---
title: "Search Policies"
method: POST
path: "/api/v2/Policies/search"
tags: ["Policies"]
---

# Search Policies

`POST /api/v2/Policies/search`

Search for policies by specifying parameters in the request body when invoking the following endpoint:

  > `POST https://YourAccount.lacework.net/api/v2/Policies/search`

## Headers

- `Authorization` string, required
- `Content-Type` string, required

## Request body

- PASSTHROUGHAPIFILTERS
  - `filters` object[] — One or more condition statements you can use to refine the data returned by the request. Only records that satisfy filtering conditions are returned. If there are multiple conditions, a record must satisfy all conditions for a match. To use wildcards with the `LIKE`, `ILIKE` `NOT_LIKE` OR `NOT_ILIKE` filters, use the % symbol to match any string. This allows you to perform more flexible and broad searches for text data. - `%` represents a wildcard to match zero or more characters - `_` (underscore) represents a wildcard match for a single character
    - `expression` 'eq' | 'ne' | 'in' | 'not_in' | 'like' | 'ilike' | 'not_like' | 'not_ilike' | 'gt' | 'ge' | 'lt' | 'le' | 'between', required — The comparison operator for the filter condition.
    - `field` string, required — The name of the data field to which the condition applies.
    - `value` string — The value that the condition checks for in the specified field. Use this attribute when specifying a single value.
    - `values` string[] — The values that the condition checks for in the specified field. Use this attribute when specifying multiple values.

## Response `200`

No Error

- object
  - `data` PoliciesResponseSchema
    - `policyType` 'Violation' — The policy type such as `Violation`.
    - `queryId` string, required — Identifier of the query that executes while running the policy.
    - `title` string, required — The policy's title.
    - `enabled` boolean, required — When sending a request, use this attribute to enable or disable a policy. When included in a response, returns `True` for enabled policies, or returns `False` for disabled policies.
    - `description` string, required — Information about the new policy.
    - `remediation` string, required — Remediation strategy for the events triggered by the policy.
    - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required — The severity of an event triggered by the policy.
    - `limit` number — The maximum number of records that each policy will return. The default value is 1000.
    - `evalFrequency` 'Hourly' | 'Daily' — Frequency at which the policy will be evaluated
    - `alertEnabled` boolean, required — When sending a request, set to `True` if you want to send alerts to an alert profile when the policy is triggered. Set to `False` if you want to mute alerts when the policy is triggered.
    - `alertProfile` string — The alert profile to use for sending alerts when the policy is triggered.
    - `tags` string[] — A list of policy tags.
    - `policyId` string — Policy ID. The convention for policy ID creation is `accountName-remainder`, for example, lws-special-100. When sending a request, you can simply provide `$account-<remainder>`, and FortiCNAPP will substitute the `$account` prefix with your actual account name. **Note:** The `-remainder` must use the regex pattern (`^[a-z]{1,16}(-\d{1,8})?$`), and cannot be `default` or start with `default-`.
    - `evaluatorId` string — Evaluator ID. For POST and PATCH endpoints, the `evaluatorId` field is still accepted but is ignored. No warning is returned if an `evaluatorId` is provided; this behavior may change in the future. For responses from all of these calls, an `evaluatorId` field is no longer returned.
    - `owner` string — The user who created the policy.
    - `lastUpdateTime` string — The timestamp for when the policy was last updated.
    - `lastUpdateUser` string — The user who last updated the policy.
    - `exceptionConfiguration` object — The configuration of policy exceptions when it is applicable.
      - `constraintFields` object[], required — List of constraint fields that can be used to create policy exceptions.
        - `fieldKey` string, required — Field ID that can be used to apply the exception on a policy.
        - `dataType` string, required — Type can be `String` or `KVTagPair`.
        - `multiValue` boolean, required — Allow multiple values or not.

## Other responses

- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)