---
title: "GET /policy-engines/{policyEngineId}/policies"
method: GET
path: "/policy-engines/{policyEngineId}/policies"
---

# GET /policy-engines/{policyEngineId}/policies

`GET /policy-engines/{policyEngineId}/policies`

Retrieves a list of policies within the AgentCore Policy engine. This operation supports pagination and filtering to help administrators manage and discover policies across policy engines. Results can be filtered by policy engine or resource associations.

## Path parameters

- `policyEngineId` string, required

## Query parameters

- `nextToken` string
- `maxResults` integer
- `targetResourceScope` string

## Response `200`

Success

- ListPoliciesResponse
  - `policies` Policy[], required — An array of policy objects that match the specified criteria. Each policy object contains the policy metadata, status, and key identifiers for further operations.
    - `policyId` string, required — The unique identifier for the policy. This system-generated identifier consists of the user name plus a 10-character generated suffix and serves as the primary key for policy operations.
    - `name` string, required — The customer-assigned immutable name for the policy. This human-readable identifier must be unique within the account and cannot exceed 48 characters.
    - `policyEngineId` string, required — The identifier of the policy engine that manages this policy. This establishes the policy engine context for policy evaluation and management.
    - `createdAt` string, date-time, required — The timestamp when the policy was originally created. This is automatically set by the service and used for auditing and lifecycle management.
    - `updatedAt` string, date-time, required — The timestamp when the policy was last modified. This tracks the most recent changes to the policy configuration or metadata.
    - `policyArn` string, required — The Amazon Resource Name (ARN) of the policy. This globally unique identifier can be used for cross-service references and IAM policy statements.
    - `status` 'CREATING' | 'ACTIVE' | 'UPDATING' | 'DELETING' | 'CREATE_FAILED' | 'UPDATE_FAILED' | 'DELETE_FAILED', required — The current status of the policy.
    - `enforcementMode` 'ACTIVE' | 'LOG_ONLY' — The current enforcement mode of the policy.
    - `definition` object, required — The Cedar policy statement that defines the access control rules. This contains the actual policy logic used for agent behavior control and access decisions.
      - `cedar` object — The Cedar policy definition within the policy definition structure. This contains the Cedar policy statement that defines the authorization logic using Cedar's human-readable, analyzable policy language. Cedar policies specify principals (who can access), actions (what operations are allowed), resources (what can be accessed), and optional conditions for fine-grained control. Cedar provides a formal policy language designed for authorization with deterministic evaluation, making policies testable, reviewable, and auditable. All Cedar policies follow a default-deny model where actions are denied unless explicitly permitted, and forbid policies always override permit policies.
        - `statement` string, required — The Cedar policy statement that defines the authorization logic. This statement follows Cedar syntax and specifies principals, actions, resources, and conditions that determine when access should be allowed or denied.
      - `policyGeneration` object — The generated policy asset information within the policy definition structure. This contains information identifying a generated policy asset from the AI-powered policy generation process within the AgentCore Policy system. Each asset contains a Cedar policy statement generated from natural language input, along with associated metadata and analysis findings to help users evaluate and select the most appropriate policy option.
        - `policyGenerationId` string, required — The unique identifier for this policy generation request.
        - `policyGenerationAssetId` string, required — The unique identifier for this generated policy asset within the policy generation request.
      - `policy` object — An AgentCore policy statement that defines the access control rules. The statement can be a Cedar policy or a guardrails definition.
        - `statement` string, required — The body of the AgentCore policy statement. Contains the policy logic, which can be a Cedar policy or a guardrails definition.
    - `description` string, password — A human-readable description of the policy's purpose and functionality. Limited to 4,096 characters, this helps administrators understand and manage the policy.
    - `statusReasons` String[], required — Additional information about the policy status. This provides details about any failures or the current state of the policy lifecycle.
  - `nextToken` string — A pagination token that can be used in subsequent ListPolicies calls to retrieve additional results. This token is only present when there are more results available.

## Other responses

- `480` — AccessDeniedException
- `481` — ValidationException
- `482` — ThrottlingException
- `483` — ResourceNotFoundException
- `484` — InternalServerException

---

[API](https://skmtc.net/aws/apis/bedrock-agentcore-control.md) · [All operations](https://skmtc.net/aws/apis/bedrock-agentcore-control/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/bedrock-agentcore-control/revisions/0ebde766792b/schema)