis

```text
uip gov aops-policy list [--product-name <name>] [--product-label <label>] [--search <term>] [--sort-by <field>] [--sort-order asc|desc] [--limit <n>] [--offset <n>]
uip gov aops-policy get <policyIdentifier>
uip gov aops-policy create --name <name> --product-name <name> [--description <text>] [--priority <n>] [--availability <n>] [--input <path>]
uip gov aops-policy update --identifier <id> --name <name> --product-name <name> [--description <text>] [--priority <n>] [--availability <n>] [--input <path>]
uip gov aops-policy delete <policyIdentifier>

uip gov aops-policy product list
uip gov aops-policy product get <productIdentifier>

uip gov aops-policy license-type list

uip gov aops-policy template get <productIdentifier> [--output-form-data <path>] [--output-template-locale-resource <path>]
uip gov aops-policy template list --output-dir <path>
```

Every verb also accepts `--login-validity <minutes>` to override the interactive-login token lifetime for that one call (rarely needed).

## uip gov aops-policy list

List governance policies, with optional filtering and pagination. Returns policy metadata (identifier, name, product, priority, availability) — not the policy `data` blob.

### Options

| Long | Value | Description |
|---|---|---|
| `--product-name <product-name>` | string | Restrict to one product (e.g. `StudioX`). Matches `product.name` — see `product list`. |
| `--product-label <productLabel>` | string | Restrict to one product by display label (e.g. `'Studio X'`). Prefer `--product-name` for scripting. |
| `--search <searchTerm>` | string | Case-insensitive substring match against policy name/description. |
| `--sort-by <field>` | string | Field to sort by (e.g. `name`, `createdOn`, `priority`). Passed through to the governance API. |
| `--sort-order <direction>` | `asc` \| `desc` | Sort direction for `--sort-by`. Case-insensitive; any other value fails client-side. |
| `--limit <n>` | integer | Page size. Default `20`. |
| `--offset <n>` | integer | Zero-based page index. |

### Example

```bash
uip gov aops-policy list --product-name StudioX --limit 2
```

### Data shape (--output json)

```json
{
  "Code": "AopsPolicyList",
  "Data": [
    { "identifier": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Baseline StudioX Policy", "productName": "StudioX", "priority": 10, "availability": 1 }
  ]
}
```

## uip gov aops-policy get

Fetch one policy by identifier, including its full `data` payload (the filled form-data blueprint). Use to inspect submitted values, or to seed a follow-up `update`.

### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<policyIdentifier>` | yes | Policy GUID, from `list`. |

### Example

```bash
uip gov aops-policy get a1b2c3d4-0000-0000-0000-000000000001
```

### Data shape (--output json)

```json
{
  "Code": "AopsPolicyGet",
  "Data": {
    "identifier": "a1b2c3d4-0000-0000-0000-000000000001",
    "name": "Baseline StudioX Policy",
    "productName": "StudioX",
    "priority": 10,
    "availability": 1,
    "data": { "allowAnalytics": true, "maxProjects": 5 }
  }
}
```

`data`'s keys are kept exactly as they appear in the Form.io form (camelCase/kebab-case), not PascalCased — this payload is designed to round-trip into `update --input` unmodified.

## uip gov aops-policy create

Create a new governance policy for a product.

### Options

| Long | Value | Required | Description |
|---|---|---|---|
| `--name <name>` | string | **yes** | Human-readable policy name (unique within the product). |
| `--product-name <product-name>` | string | **yes** | Target product (e.g. `StudioX`, `AITrustLayer`) — must match a name from `product list`. |
| `--description <description>` | string | no | Free-text description surfaced in the governance UI. |
| `--priority <n>` | integer | no | When multiple policies apply to the same subject, higher numbers win. |
| `--availability <n>` | integer | no | Availability flag (product-specific enum) — check the governance UI or service docs for valid values. |
| `--input <path>` | path | no | JSON file with the filled form-data object (from `template get --output-form-data`). Omit for a policy with no data payload. |

### Example

```bash
uip gov aops-policy create --name "Baseline StudioX Policy" --product-name StudioX --input form-data.json
```

### Data shape (--output json)

```json
{
  "Code": "AopsPolicyCreate",
  "Data": { "identifier": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Baseline StudioX Policy", "productName": "StudioX" }
}
```

The response echoes the raw (doubly-wrapped) data blob, not the flattened shape `get` returns — use `get` to produce form-data for a follow-up `update --input`.

## uip gov aops-policy update

Replace the fields of an existing policy. **Full update, not a patch** — every field you want to keep must be passed again; omitting `--description`/`--priority`/`--availability`/`--input` clears that field on the server.

### Options

| Long | Value | Required | Description |
|---|---|---|---|
| `--identifier <identifier>` | GUID | **yes** | Policy to update. From `list`/`get`. |
| `--name <name>` | string | **yes** | Policy name. Passing the existing name preserves it. |
| `--product-name <product-name>` | string | **yes** | Must match the policy's existing product — changing product on update is not supported. |
| `--description <description>` | string | no | Full-replace: re-pass the existing value from `get` to preserve it. |
| `--priority <n>` | integer | no | Full-replace: re-pass the existing value to preserve it. |
| `--availability <n>` | integer | no | Full-replace: re-pass the existing value to preserve it. |
| `--input <path>` | path | no | Full-replace: re-pass the existing `data` (saved from `get`) to preserve it. |

Fails with a "template upgrade in progress" error if the underlying Form.io template is being migrated — retry once it completes.

### Example

```bash
uip gov aops-policy update --identifier a1b2c3d4-0000-0000-0000-000000000001 --name "Baseline StudioX Policy" --product-name StudioX --input form-data.json
```

### Data shape (--output json)

Same shape as `create`, with `Code: "AopsPolicyUpdate"`.

## uip gov aops-policy delete

Permanently delete a governance policy.

:::note
Fails if the policy is still assigned to any tenant/user/group. Run [`deployment tenant\|user\|group remove`](./uip-gov-aops-policy-deployment.md) on every subject first, then retry.
:::

### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<policyIdentifier>` | yes | Policy GUID, from `list`. |

### Example

```bash
uip gov aops-policy delete a1b2c3d4-0000-0000-0000-000000000001
```

### Data shape (--output json)

```json
{ "Code": "AopsPolicyDelete", "Data": { "Status": "Deleted", "identifier": "a1b2c3d4-0000-0000-0000-000000000001" } }
```

## uip gov aops-policy product

Read-only catalog of products that publish governance templates. Use to discover valid `--product-name` values.

### uip gov aops-policy product list

#### Example

```bash
uip gov aops-policy product list
```

#### Data shape (--output json)

```json
{
  "Code": "AopsProductList",
  "Data": [
    { "identifier": "a1b2c3d4-0000-0000-0000-0000000000B1", "name": "StudioX", "label": "Studio X" }
  ]
}
```

`name` is what `policy create --product-name`, `template get <productIdentifier>`, and `deployment ... configure` entries expect; `label` is the display name.

### uip gov aops-policy product get

#### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<productIdentifier>` | yes | Product name (e.g. `StudioX`) or GUID — either `name` or `identifier` from `product list`. |

#### Example

```bash
uip gov aops-policy product get StudioX
```

#### Data shape (--output json)

```json
{ "Code": "AopsProductGet", "Data": { "identifier": "a1b2c3d4-0000-0000-0000-0000000000B1", "name": "StudioX", "label": "Studio X" } }
```

## uip gov aops-policy license-type

Read-only catalog of license types (e.g. Attended, Unattended) — used to scope `deployment tenant configure` entries and as the `<license-type>` argument to `deployed-policy get`/`list`.

### uip gov aops-policy license-type list

#### Example

```bash
uip gov aops-policy license-type list
```

#### Data shape (--output json)

```json
{
  "Code": "AopsLicenseTypeList",
  "Data": [
    { "identifier": "a1b2c3d4-0000-0000-0000-0000000000A1", "name": "Attended" },
    { "identifier": "a1b2c3d4-0000-0000-0000-0000000000A2", "name": "Unattended" }
  ]
}
```

The `identifier` feeds `deployment tenant configure` entries; the display `name` is what `deployed-policy get`/`list` accept as `<license-type>`.

## uip gov aops-policy template

Generates the fillable form-data blueprint (and a human-readable reference) from a product's Form.io policy template — the source of a policy's `data` payload.

### uip gov aops-policy template get

Fetch the active Form.io template for one product and emit policy artifacts.

#### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<productIdentifier>` | yes | Product name or identifier (e.g. `StudioX`). |

#### Options

| Long | Value | Description |
|---|---|---|
| `--output-form-data <path>` | path | Write the fillable form-data blueprint JSON — the object you edit and submit back on `create`/`update`. Display-only components (hidden, button, submit, HTML, content) are skipped; missing leaves get type-appropriate defaults (`false` for checkbox, `[]` for editgrid, `{}` for selectboxes, `null` for text/select). |
| `--output-template-locale-resource <path>` | path | Write a locale-resolved human-readable reference: every product-scoped locale key is replaced with its English string (with a sibling `<prop>-key` preserving the original), and `defaultData.data` becomes a flat annotated map (`{ value, type, label, description?, tooltip? }`). Cross-product prefixes (e.g. `AutomationOps.submit`) are left unresolved. |

If neither `--output-*` flag is passed, both the template and form-data are returned in the stdout `Data` payload instead.

#### Example

```bash
uip gov aops-policy template get StudioX --output-form-data form-data.json --output-template-locale-resource reference.json
```

#### Data shape (--output json)

```json
{
  "Code": "AopsPolicyTemplateGet",
  "Data": {
    "formDataFile": "/Users/alice/aops/form-data.json",
    "templateLocaleResourceFile": "/Users/alice/aops/reference.json"
  }
}
```

When no `--output-*` flag is passed, `Data` instead contains `template` (the raw Form.io DTO) and `formData` (the blueprint) directly — both preserve their native Form.io key casing rather than being PascalCased, so `formData` round-trips into `create`/`update --input` verbatim.

An `UnsupportedTemplateComponentError` (product's template uses a component type the CLI can't convert) fails with `ErrorCode: "configuration_error"` and `Retry: "RetryWillNotFix"` — author the policy `data` by hand in that case.

### uip gov aops-policy template list

Fetch every product's template and dump a full artifact set per product — use instead of looping `template get`.

#### Options

| Long | Value | Required | Description |
|---|---|---|---|
| `--output-dir <path>` | path | **yes** | Directory under which one `<ProductName>/` folder per product (containing `form-template.json`, `form-data.json`, `form-template-locale-resource.json`) is created. |

Per-product failures are collected and don't abort the run — the command exits non-zero only if every product fails.

#### Example

```bash
uip gov aops-policy template list --output-dir ./aops-templates
```

#### Data shape (--output json)

```json
{
  "Code": "AopsPolicyTemplateList",
  "Data": {
    "outputDir": "/Users/alice/aops-templates",
    "results": [
      {
        "productName": "StudioX",
        "status": "Success",
        "templateFile": "/Users/alice/aops-templates/StudioX/form-template.json",
        "formDataFile": "/Users/alice/aops-templates/StudioX/form-data.json",
        "templateLocaleResourceFile": "/Users/alice/aops-templates/StudioX/form-template-locale-resource.json"
      }
    ]
  }
}
```

A failed product's entry has `status: "Failure"` and a `message` field instead of the three file paths.

## Related

- [`uip gov`](./uip-gov.md) — tool overview and Access Policies.
- [`aops-policy deployment` and `deployed-policy`](./uip-gov-aops-policy-deployment.md) — assign policies to tenants/users/groups, resolve the effective policy.
- [`compliance-packs`](./uip-gov-compliance-packs.md) — bundle policies into a named framework.

## See also

- [Tools (plugins)](./concepts-tools.md)
- [Global options](./global-options.md)
- [Exit codes](./exit-codes.md)