CURATION: How to Use Curation Waiver Requests to Unblock Packages

Introduction

This article explains how to submit, manage, and approve waiver requests for packages blocked by JFrog Curation policies, including how to create waivers via the API when no audit event exists.



Prerequisites

JFrog Curation is enabled and at least one Curation policy is active.

The package version is blocked by one or more Curation policies.

The requester has access to the curated repository.

Policy owners have been assigned to the relevant blocking policies.



Step 1: Understand Waiver Request Concepts

Goal: Understand how waiver requests are structured before submitting or reviewing one.

A waiver request is an exception mechanism that allows users to request access to a blocked package version. Key concepts:

Waivers are created per package version + repository, not per user. Multiple developers requesting a waiver for the same package in the same repository are recorded as requesters on a single shared waiver record.

Each requester is recorded with their username, email, individual justification text, and request timestamp.

A package may be blocked by more than one policy. Each blocking policy has its own independent approval decision.

All blocking policies must approve the waiver for it to take effect.

If any one policy owner rejects the waiver, it is rejected overall.

Waiver lifecycle:

Status	Description
Pending	Submitted; awaiting decision from one or more policy owners
Approved	All blocking policies have approved the waiver
Rejected	At least one policy owner has rejected the waiver
Expired	An approved time-limited waiver whose duration has passed



Step 2: Submit a Waiver Request

Goal: Create a waiver request for a blocked package version, either from the UI or via the API.



Option A — From the UI (Standard Path)

Use this path when the package version has already been attempted for download and an audit event exists.

Attempt to download or resolve the blocked package through a curated repository. The download is blocked and an audit event is recorded in the Curation audit log.

Navigate to Platform > Curation > Audit Log.

Locate the audit event for the blocked package.

Click the event to open it, then select Create New Request.

Enter a justification describing why the exception is needed.

```
Click Submit.
```

Limitation: The UI path requires an existing audit event. If the package version was never attempted for download, no audit event will exist and the UI path is unavailable. Use Option B in that case.



Option B — From the API (No Audit Event Required)

Use this path when the package version is not visible to the client at all and no audit event exists. The API performs its own policy evaluation internally.

Endpoint:

POST /xray/api/v1/curation/waiver_requests

Authentication: Bearer token or basic auth (user must have access to the curated repository).

Request body:

json

{
  "pkg_type": "nuget",
  "pkg_name": "microsoft.netcore.app.ref",
  "pkg_version": "8.0.28",
  "repo_key": "<curated-repo-key>",
  "reason": "<justification for the waiver>"
}



Step 3: Review and Approve a Waiver Request (Policy Owner)

Goal: Review pending waiver requests and approve or reject them for policies you own.

Navigate to Platform > Curation > Waiver Requests.

Filter by Pending status to view requests awaiting a decision.

Select a waiver request to open its details. Review:

Requesters — usernames, emails, and individual justifications submitted.

Blocking Policies — the policies blocking this package and their current decision status.

Package Details — package type, name, version, and repository.

For each policy you own, select an action:

Approve — set an expiry duration and confirm.

Reject — provide a reason for rejection.

Note:

Approving the waiver for your policy does not unblock the package if other policy owners have not yet approved. All blocking policies must be approved before the waiver takes effect.

Step 4: Verify the Waiver Is in Effect



Scenario 1: All Policies Approved (Package Unblocked)

A developer attempts to download the previously blocked package version through the curated repository after all policy owners have approved the waiver.

Expected Result:

The package resolves successfully. The waiver status in Platform > Curation > Waiver Requests shows Approved, and the download proceeds without a block event.



Scenario 2: One Policy Rejected (Package Still Blocked)

A developer attempts to download the package after one policy owner approved but another rejected.

Expected Result:

The download remains blocked. The waiver status shows Rejected. A new audit event may be recorded. The requester should address the rejection reason and consider submitting a new waiver or escalating to the rejecting policy owner.