Fetch a policy
Requires policy:manage.
Authorizations
A machine credential, qk_ followed by its secret. Only a hash of the
secret is stored, so a key is displayed exactly once, when it is created
or rotated. A key reaches only the configurations it is linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Path Parameters
The policy statement's id.
Response
The policy.
Deny always wins, and the default with no statement at all is to refuse.
allow, deny The kinds of principal a policy statement or a clearance grant may name.
An audit record may additionally carry anonymous or system.
user, api_key, role A user id, an API key id, or a role name, according to
principal_type.
1An exact action, a namespace wildcard such as kms:*, or * for
everything. A namespace wildcard must name a namespace that exists, and
only an administrator may write *.
encrypt, decrypt, kms:read, kms:create, kms:update, kms:import, kms:export, kms:rotate, kms:revoke, kms:restore, classification:read, classification:manage, configuration:read, configuration:manage, apikey:manage, user:manage, policy:manage, audit:read, audit:export, audit:purge, kms:*, classification:*, configuration:*, apikey:*, user:*, policy:*, audit:*, * 1What the statement applies to. Either *, the bare words audit or
system, or one of the prefixed forms: configuration:<slug>,
key:<uuid>, classification:<slug>, audit:<name> or
system:<name>. Each prefix also takes * in place of the name, so
configuration:* covers every configuration.