Group Policy Search

API

Verification API for AI agents

This API is designed for AI agents, not browsers. It is a verification service, not another way to browse the directory.

Before writing a registry value across a fleet, an agent can verify whether it is valid for the target OS, whether an Intune equivalent exists, and which scope applies. The value is not merely knowing Microsoft’s public documentation; models already know much of it. The value is proving an answer with provenance, a source version and a freshness date.

Founding rule

Never fill an absence with an assumption.

A compatibility request for 22H2 without an OS family does not produce a verdict. 22H2 identifies build 10.0.19045 on Windows 10 and build 10.0.22621 on Windows 11. The API returns verdict: "unknown", both candidates, and how the agent can disambiguate the request.

Measured coverage

Dataset 6a69d203, measured on July 29, 2026. These are coverage boundaries, not estimates.

Indicator Value
settings per language 9,657 (2 languages)
registry key + value pairs per language 16,497
Intune (CSP) mappings per language 2,458 (25.5 %)
settings with no Intune equivalent 7,199
active sources 14 / 16 declared

Endpoints

Base URL: https://api.gporais.com

Method Path Verification performed
POST /v1/resolve Registry key to setting, with a compatibility verdict
POST /v1/csp OMA-URI to setting and registry key
POST /v1/search Text query to settings
GET /v1/setting/{slug} Complete setting record
GET /v1/health Service status and dataset version; no authentication

Response envelope

Every authenticated response carries the same six top-level fields so an agent can distinguish evidence, inference and uncertainty.

Field Guarantee
query The normalized request the API actually evaluated.
result Matches, the requested record, or a reason when no mapping exists.
confidence official means Microsoft states the mapping; derived means GPORais inferred it; none means no Intune mapping exists. none is an answer, not an error, and always comes with result.reason.
provenance The source, its version and the Microsoft Learn URL when one exists.
dataset The dataset version and generation date on every response. This is the freshness evidence.
warnings Facts the API noticed without deciding in place of the agent.

result.compatibility

Compatibility has four explicit verdicts. None is a guess.

Verdict Meaning
supported The target build meets the documented minimum.
unsupported The target build does not meet the documented minimum.
unverified A minOs value exists, but it contains no readable build number.
unknown The target OS is missing, unrecognized or ambiguously labelled.

requiredBuildAlternatives — requiredBuildAlternatives appears only when Microsoft lists several minimum builds.

Examples

The response excerpts below come from production dataset 6a69d203. Long arrays are shortened by omitting entries; shown fields and values are unchanged.

Authentication

Send the access key in the X-API-Key header. The health endpoint is public.

PowerShell

Invoke-RestMethod -Uri 'https://api.gporais.com/v1/resolve' -Method Post -Headers @{'X-API-Key'='YOUR_API_KEY'; 'Content-Type'='application/json'} -Body '{"key":"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Uninstall","value":"noaddfromcdorfloppy","lang":"en-US","targetOs":"Windows 10 22H2"}'

curl

curl -X POST 'https://api.gporais.com/v1/resolve' -H 'X-API-Key: YOUR_API_KEY' -H 'Content-Type: application/json' --data '{"key":"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Uninstall","value":"noaddfromcdorfloppy","lang":"en-US","targetOs":"Windows 10 22H2"}'

Registry resolution with a supported verdict

Put the exact registry path in the request body; the API normalizes the key, extracts the hive, and shows that normalized query in `query`.

Request

{
  "key": "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Uninstall",
  "value": "noaddfromcdorfloppy",
  "lang": "en-US",
  "targetOs": "Windows 10 22H2"
}

PowerShell

Invoke-RestMethod -Uri 'https://api.gporais.com/v1/resolve' -Method Post -Headers @{'X-API-Key'='YOUR_API_KEY'; 'Content-Type'='application/json'} -Body '{"key":"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Uninstall","value":"noaddfromcdorfloppy","lang":"en-US","targetOs":"Windows 10 22H2"}'

curl

curl -X POST 'https://api.gporais.com/v1/resolve' -H 'X-API-Key: YOUR_API_KEY' -H 'Content-Type: application/json' --data '{"key":"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Uninstall","value":"noaddfromcdorfloppy","lang":"en-US","targetOs":"Windows 10 22H2"}'

Response excerpt

{
  "query": {
    "key": "software\\microsoft\\windows\\currentversion\\policies\\uninstall",
    "value": "noaddfromcdorfloppy",
    "lang": "en-US",
    "hive": "HKCU",
    "targetOs": "Windows 10 22H2"
  },
  "result": {
    "matches": [
      {
        "slug": "addremoveprograms-noaddfromcdorfloppy",
        "lang": "en-US",
        "name": "NoAddFromCDorFloppy",
        "displayName": "Hide the \"Add a program from CD-ROM or floppy disk\" option",
        "class": "User",
        "registryKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Uninstall",
        "valueName": "NoAddFromCDorFloppy",
        "source": "windows",
        "sourceVersion": "Windows 11 25H2",
        "confidence": "official"
      }
    ],
    "compatibility": {
      "verdict": "supported",
      "reason": "target build 10.0.19045 (Windows 10 22H2) meets minimum 10.0.19041.1202",
      "targetBuild": "10.0.19045",
      "requiredBuild": "10.0.19041.1202",
      "requiredBuildAlternatives": [
        "10.0.19041.1202",
        "10.0.19042.1202",
        "10.0.19043.1202",
        "10.0.22000"
      ]
    }
  },
  "confidence": "official",
  "provenance": {
    "source": "windows",
    "sourceVersion": "Windows 11 25H2"
  },
  "dataset": {
    "version": "6a69d203",
    "generatedAt": "2026-07-29T10:12:19Z"
  },
  "warnings": []
}

Ambiguous OS label: no invented verdict

With targetOs set only to 22H2, the response identifies the two possible Windows families and explains how to decide.

Response excerpt

{
  "query": {
    "key": "software\\microsoft\\windows\\currentversion\\policies\\uninstall",
    "value": "noaddfromcdorfloppy",
    "lang": "en-US",
    "hive": "HKCU",
    "targetOs": "22H2"
  },
  "result": {
    "compatibility": {
      "verdict": "unknown",
      "reason": "version 22H2 ambigue : Windows 10 (10.0.19045) ou Windows 11 (10.0.22621). Precisez la famille (ex. \"Windows 10 22H2\") ou fournissez le numero de build."
    }
  },
  "confidence": "official",
  "dataset": {
    "version": "6a69d203",
    "generatedAt": "2026-07-29T10:12:19Z"
  },
  "warnings": []
}

Two settings write the same registry pair

The API returns both matches and warns the agent instead of selecting one on its behalf. This preserved ambiguity is evidence, not a weakness.

Response excerpt

{
  "query": {
    "key": "software\\policies\\microsoft\\windows\\windowsupdate\\au",
    "value": "noautoupdate",
    "lang": "en-US",
    "hive": "HKLM",
    "targetOs": null
  },
  "result": {
    "matches": [
      {
        "slug": "wuau-autoupdatecfg",
        "displayName": "Configure Automatic Updates",
        "registryKey": "Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU",
        "valueName": "NoAutoUpdate",
        "sourceVersion": "Windows 11 25H2",
        "confidence": "official"
      },
      {
        "slug": "icm-internetmanagement-restrictcommunication-2",
        "displayName": "Restrict Internet communication",
        "registryKey": "Software\\Policies\\Microsoft\\InternetManagement",
        "valueName": "RestrictCommunication",
        "sourceVersion": "Windows 11 25H2",
        "confidence": "official"
      }
    ],
    "compatibility": {
      "verdict": "unknown",
      "reason": "aucun OS cible fourni"
    }
  },
  "confidence": "official",
  "dataset": {
    "version": "6a69d203",
    "generatedAt": "2026-07-29T10:12:19Z"
  },
  "warnings": [
    "The registry pair HKLM\\software\\policies\\microsoft\\windows\\windowsupdate\\au\\noautoupdate is written by 2 parameters: wuau-autoupdatecfg, icm-internetmanagement-restrictcommunication-2. Returning all matches and letting the agent choose."
  ]
}

Resolve an OMA-URI

The CSP endpoint returns the corresponding setting and registry write. This is an excerpt of the recorded production response.

Request

{
  "omaUri": "./device/vendor/msft/policy/config/admx_externalboot/portableoperatingsystem_hibernate",
  "lang": "en-US",
  "scope": "Device"
}

Response excerpt

{
  "query": {
    "omaUri": "./device/vendor/msft/policy/config/admx_externalboot/portableoperatingsystem_hibernate",
    "lang": "en-US",
    "scope": "Device"
  },
  "result": {
    "matches": [
      {
        "displayName": "Allow hibernate (S4) when starting from a Windows To Go workspace",
        "class": "Machine",
        "registryKey": "System\\CurrentControlSet\\Policies\\Microsoft\\PortableOperatingSystem",
        "valueName": "Hibernate",
        "source": "windows",
        "sourceVersion": "Windows 11 25H2",
        "confidence": "official",
        "csp": {
          "scope": "Device",
          "minOs": "Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later | Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later | Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later | Windows 11, version 21H2 [10.0.22000] and later"
        }
      }
    ]
  },
  "confidence": "official",
  "provenance": {
    "source": "windows",
    "sourceVersion": "Windows 11 25H2"
  },
  "dataset": {
    "version": "6a69d203",
    "generatedAt": "2026-07-29T10:12:19Z"
  },
  "warnings": []
}

Search for settings

Use a setting token that returns results, such as DisableSearchHistory. This example shows the request only because the supplied recorded search response used a different query that returned no result.

Request

{
  "q": "DisableSearchHistory",
  "lang": "en-US",
  "limit": 3
}

Access, limits and documented boundaries

Aspect Rule
Authentication Authentication uses the X-API-Key header. GET /v1/health remains public.
Rate limiting The limit is 120 requests per minute per IP address.
Errors Errors use the RFC 9457 problem details format.
Requesting a key There is no self-service signup. Request access through the existing contact details on the About page. No additional form or personal-data collection is used.
Billing There is no billing at this time.
Coverage Intune coverage is 25.5%: 2,458 mappings per language. This is a documented boundary. For 7,199 settings, answering “no Intune equivalent exists, and here is why” is the service being delivered.
Independence GPORais is an independent technical resource and is not affiliated with or endorsed by Microsoft.