---
title: "List versions of a policy"
method: GET
path: "/zones/{zone_id}/policies/{policy_id}/versions"
tags: ["PolicyVersions"]
---

# List versions of a policy

`GET /zones/{zone_id}/policies/{policy_id}/versions`

## Path parameters

- `zone_id` string, required
- `policy_id` string, required

## Query parameters

- `after` string — An opaque cursor used for paginating through a list of results
- `before` string — An opaque cursor used for paginating through a list of results
- `limit` integer
- `expand` PdpExpandField[]
- `expand[]` PdpExpandField[]
- `sort` 'created_at'
- `order` 'asc' | 'desc'
- `format` 'cedar' | 'json'

## Headers

- `X-API-Version` string
- `X-Client-Request-ID` string, uuid

## Response `200`

A paginated list of policy versions

- PdpPolicyVersionsList
  - `items` PdpPolicyVersion[], required
    - `id` string, required
    - `policy_id` string, required
    - `zone_id` string, required
    - `version` integer, required
    - `schema_version` string, required — Schema version this policy was validated against when created.
    - `cedar_json` object, nullable — Cedar policy in JSON representation. Populated by default and when `format=json` is passed; null when `format=cedar` narrows the response to the text representation only.
    - `cedar_raw` string, nullable — Cedar policy in human-readable syntax. Populated by default and when `format=cedar` is passed; null when `format=json` narrows the response to the JSON representation only.
    - `sha` string, required — Hex-encoded content hash
    - `archived_at` string, date-time, nullable
    - `archived_by` string, nullable
    - `created_at` string, date-time, required
    - `created_by` string, required
    - `owner_type` 'platform' | 'customer', required — Who manages this policy version: - `"platform"` — managed by the Keycard platform (system policy versions). - `"customer"` — managed by the tenant (custom policy versions).
  - `pagination` PdpPagination, required — Cursor-based pagination metadata returned alongside a list of results
    - `before_cursor` string, required — An opaque cursor used for paginating through a list of results
    - `after_cursor` string, required — An opaque cursor used for paginating through a list of results
    - `total_count` integer — Total number of items across all pages. Only present when the request includes ?expand[]=total_count.

## Other responses

- `400` — bad request error response when caller supplied invalid input data
- `401` — unauthorized error response when caller session is not authenticated
- `403` — forbidden error response when caller does not have permissions to a resource
- `404` — not found error response when caller does not have permission to see a resource or the resource does not exist
- `429` — rate limit exceeded error response when caller has exhausted api limits for the given time period
- `500` — internal server error response when server encountered error of its own creation
- `503` — service unavailable error when server you're attempting to reach is not available
- `default` — internal server error response when server encountered error of its own creation

---

[API](https://skmtc.net/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.net/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/keycardai/untitled-api/revisions/2f5033ed4491/schema)