---
title: "Get one session policy"
method: GET
path: "/wallets/{address}/policies/{policyId}"
tags: ["Policies"]
---

# Get one session policy

`GET /wallets/{address}/policies/{policyId}`

## Response `200`

The policy.

- SessionPolicy
  - `id` string, required — ULID identifier (26-char Crockford base32).
  - `runner` string, required — Lowercase or checksummed hex EOA / contract address.
  - `chainId` integer, required — Numeric chain ID (e.g. 11155111 for Sepolia, 8453 for Base). On chain-aware trigger/node configs this is required and must be a configured chain; on query/filter params it is optional.
  - `status` 'pending' | 'active' | 'revoked', required — pending = signed and stored, install not yet on-chain (revocable for free). active = install applied. revoked = grants nothing.
  - `entityId` integer, required
  - `sessionSigner` string, required — Lowercase or checksummed hex EOA / contract address.
  - `agentLabel` string, required
  - `justification` string
  - `allowedActions` AllowedAction[]
    - `target` string, required — Lowercase or checksummed hex EOA / contract address.
    - `selectors` string[], required — 4-byte function selectors permitted on the target.
  - `erc20SpendCap` Erc20SpendCap — Cumulative ERC-20 spend cap, enforced on-chain at execution. The token must appear as an `allowedActions` target.
    - `token` string, required — Lowercase or checksummed hex EOA / contract address.
    - `amount` string, required — Total cap in the token's smallest unit (decimal string, no reset).
  - `validUntil` integer, required — Unix milliseconds.
  - `createdAt` integer, required — Unix milliseconds.
  - `onChainCleanup` OnChainRevokeCleanup — Owner-executable call that clears an applied grant's validation entity and hooks from the runner. Production grants are policied: the gateway controller cannot self-uninstall (allowlist blocks uninstallValidation). The owner sends this as a plain transaction to `target` (or a UserOp validated by the owner fallback). Derived from the retained `Grant.InstallCall`, never from live permission structs.
    - `entityId` integer, required — Validation entity this cleanup removes.
    - `target` string, required — Lowercase or checksummed hex EOA / contract address.
    - `callData` string, required — Arbitrary-length hex-encoded byte string.
    - `chainId` integer, required — Chain the runner lives on.

## Other responses

- `401` — Missing or invalid bearer token.
- `403` — Authenticated but not permitted.
- `404` — Resource not found.

---

[API](https://skmtc.net/avaprotocol/apis/ava-protocol-avs-api.md) · [All operations](https://skmtc.net/avaprotocol/apis/ava-protocol-avs-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/avaprotocol/ava-protocol-avs-api/versions/231d563f2c9f/schema)