policy and protectedhost api