---
title: "GET /access-policies/{accessPolicyId}"
method: GET
path: "/access-policies/{accessPolicyId}"
---

# GET /access-policies/{accessPolicyId}

`GET /access-policies/{accessPolicyId}`

Describes an access policy, which specifies an identity's access to an IoT SiteWise Monitor portal or project.

## Path parameters

- `accessPolicyId` string, required

## Response `200`

Success

- DescribeAccessPolicyResponse
  - `accessPolicyId` string, required — The ID of the access policy.
  - `accessPolicyArn` string, required — <p>The <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">ARN</a> of the access policy, which has the following format.</p> <p> <code>arn:${Partition}:iotsitewise:${Region}:${Account}:access-policy/${AccessPolicyId}</code> </p>
  - `accessPolicyIdentity` object, required — The identity (IAM Identity Center user, IAM Identity Center group, or IAM user) to which this access policy applies.
    - `user` object — An IAM Identity Center user identity.
      - `id` string, required — The IAM Identity Center ID of the user.
    - `group` object — An IAM Identity Center group identity.
      - `id` string, required — The IAM Identity Center ID of the group.
    - `iamUser` object — An IAM user identity.
      - `arn` string, required — <p>The ARN of the IAM user. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html">IAM ARNs</a> in the <i>IAM User Guide</i>.</p> <note> <p>If you delete the IAM user, access policies that contain this identity include an empty <code>arn</code>. You can delete the access policy for the IAM user that no longer exists.</p> </note>
    - `iamRole` object — An IAM role identity.
      - `arn` string, required — The ARN of the IAM role. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html">IAM ARNs</a> in the <i>IAM User Guide</i>.
  - `accessPolicyResource` object, required — The IoT SiteWise Monitor resource (portal or project) to which this access policy provides access.
    - `portal` object — A portal resource.
      - `id` string, required — The ID of the portal.
    - `project` object — A project resource.
      - `id` string, required — The ID of the project.
  - `accessPolicyPermission` 'ADMINISTRATOR' | 'VIEWER', required — The access policy permission. Note that a project <code>ADMINISTRATOR</code> is also known as a project owner.
  - `accessPolicyCreationDate` string, date-time, required — The date the access policy was created, in Unix epoch time.
  - `accessPolicyLastUpdateDate` string, date-time, required — The date the access policy was last updated, in Unix epoch time.

## Other responses

- `480` — InvalidRequestException
- `481` — ResourceNotFoundException
- `482` — InternalFailureException
- `483` — ThrottlingException

---

[API](https://skmtc.net/aws/apis/iotsitewise.md) · [All operations](https://skmtc.net/aws/apis/iotsitewise/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/iotsitewise/versions/d13e5d3e0a6f/schema)