canonical: https://jentic.com/apis/policyforge.co/policyforge # PolicyForge API The PolicyForge API generates draft privacy policies, terms of service, cookie policies, and refund policies from a short description of your business, its jurisdiction, and the data it collects. Drafts can be retrieved, edited, published, and hosted on a PolicyForge page, and every policy carries a lifecycle status of draft, published, or archived. A consent ledger records which cookie and data categories each website visitor accepted, filterable by policy, banner, source, and date for later compliance audits. Generated content is not legal advice and should be reviewed before publication. ## For AI agents Generate privacy, terms, cookie, and refund policy drafts for a business, publish and host them, and record or look up visitor consent records for compliance audits. ## Scope Does not provide legal advice, run cookie scanning, or manage security compliance frameworks such as SOC 2. Use for generating and hosting policy documents and recording visitor consent only. ## Capabilities - Generate a privacy policy, terms of service, cookie policy, or refund policy draft from business_type, jurisdiction, and data_collection inputs - Edit a policy's title or content and move it between draft, published, and archived status - Turn on hosting_enabled to publish a policy on a PolicyForge-hosted page - Record a visitor's consent choices per category against a policy_version - Audit consent records by end_user_id, policy_id, banner_config_id, source, or recorded date range - Delete a single consent record to honour an erasure request ## Use cases ### Agent-drafted policies through Jentic A developer launching a new product asks their agent for a privacy policy that matches the stack. Through Jentic the agent finds the PolicyForge generate operation by intent, fills type, business_type, jurisdiction, company_name, and contact_email, and returns a draft for human review. The bearer key is injected at call time, so the agent never holds it, and a rule can keep it to drafting and reading without the delete operations. Example prompt: Call POST `/api/v1/policies` with type privacy_policy, business_type saas, jurisdiction gdpr, company_name Acme Inc, and contact_email privacy@acme.com, then fetch the draft with GET `/api/v1/policies/{policyId}` ### Publish and host a reviewed policy Once a lawyer or founder has reviewed a draft, the policy needs to go live at a stable URL. PolicyForge lets a client update the title or content, set status to published, and switch hosting_enabled on so the policy is served from a PolicyForge-hosted page. Archiving an outdated version keeps the history without deleting it. Example prompt: Call PATCH `/api/v1/policies/{policyId}` with status published and hosting_enabled true, then confirm the change with GET `/api/v1/policies/{policyId}` ### Consent logging at checkout A checkout flow must prove that each buyer agreed to the terms in force at the time. POST `/api/v1/consent` stores the visitor's user_id, the policy_version, a map of consent categories, and optional ip_address and user_agent for the audit trail. Records tied to a policy_id show up under that policy and can be filtered later. Example prompt: Call POST `/api/v1/consent` with user_id visitor_abc123, policy_version v2.1, and consents essential true, analytics true, marketing false ### Consent audit and erasure requests When a regulator or customer asks for proof of consent, the consent list can be filtered by end_user_id, policy_id, banner_config_id, consent source, and a from and to date range, with cursor pagination up to 200 records per page. For an erasure request, a single consent record can be removed by its record id. Example prompt: Call GET `/api/v1/consent` with end_user_id visitor_abc123, page through next_cursor, and report each recorded consent map ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | `/api/v1/policies` | Generate a policy draft | | GET | `/api/v1/policies` | List policies with status and type filters | | GET | `/api/v1/policies/{policyId}` | Get a policy with content and hosting info | | PATCH | `/api/v1/policies/{policyId}` | Update title, content, status, or hosting | | POST | `/api/v1/consent` | Record visitor consent | | GET | `/api/v1/consent` | List and filter consent records | | GET | `/api/v1/consent/{userId}` | Get consent records for a visitor | ## Key resources - **Policies** — Generate, list, retrieve, update, publish, host, and delete privacy, terms, cookie, and refund policies - **Consent records** — Record visitor consent, list and filter consent history, look up a visitor's records, and delete a single record - **Hosted-policy consent** — Public endpoint that logs an 'I Agree' consent event against a published, hosting-enabled policy ## AI readiness This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use. - **Score:** 71 / 100 - **Maturity:** AI-Aware - **Dimensions:** - Foundational Compliance: 93 / 100 - Developer Experience & Jentic Compatibility: 67 / 100 - AI-Readiness & Agent Experience: 56 / 100 - Agent Usability: 94 / 100 - Security: 60 / 100 - AI Discoverability: 79 / 100 - **View full report:** https://jentic.com/apis/policyforge.co/policyforge/scorecard - **How the score is calculated:** https://docs.jentic.com/reference/api-readiness-framework/overview/ - **More about the dimensions:** https://docs.jentic.com/reference/api-readiness-framework/specification/#dimensional-model-overview ### Score it yourself Every API in the directory is allowlisted, so you can re-score it with no key required. - **Score your own API:** https://jentic.com/scorecard.md - **Scoring CLI agent skill:** https://github.com/jentic/jentic-api-scorecard/blob/main/skills/jentic-api-scorecard/SKILL.md ```sh npx @jentic/api-scorecard-cli score ``` ## Why Jentic - **Setup:** Wiring PolicyForge by hand means minting a pf_live_ key in the dashboard, sending it as a bearer token, handling per-tier X-RateLimit headers, and remembering that the hosted-consent endpoint takes no key at all. Through Jentic you install once, import PolicyForge from the API Directory, store the key once, and your agent calls it. - **Permission scoping:** PolicyForge puts the policy id in the URL path (`/api/v1/policies/{policyId}`), so a rule can pin your agent to one policy and the operations you pick. You choose what it may call, so destructive ones like deleting a policy or deleting consent records are not included unless you add them. - **Credential handling:** Your PolicyForge API key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'generate a privacy policy' or 'look up consent for a visitor', and Jentic returns the matching PolicyForge operation with its input schema, including the type and jurisdiction enums, so the agent fills the request correctly. ## Related APIs - **Osano Consent Management API** — Dedicated consent management platform for cookie banners and consent records - **iubenda** — Privacy and cookie policy service with consent tooling - **Secureframe API** — Compliance automation for frameworks such as SOC 2 and ISO 27001 ## FAQ ### What authentication does the PolicyForge API use? The PolicyForge API authenticates with a bearer token per its OpenAPI spec: you generate an API key in the PolicyForge API Dashboard and send it in the Authorization header as Bearer pf_live_.... One endpoint, POST `/api/v1/consent/policy/{policyId}/record`, is public and needs no key because the owner is derived from the hosted policy. Through Jentic the key is stored by your own instance and attached at call time. ### Can I generate a GDPR privacy policy with the PolicyForge API? Yes. POST `/api/v1/policies` takes a type such as privacy_policy, terms_of_service, cookie_policy, or refund, a business_type, a jurisdiction such as gdpr, ccpa, or uk, plus company_name and contact_email. Optional fields like data_collection, third_party_integrations, and data_retention shape the draft. PolicyForge notes that generated content is not legal advice, so review it before publishing. ### What are the rate limits for the PolicyForge API? The PolicyForge OpenAPI spec lists per-tier limits: Free at 10 requests per minute and 100 per day, Pro at 60 per minute and 5,000 per day, and Enterprise at 300 per minute and 50,000 per day. Every response includes X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers so a client can back off before hitting the ceiling. ### Is there a PolicyForge MCP server? You don't need an MCP server to give your agent PolicyForge. Jentic connects it directly from the API Directory: import it, store your API key once, and your agent calls the policy and consent operations it needs, discovered on demand rather than loaded into its context up front. ### Can I limit what my agent is allowed to do with PolicyForge? Yes. For example, write a rule that allows only POST `/api/v1/policies` and GET `/api/v1/policies/{policyId}`, so the agent can draft and read policies but cannot publish, delete, or touch consent records. Because policy ids sit in the URL path, you can also pin the update operation to one policyId, and every call the agent makes is logged. ### How do I record visitor consent with PolicyForge through Jentic? Search Jentic for 'record user consent for a privacy policy', load the POST `/api/v1/consent` operation, and send user_id, policy_version, and a consents map such as essential true and marketing false, optionally with a policy_id. To run it on your own infrastructure, install Jentic One from its GitHub repo.