--- title: "List policy sets in a zone" method: GET path: "/zones/{zone_id}/policy-sets" tags: ["PolicySets"] --- # List policy sets in a zone `GET /zones/{zone_id}/policy-sets` Returns a paginated list of policy sets in the zone. `filter[target_type]` defaults to `zone`, hiding principal-scoped sets (e.g. per-user bundle sets) unless explicitly widened. The deprecated `filter[scope_type]` is honored as an equivalent and suppresses the default; supplying both with different value sets returns 400. ## Path parameters - `zone_id` string, required ## Query parameters - `after` string — An opaque cursor used for paginating through a list of results - `before` string — An opaque cursor used for paginating through a list of results - `limit` integer - `expand` PdpExpandField[] - `expand[]` PdpExpandField[] - `sort` 'created_at' | 'status' - `order` 'asc' | 'desc' - `query[name]` string[] — Value shape for `query[]` and `query[]` search parameters. Wire conventions: - Case-insensitive substring match (ILIKE). - Repeated parameter instances are OR-ed across terms. - Comma splitting is NOT performed; literal commas in a search term are preserved as part of the term. Examples: ?query[name]=alpha&query[name]=beta -> name ILIKE %alpha% OR name ILIKE %beta% ?query[]=alpha -> any searchable field ILIKE %alpha% Cross-field form is `query[]`; field-scoped form is `query[]`. Field names are endpoint-specific; services declare each query parameter per operation. - `query[]` string[] — Value shape for `query[]` and `query[]` search parameters. Wire conventions: - Case-insensitive substring match (ILIKE). - Repeated parameter instances are OR-ed across terms. - Comma splitting is NOT performed; literal commas in a search term are preserved as part of the term. Examples: ?query[name]=alpha&query[name]=beta -> name ILIKE %alpha% OR name ILIKE %beta% ?query[]=alpha -> any searchable field ILIKE %alpha% Cross-field form is `query[]`; field-scoped form is `query[]`. Field names are endpoint-specific; services declare each query parameter per operation. - `filter[owner_type]` string[] — Value shape for `filter[]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[] parameter per operation with an appropriate items.type/items.enum override. - `filter[scope_type]` string[] — Value shape for `filter[]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[] parameter per operation with an appropriate items.type/items.enum override. - `filter[target_type]` string[] — Value shape for `filter[]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[] parameter per operation with an appropriate items.type/items.enum override. - `active` boolean - `filter[active]` boolean ## Headers - `X-API-Version` string - `X-Client-Request-ID` string, uuid ## Response `200` A paginated list of policy sets - PdpPolicySetsList - `items` PdpPolicySetWithBinding[], required - `id` string, required - `zone_id` string, required - `name` string, required - `scope_type` 'zone' | 'resource' | 'user' | 'session', required — **Deprecated.** Use `target_type` instead. Carries the same value. - `target_type` 'zone' | 'user', required — What this policy set targets: - `"zone"` — applies to all requests in the zone. - `"user"` — scoped to a specific user. `resource` and `session` are reserved; legacy sets with those scopes carry them in the deprecated `scope_type` field. - `latest_version_id` string, nullable - `latest_version` integer, nullable — Human-readable version number of the latest version (e.g., 1, 2, 3) - `archived_at` string, date-time, nullable - `created_at` string, date-time, required - `updated_at` string, date-time, required - `created_by` string, required - `updated_by` string, nullable - `owner_type` 'platform' | 'customer', required — Who manages this policy set: - `"platform"` — managed by the Keycard platform (system policies). - `"customer"` — managed by the tenant (custom policies). - `scope_target_id` string, nullable — **Deprecated.** Use `target_id` instead. Carries the active binding's target; null when unbound. - `target_id` string, nullable — Target entity ID. Equals `zone_id` for zone-targeted sets; the principal identifier for principal-scoped sets. Null only for legacy non-zone sets that predate target tracking. - `mode` 'active' | 'shadow', nullable - `active` boolean — Whether this policy set is currently bound to a scope - `active_version_id` string, nullable — Public ID of the currently active (bound) version - `active_version` integer, nullable — Human-readable version number of the active version (e.g., 1, 2, 3) - `shadow_version_id` string, nullable — Public ID of the shadow (observed) version, if any - `shadow_version` integer, nullable — Human-readable version number of the shadow version - `pagination` PdpPagination, required — Cursor-based pagination metadata returned alongside a list of results - `before_cursor` string, required — An opaque cursor used for paginating through a list of results - `after_cursor` string, required — An opaque cursor used for paginating through a list of results - `total_count` integer — Total number of items across all pages. Only present when the request includes ?expand[]=total_count. ## Other responses - `400` — bad request error response when caller supplied invalid input data - `401` — unauthorized error response when caller session is not authenticated - `403` — forbidden error response when caller does not have permissions to a resource - `404` — not found error response when caller does not have permission to see a resource or the resource does not exist - `429` — rate limit exceeded error response when caller has exhausted api limits for the given time period - `500` — internal server error response when server encountered error of its own creation - `503` — service unavailable error when server you're attempting to reach is not available - `default` — internal server error response when server encountered error of its own creation --- [API](https://skmtc.net/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.net/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/keycardai/untitled-api/revisions/2f5033ed4491/schema)