--- title: "List captured evaluation requests" method: GET path: "/zones/{zone_id}/policy-evaluations/requests" tags: ["PolicyEvaluations"] --- # List captured evaluation requests `GET /zones/{zone_id}/policy-evaluations/requests` Returns a paginated list of evaluation request entries captured from live credentials API traffic for the specified zone. Sorted by created_at descending (newest first). Use with the test evaluation endpoint for replay-based impact analysis. ## Path parameters - `zone_id` string, required ## Query parameters - `after` string — An opaque cursor used for paginating through a list of results - `before` string — An opaque cursor used for paginating through a list of results - `limit` integer - `expand[]` PdpExpandField[] - `sort` 'created_at' - `order` 'asc' | 'desc' - `query[action]` string[] — Value shape for `query[]` and `query[]` search parameters. Wire conventions: - Case-insensitive substring match (ILIKE). - Repeated parameter instances are OR-ed across terms. - Comma splitting is NOT performed; literal commas in a search term are preserved as part of the term. Examples: ?query[name]=alpha&query[name]=beta -> name ILIKE %alpha% OR name ILIKE %beta% ?query[]=alpha -> any searchable field ILIKE %alpha% Cross-field form is `query[]`; field-scoped form is `query[]`. Field names are endpoint-specific; services declare each query parameter per operation. - `filter[active_decision]` string[] — Value shape for `filter[]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[] parameter per operation with an appropriate items.type/items.enum override. - `filter[principal_type]` string[] — Value shape for `filter[]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[] parameter per operation with an appropriate items.type/items.enum override. - `filter[subject_type]` string[] — Value shape for `filter[]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[] parameter per operation with an appropriate items.type/items.enum override. - `filter[authority_type]` string[] — Value shape for `filter[]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[] parameter per operation with an appropriate items.type/items.enum override. - `filter[has_shadow]` boolean - `filter[principal_id]` string[] — Value shape for `filter[]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[] parameter per operation with an appropriate items.type/items.enum override. - `filter[resource_id]` string[] — Value shape for `filter[]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[] parameter per operation with an appropriate items.type/items.enum override. - `filter[subject_id]` string[] — Value shape for `filter[]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[] parameter per operation with an appropriate items.type/items.enum override. ## Headers - `X-API-Version` string - `X-Client-Request-ID` string, uuid ## Response `200` A paginated list of evaluation requests - PdpEvaluationRequestsList - `items` PdpEvaluationRequestItem[], required - `id` string, uuid, required — Unique identifier for this evaluation request entry. - `request_id` string, required — Correlation ID from the original credentials API request. - `principal_type` 'user' | 'application', required - `principal_id` string, required - `action` string, required - `resource_id` string, required - `subject_type` 'user' | 'application', nullable - `subject_id` string, nullable - `authority_type` 'delegation' | 'impersonation', nullable - `context` PdpEvaluationContext — Additional context for Cedar authorization evaluation. Fields here are mapped directly into the Cedar `context` record. - `scopes` string[] — OAuth scopes associated with the request. Mapped to `context.scopes` in the Cedar evaluation as a `Set`. - `session_id` string — Session identifier for the current authorization context. Mapped to `context.session_id` in Cedar. - `claims` PdpEvaluationClaims — Token claims for the actor and/or subject. Mapped to `context.actor_claims` and `context.subject_claims` in Cedar. - `actor` PdpClaimsData — Represents token claims passed into the Cedar context. Mapped to the Cedar `Keycard::Claims` type. Known fields (`email`, `groups`, `issuer_claims`) are typed; additional claims are passed through as untyped key-value pairs via `additionalProperties`. - `email` string — Email claim from the authentication token. - `groups` string[] — Group membership claims from the authentication token. - `issuer_claims` PdpIssuerClaims — Issuer-specific claims forwarded opaquely from STS (e.g. GHA OIDC assertion claims). Mapped to `context.actor_claims.issuer_claims` in Cedar. All fields are optional and issuer-dependent. See issuer documentation for available claim fields. - `subject` PdpClaimsData — Represents token claims passed into the Cedar context. Mapped to the Cedar `Keycard::Claims` type. Known fields (`email`, `groups`, `issuer_claims`) are typed; additional claims are passed through as untyped key-value pairs via `additionalProperties`. - `email` string — Email claim from the authentication token. - `groups` string[] — Group membership claims from the authentication token. - `issuer_claims` PdpIssuerClaims — Issuer-specific claims forwarded opaquely from STS (e.g. GHA OIDC assertion claims). Mapped to `context.actor_claims.issuer_claims` in Cedar. All fields are optional and issuer-dependent. See issuer documentation for available claim fields. - `active_psv_id` string, uuid, required — ID of the active policy set version used for evaluation. - `active_schema_version` string, required — Cedar schema version of the active policy set version. - `active_decision` 'allow' | 'deny', required - `active_duration_ms` integer, required — Evaluation duration in milliseconds. - `shadow_psv_id` string, uuid, nullable — ID of the shadow policy set version, if a shadow binding existed. - `created_at` string, date-time, required - `pagination` PdpPagination, required — Cursor-based pagination metadata returned alongside a list of results - `before_cursor` string, required — An opaque cursor used for paginating through a list of results - `after_cursor` string, required — An opaque cursor used for paginating through a list of results - `total_count` integer — Total number of items across all pages. Only present when the request includes ?expand[]=total_count. ## Other responses - `400` — bad request error response when caller supplied invalid input data - `401` — unauthorized error response when caller session is not authenticated - `403` — forbidden error response when caller does not have permissions to a resource - `404` — not found error response when caller does not have permission to see a resource or the resource does not exist - `429` — rate limit exceeded error response when caller has exhausted api limits for the given time period - `500` — internal server error response when server encountered error of its own creation - `503` — service unavailable error when server you're attempting to reach is not available - `default` — internal server error response when server encountered error of its own creation --- [API](https://skmtc.net/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.net/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/keycardai/untitled-api/versions/2f5033ed4491/schema)