Skip to main content
GET
Fetch a policy

Authorizations

X-Qanapi-Authorization
string
header
required

A machine credential, qk_ followed by its secret. Only a hash of the secret is stored, so a key is displayed exactly once, when it is created or rotated. A key reaches only the configurations it is linked to.

It may also be sent as Authorization: Bearer qk_..., which is recognised by the prefix.

Path Parameters

id
string<uuid>
required

The policy statement's id.

Response

The policy.

id
string<uuid>
required
name
string
required
description
string | null
required
effect
enum<string>
required

Deny always wins, and the default with no statement at all is to refuse.

Available options:
allow,
deny
principal_type
enum<string>
required

The kinds of principal a policy statement or a clearance grant may name. An audit record may additionally carry anonymous or system.

Available options:
user,
api_key,
role
principal_id
string
required

A user id, an API key id, or a role name, according to principal_type.

actions
enum<string>[]
required
Minimum array length: 1

An exact action, a namespace wildcard such as kms:*, or * for everything. A namespace wildcard must name a namespace that exists, and only an administrator may write *.

Available options:
encrypt,
decrypt,
kms:read,
kms:create,
kms:update,
kms:import,
kms:export,
kms:rotate,
kms:revoke,
kms:restore,
classification:read,
classification:manage,
configuration:read,
configuration:manage,
apikey:manage,
user:manage,
policy:manage,
audit:read,
audit:export,
audit:purge,
kms:*,
classification:*,
configuration:*,
apikey:*,
user:*,
policy:*,
audit:*,
*
resources
string[]
required
Minimum array length: 1

What the statement applies to. Either *, the bare words audit or system, or one of the prefixed forms: configuration:<slug>, key:<uuid>, classification:<slug>, audit:<name> or system:<name>. Each prefix also takes * in place of the name, so configuration:* covers every configuration.

created_at
string<date-time>
required