Get an approval policy

Needs policies:read. A policy in another environment is reported as not found.

GET/api/v2/approval-policies/{policyId}

Authorization

AuthorizationBearer token (Anlyon API key) · headerrequired

Workspace API key sent as Authorization: Bearer <key>.

better-auth.session_tokenAPI key · cookierequired

Browser session used by dashboard-only operations.

Path parameters

policyIdstringrequired

Public approval-policy id (apol_xxx).

Header parameters

X-Request-Idstring

Optional caller correlation ID. Unsafe or oversized values are replaced.

max length 128

Responses

200

A single approval policy.

successbooleanrequired

Allowed:true

dataApprovalPolicyrequired

Show properties

idstringrequired

Public policy id (apol_xxx).

environmentIdstring<uuid>required

The environment the policy governs. Policies never span environments.

namestringrequired

priorityintegerrequired

Lower runs first. Ties are broken by creation time, then by id, so the order is always deterministic.

enabledbooleanrequired

scopestringrequired

What the policy applies to, derived from match. Never inferred from the name.

Allowed:specific_actionall_actionscustom_requestsall_requests

needsScopeReviewbooleanrequired

True on a broad policy nobody has confirmed the scope of. Every policy created before explicit targeting is in this state, because the old form sent no action selector. Preserved as it was, and flagged.

matchApprovalPolicyMatchrequired

Show properties

kindstringrequired

Allowed:anyactioncustom

actionNamestring | nullrequired

agentIdstring | nullrequired

userIdstring | nullrequired

tagsstring[] | nullrequired

minAmountnumber | nullrequired

conditionsobject | nullrequired

conditionstring | nullrequired

A CEL expression (https://cel.dev) that must also hold, over input, agent.id, user.id, tags, action.name and kind. Checked against the target action's input schema when saved. An evaluation error (for example a missing field) requires approval rather than skipping the policy; guard optional fields with has().

effectstringrequired

Allowed:require_approvalauto_approveauto_deny

requiredApprovalsintegerrequired

Distinct approvers needed (N-of-M).

versionintegerrequired

Bumps on each edit; recorded on approvals this policy governs.

scopeReviewedAtstring<date-time> | nullrequired

createdAtstring<date-time>required

updatedAtstring<date-time>required

managedByobject | null

Set when a policy file owns this policy. Console and API edits of it are refused; change the file.

Show properties

filestringrequired

keystringrequired

401

Unauthorized - Invalid or missing API key

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

403

Authenticated credential lacks the required scope or workspace access.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

404

Not Found - Resource does not exist

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

429

Too Many Requests - Rate limit exceeded

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer token (Anlyon API key)Remember on this deviceInclude my values in samples

Parameters

X-Request-IdheaderOptional caller correlation ID. Unsafe or oversized values are replaced.policyIdpath*Public approval-policy id (apol_xxx).

Request

curl -X GET 'https://api.anlyon.com/api/v2/approval-policies/string' \
  -H 'Authorization: Bearer YOUR_TOKEN'

const response = await fetch("https://api.anlyon.com/api/v2/approval-policies/string", {
  method: "GET",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN"
  }
});

import requests

response = requests.get(
    "https://api.anlyon.com/api/v2/approval-policies/string",
    headers={
        "Authorization": "Bearer YOUR_TOKEN"
    },
)

Response

{
  "success": true,
  "data": {
    "id": "string",
    "environmentId": "19f5cc2e-7657-437a-9268-83cd3d563563",
    "name": "string",
    "priority": 0,
    "enabled": true,
    "scope": "specific_action",
    "needsScopeReview": true,
    "match": {
      "kind": "any",
      "actionName": "string",
      "agentId": "string",
      "userId": "string",
      "tags": [
        "string"
      ],
      "minAmount": 0,
      "conditions": {},
      "condition": "string"
    },
    "effect": "require_approval",
    "requiredApprovals": 0,
    "version": 0,
    "scopeReviewedAt": "2019-08-24T14:15:22Z",
    "createdAt": "2019-08-24T14:15:22Z",
    "updatedAt": "2019-08-24T14:15:22Z",
    "managedBy": {
      "file": "string",
      "key": "string"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "AUTHENTICATION_ERROR",
    "message": "Invalid or missing API key"
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {}
  }
}

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

{
  "success": false,
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Rate limit exceeded. Please try again later."
  }
}