---
title: "List policy set bindings for a zone"
method: GET
path: "/zones/{zone_id}/policy-bindings"
tags: ["PolicyBindings"]
---

# List policy set bindings for a zone

`GET /zones/{zone_id}/policy-bindings`

Returns bindings for the zone, filtered by target and mode.

`filter[target_type]` defaults to `zone` and `filter[mode]`
defaults to `shadow` when omitted (preserving the endpoint's
historical shadow-only listing); pass explicit values to widen.
The deprecated bare `scope_type` and `mode` parameters are honored
as equivalents and suppress the respective defaults; supplying a
bare parameter and its `filter[...]` form with different values
returns 400. With an effective target type set of exactly `zone`,
`filter[target_id]` values other than the zone ID return 400.

## Path parameters

- `zone_id` string, required

## Query parameters

- `scope_type` 'zone'
- `mode` 'shadow'
- `filter[target_type]` string[] — Value shape for `filter[<field>]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.
- `filter[target_id]` string[] — Value shape for `filter[<field>]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.
- `filter[mode]` string[] — Value shape for `filter[<field>]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.

## Headers

- `X-API-Version` string
- `X-Client-Request-ID` string, uuid

## Response `200`

List of bindings

- object
  - `items` PdpPolicySetBinding[], required
    - `id` string, required — Binding identifier (stable per slot)
    - `scope_type` 'zone', required — **Deprecated.** Use `target_type` instead. Carries the same value.
    - `scope_target_id` string, required — **Deprecated.** Use `target_id` instead. Carries the same value.
    - `target_type` 'zone' | 'user', required — What this binding targets
    - `target_id` string, required — Target entity ID. Equals zone_id for zone-targeted bindings.
    - `mode` 'active' | 'shadow', required — Binding mode
    - `policy_set_id` string, required — Public ID of the bound policy set
    - `policy_set_version_id` string, required — Public ID of the bound policy set version
    - `created_at` string, date-time, required

## Other responses

- `400` — bad request error response when caller supplied invalid input data
- `401` — unauthorized error response when caller session is not authenticated
- `403` — forbidden error response when caller does not have permissions to a resource
- `429` — rate limit exceeded error response when caller has exhausted api limits for the given time period
- `500` — internal server error response when server encountered error of its own creation
- `default` — internal server error response when server encountered error of its own creation

---

[API](https://skmtc.net/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.net/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/keycardai/untitled-api/versions/2f5033ed4491/schema)