List policy set bindings for a zone
Returns bindings for the zone, filtered by target and mode.
filter[target_type] defaults to zone and filter[mode] defaults to shadow when omitted (preserving the endpoint's historical shadow-only listing); pass explicit values to widen. The deprecated bare scope_type and mode parameters are honored as equivalents and suppress the respective defaults; supplying a bare parameter and its filter[...] form with different values returns 400. With an effective target type set of exactly zone, filter[target_id] values other than the zone ID return 400.
Path parameters
The zone identifier
Query parameters
Deprecated. Use filter[target_type] instead. Still honored for backward compatibility but only accepts zone; other values return 400. Conflicts with filter[target_type] return 400.
Deprecated. Use filter[mode] instead. Still honored for backward compatibility but only accepts shadow; other values return 400. Conflicts with filter[mode] return 400.
Value shape for filter[<field>] query parameters.
Wire conventions:
- Repeated parameter instances are OR-ed across values.
- A single value containing comma-separated tokens is AND-ed across tokens.
Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz
Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.
Filter on target_type. Repeatable; repeated instances OR across values. See FilterValues in the shared spec for the full wire convention.
Allowed values: zone, user (resource and session are reserved and not yet accepted). Unknown values return 400 with the list of allowed values. Comma-separated single values are rejected with a 400 pointing at the repeated-parameter OR form.
Defaults to zone when omitted (and no deprecated equivalent parameter is supplied), so listings exclude principal-scoped elements unless explicitly widened. On listPolicies the default is skipped when filter[id] is present, so by-ID fetches resolve regardless of target.
Note: the allowed-value enum is enforced in the handler (not as an OpenAPI items.enum) so the server can return a targeted error for the comma-AND form instead of a generic "not in allowed values" response.
Value shape for filter[<field>] query parameters.
Wire conventions:
- Repeated parameter instances are OR-ed across values.
- A single value containing comma-separated tokens is AND-ed across tokens.
Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz
Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.
Filter on target_id. Repeatable; repeated instances OR across values. See FilterValues in the shared spec for the full wire convention.
Zone-targeted elements carry the zone ID as their target_id. When the effective filter[target_type] set is exactly zone (including via its default), any filter[target_id] value other than the path zone_id returns 400 Bad Request.
Value shape for filter[<field>] query parameters.
Wire conventions:
- Repeated parameter instances are OR-ed across values.
- A single value containing comma-separated tokens is AND-ed across tokens.
Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz
Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.
Filter on binding mode. Repeatable; repeated instances OR across values. See FilterValues in the shared spec for the full wire convention.
Allowed values: active, shadow. Unknown values return 400 with the list of allowed values. Comma-separated single values are rejected with a 400 pointing at the repeated-parameter OR form.
Defaults to shadow when omitted (and the deprecated bare mode parameter is absent), preserving the endpoint's historical shadow-only listing. Pass filter[mode]=active (or both values) to widen.
Headers
API version header (date-based, e.g. 2026-02-01)
Unique request identifier specified by the originating caller and passed along by proxies.
Response
List of bindings