List policy sets in a zone
Returns a paginated list of policy sets in the zone.
filter[target_type] defaults to zone, hiding principal-scoped sets (e.g. per-user bundle sets) unless explicitly widened. The deprecated filter[scope_type] is honored as an equivalent and suppresses the default; supplying both with different value sets returns 400.
Path parameters
The zone identifier
Query parameters
An opaque cursor used for paginating through a list of results
Cursor for forward pagination. Returned in Pagination.after_cursor. Mutually exclusive with before.
An opaque cursor used for paginating through a list of results
Cursor for backward pagination. Returned in Pagination.before_cursor. Mutually exclusive with after.
Maximum number of items to return per page.
Deprecated. Use expand[] instead.
Opt-in to additional response fields. Still honored for backward compatibility; supplying both expand and expand[] with disagreeing values returns 400 Bad Request.
Opt-in to additional response fields. Repeatable; matches the expand[] convention used across the Keycard API.
Field to sort by. created_at (default) sorts by creation date. status sorts active-first, then by creation date within each group. When sort=status, only descending order and forward pagination are supported; order=asc or before cursors return 400.
Sort direction. Default is desc (newest first).
Value shape for query[] and query[<field>] search parameters.
Wire conventions:
- Case-insensitive substring match (ILIKE).
- Repeated parameter instances are OR-ed across terms.
- Comma splitting is NOT performed; literal commas in a search term are preserved as part of the term.
Examples: ?query[name]=alpha&query[name]=beta -> name ILIKE %alpha% OR name ILIKE %beta% ?query[]=alpha -> any searchable field ILIKE %alpha%
Cross-field form is query[]; field-scoped form is query[<field>]. Field names are endpoint-specific; services declare each query parameter per operation.
Case-insensitive substring search on name. Repeatable; if multiple terms are supplied they are OR-ed (any matching term returns the row).
Value shape for query[] and query[<field>] search parameters.
Wire conventions:
- Case-insensitive substring match (ILIKE).
- Repeated parameter instances are OR-ed across terms.
- Comma splitting is NOT performed; literal commas in a search term are preserved as part of the term.
Examples: ?query[name]=alpha&query[name]=beta -> name ILIKE %alpha% OR name ILIKE %beta% ?query[]=alpha -> any searchable field ILIKE %alpha%
Cross-field form is query[]; field-scoped form is query[<field>]. Field names are endpoint-specific; services declare each query parameter per operation.
Case-insensitive substring search across all searchable fields of the resource. For policies that is name and description; for policy sets that is name. Repeatable; if multiple terms are supplied they are OR-ed.
Value shape for filter[<field>] query parameters.
Wire conventions:
- Repeated parameter instances are OR-ed across values.
- A single value containing comma-separated tokens is AND-ed across tokens.
Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz
Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.
Filter on owner_type. Repeatable; repeated instances OR across values (e.g. ?filter[owner_type]=platform&filter[owner_type]=customer matches either). See FilterValues in the shared spec for the full wire convention.
Allowed values: platform, customer. Unknown values return 400 with the list of allowed values. Comma-separated single values (e.g. ?filter[owner_type]=platform,customer) are rejected with a 400 pointing at the repeated-parameter OR form.
Note: the allowed-value enum is enforced in the handler (not as an OpenAPI items.enum) so the server can return a targeted error for the comma-AND form instead of a generic "not in allowed values" response.
Value shape for filter[<field>] query parameters.
Wire conventions:
- Repeated parameter instances are OR-ed across values.
- A single value containing comma-separated tokens is AND-ed across tokens.
Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz
Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.
Deprecated. Use filter[target_type] instead.
Filter on scope_type (policy sets only). Repeatable; repeated instances OR across values. See FilterValues in the shared spec for the full wire convention.
Allowed values: zone only. Use filter[target_type] to select user (or future) targets. Unknown values return 400 with the list of allowed values. Comma-separated single values are rejected with a 400 pointing at the repeated-parameter OR form.
Still honored for backward compatibility and suppresses the filter[target_type] zone default. Supplying both this and filter[target_type] with different value sets returns 400 Bad Request.
Value shape for filter[<field>] query parameters.
Wire conventions:
- Repeated parameter instances are OR-ed across values.
- A single value containing comma-separated tokens is AND-ed across tokens.
Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz
Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.
Filter on target_type. Repeatable; repeated instances OR across values. See FilterValues in the shared spec for the full wire convention.
Allowed values: zone, user (resource and session are reserved and not yet accepted). Unknown values return 400 with the list of allowed values. Comma-separated single values are rejected with a 400 pointing at the repeated-parameter OR form.
Defaults to zone when omitted (and no deprecated equivalent parameter is supplied), so listings exclude principal-scoped elements unless explicitly widened. On listPolicies the default is skipped when filter[id] is present, so by-ID fetches resolve regardless of target.
Note: the allowed-value enum is enforced in the handler (not as an OpenAPI items.enum) so the server can return a targeted error for the comma-AND form instead of a generic "not in allowed values" response.
Deprecated. Use filter[active] instead.
Filter by active binding status. When true, returns only policy sets with an active binding. When false, returns only policy sets without one. Omit to return all.
Still honored for backward compatibility. Supplying both active and filter[active] with conflicting values returns 400 Bad Request.
Filter by active binding status. When true, returns only policy sets with an active binding. When false, returns only policy sets without one. Omit to return all.
Headers
API version header (date-based, e.g. 2026-02-01)
Unique request identifier specified by the originating caller and passed along by proxies.
Response
A paginated list of policy sets