Skip to main content
GET
List policies

Authorizations

X-Qanapi-Authorization
string
header
required

A machine credential, qk_ followed by its secret. The first twelve characters are an indexed prefix; the rest is compared in constant time against a stored SHA-256 hash. A key reaches only the configurations it is linked to.

It may also be sent as Authorization: Bearer qk_..., which is recognised by the prefix.

Query Parameters

principal_type
enum<string>

The kinds of principal a policy or a clearance grant may name. An audit record may additionally carry anonymous or system.

Available options:
user,
api_key,
role
principal_id
string

Response

Matching policies.

id
string<uuid>
required
name
string
required
effect
enum<string>
required

Deny always wins, and the default with no policy is deny.

Available options:
allow,
deny
principal_type
enum<string>
required

The kinds of principal a policy or a clearance grant may name. An audit record may additionally carry anonymous or system.

Available options:
user,
api_key,
role
principal_id
string
required
actions
string[]
required

Exact actions or namespace wildcards, for example kms:*. * grants everything and only an administrator may write it.

resources
string[]
required

Prefixed specifiers: container:<slug>, key:<uuid>, classification:<slug>, audit:, system:, or *.

created_at
string<date-time>
required
description
string | null