---
title: "List the wallet's session policies"
method: GET
path: "/wallets/{address}/policies"
tags: ["Policies"]
---

# List the wallet's session policies

`GET /wallets/{address}/policies`

Grant material (calldata, signatures) is never echoed.

## Response `200`

Policies for this wallet, newest first.

- SessionPolicyList
  - `items` SessionPolicy[], required
    - `id` string, required — ULID identifier (26-char Crockford base32).
    - `runner` string, required — Lowercase or checksummed hex EOA / contract address.
    - `chainId` integer, required — Numeric chain ID (e.g. 11155111 for Sepolia, 8453 for Base). On chain-aware trigger/node configs this is required and must be a configured chain; on query/filter params it is optional.
    - `status` 'pending' | 'active' | 'revoked', required — pending = signed and stored, install not yet on-chain (revocable for free). active = install applied. revoked = grants nothing.
    - `entityId` integer, required
    - `sessionSigner` string, required — Lowercase or checksummed hex EOA / contract address.
    - `agentLabel` string, required
    - `justification` string
    - `allowedActions` AllowedAction[]
      - `target` string, required — Lowercase or checksummed hex EOA / contract address.
      - `selectors` string[], required — 4-byte function selectors permitted on the target.
    - `erc20SpendCap` Erc20SpendCap — Cumulative ERC-20 spend cap, enforced on-chain at execution. The token must appear as an `allowedActions` target.
      - `token` string, required — Lowercase or checksummed hex EOA / contract address.
      - `amount` string, required — Total cap in the token's smallest unit (decimal string, no reset).
    - `validUntil` integer, required — Unix milliseconds.
    - `createdAt` integer, required — Unix milliseconds.
    - `onChainCleanup` OnChainRevokeCleanup — Owner-executable call that clears an applied grant's validation entity and hooks from the runner. Production grants are policied: the gateway controller cannot self-uninstall (allowlist blocks uninstallValidation). The owner sends this as a plain transaction to `target` (or a UserOp validated by the owner fallback). Derived from the retained `Grant.InstallCall`, never from live permission structs.
      - `entityId` integer, required — Validation entity this cleanup removes.
      - `target` string, required — Lowercase or checksummed hex EOA / contract address.
      - `callData` string, required — Arbitrary-length hex-encoded byte string.
      - `chainId` integer, required — Chain the runner lives on.

## Other responses

- `401` — Missing or invalid bearer token.
- `403` — Authenticated but not permitted.
- `404` — Resource not found.

---

[API](https://skmtc.net/avaprotocol/apis/ava-protocol-avs-api.md) · [All operations](https://skmtc.net/avaprotocol/apis/ava-protocol-avs-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/avaprotocol/ava-protocol-avs-api/revisions/231d563f2c9f/schema)