Policy API controller