Get the tenant's policy document

GET

/v1/policy

const url = 'https://example.com/v1/policy';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://example.com/v1/policy \
  --header 'Authorization: Bearer <token>'

Returns the calling tenant’s current policy document. A tenant with no policy configured gets the empty/absent default (version: 0, no default/on_error, empty rules, no updated_at) rather than a 404 — no policy means zero behavior change (spec 0009).

Authorizations

oidcBearer

Responses

200

The tenant’s policy document (or its empty default).

application/json

The GET /v1/policy response — the full document, or its empty default when unconfigured.

object

version

required

0 when the tenant has no policy configured.

integer

default

string

Allowed values: allow warn deny

on_error

string

Allowed values: allow warn deny

rules

required

Array<object>

One ordered entry in a policy document’s rule list, evaluated in order (spec 0009).

object

action

required

string

Allowed values: allow warn deny

match

required

Conditions a rule matches an in-flight call against (spec 0009). Every populated field must match for the rule to apply; an absent/empty field is not a match condition (matches any value). tools is meaningless for protocol=http agents (route-level only).

object

agents

Matches the calling agent’s ID. Absent/empty matches any agent.

Array<string>

tools

Matches the parsed MCP tool name, supporting a single trailing * wildcard (e.g. read_*). Absent/empty matches any tool.

Array<string>

max_body_bytes

Matches when the request body size is at least this many bytes.

integer

rate_per_min

Matches when the caller’s observed rate exceeds this many requests per minute.

integer

updated_at

Absent when the tenant has no policy configured.

string format: date-time

Example

{
  "default": "allow",
  "on_error": "allow",
  "rules": [
    {
      "action": "allow"
    }
  ]
}

401

Missing or invalid bearer token, or the token’s tenant/user claims are absent. No body.

500

An unexpected server-side error. No body (internal detail is never returned to callers, invariant