List policies
Requires policy:manage. Both filters are optional and combine; with
neither, every statement is returned. Not paginated.
Authorizations
A machine credential, qk_ followed by its secret. Only a hash of the
secret is stored, so a key is displayed exactly once, when it is created
or rotated. A key reaches only the configurations it is linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Query Parameters
Return only statements binding this kind of principal.
The kinds of principal a policy statement or a clearance grant may name.
An audit record may additionally carry anonymous or system.
user, api_key, role Return only statements binding this principal: a user id, an API key
id, or a role name, according to principal_type.
Response
Matching policies.
Deny always wins, and the default with no statement at all is to refuse.
allow, deny The kinds of principal a policy statement or a clearance grant may name.
An audit record may additionally carry anonymous or system.
user, api_key, role A user id, an API key id, or a role name, according to
principal_type.
1An exact action, a namespace wildcard such as kms:*, or * for
everything. A namespace wildcard must name a namespace that exists, and
only an administrator may write *.
encrypt, decrypt, kms:read, kms:create, kms:update, kms:import, kms:export, kms:rotate, kms:revoke, kms:restore, classification:read, classification:manage, configuration:read, configuration:manage, apikey:manage, user:manage, policy:manage, audit:read, audit:export, audit:purge, kms:*, classification:*, configuration:*, apikey:*, user:*, policy:*, audit:*, * 1What the statement applies to. Either *, the bare words audit or
system, or one of the prefixed forms: configuration:<slug>,
key:<uuid>, classification:<slug>, audit:<name> or
system:<name>. Each prefix also takes * in place of the name, so
configuration:* covers every configuration.