Filter and list Policies by Envrionment (required), Authorization Workspace, Application, Custom Attributes within an Environment.
Notice
Accessing the API call is through a dedicated domain/URL, according to your PlainID Tenant Location- United States (US) - `https://api.us1.plainid.io`
- Canada (CA) - `https://api.ca1.plainid.io`
- Europe (EU) - `https://api.eu1.plainid.io`
Using HTML Encoded Special Characters
Use HTML encoded patterns when working with values that contain special characters like spaces, dashes, etc. Refer to this HTML URL Encoding Reference for a full list.
Important note about headers
Refer to the headers below to modify your cURL sample. Check if the following headers are in the sample, if not, ensure you add it to your cURL sample before pasting into your API tool.
Headers
*Required| Header | Value | cURL Line |
|---|---|---|
| Content-Type * | `application/json` | `-H "Content-Type:application/json"` |
| Accept | `application/json` | `-H "Accept:application/json"` |
cURL Sample Guidelines
In order for the relevant parameters to appear in the cURL sample, you can input the values in the interactive API console on the right. They will then appear in the cURL sample on the bottom of the page in the correct format.
For more details about Administration API Authentication, check out the Authentication APIs documentation
Provide your bearer token in the Authorization header when making requests to protected resources.
Example: Authorization: Bearer 123
The Environment ID can be found under the Details Tab in the Environment Settings.
Page size. Default 50, max 100. Capped to 10 when detailed=true.
Zero-based offset. Default 0.
{
"applicationIds": [
"my-app-1"
],
"state": "active",
"detailed": false
}{
"actionIds": [
"read",
"Approve"
],
"detailed": false
}{
"assetTemplateIds": [
"Bank_accounts"
],
"detailed": false
}{
"actionIds": [
"view"
],
"assetTemplateIds": [
"Bank_accounts"
],
"detailed": false
}{
"policyCustomAttributes": {
"regulatoryTags": [
"GDPR-PII"
],
"policyScore": [
2
]
},
"detailed": false
}{
"applicationIds": [
"my-app-1"
],
"detailed": true
}{
"applicationIds": [
"my-app-1",
"my-app-2"
],
"authzWsIds": [
"03d54e5b-32ef-4ebe-8bb2-8b9b03049d81"
],
"state": "active",
"policyCustomAttributes": {
"regulatoryTags": [
"GDPR-PII"
],
"policyScore": [
2
]
},
"actionIds": [
"read",
"Approve"
],
"assetTemplateIds": [
"Bank_accounts"
],
"detailed": true
}Application IDs to filter by. Use a comma within the brackets to specify multiple Application IDs.
Policy Workspace IDs (previously Authorization Workspace ID) to filter by.
Filter by Policy state.
Custom Attribute filters expressed as key-value conditions.
- Within a single attribute value list, conditions are evaluated using OR semantics.
-Across different attribute keys, conditions are evaluated using AND semantics.
For more information about Policy Custom Attributes, refer to our documentation.
Action IDs to filter by. Only Policies linked to at least one of the given Actions are returned.
Within this list, conditions are evaluated using OR semantics. Against the other filters, they are evaluated using AND semantics.
Can be used in combination with the assetTemplateIDs parameter
Asset Template IDs to filter by. Only Policies linked to at least one of the given Asset Templates are returned. Within this list, conditions are evaluated using OR semantics. Against the other filters, including actionIds they are evaluated using AND semantics.
When set to true, includes Policy ID and metadata.
When set to false (default), only Policy IDs are returned.
Paginated list of policies
{
"data": [
{
"policyId": "POL-001",
"displayName": "US Gold Tier Access Policy",
"state": "Active",
"accessType": "Allow"
},
{
"policyId": "POL-002",
"displayName": "EU Restricted Policy",
"state": "Active",
"accessType": "Restrict"
}
],
"meta": {
"total": 237,
"limit": 50,
"offset": 0
}
}{
"data": [
{
"policyId": "POL-001",
"displayName": "US Gold Tier Access Policy",
"state": "Active",
"accessType": "Allow",
"structuredRego": "# METADATA\n# custom:\n# plainid:\n# policyId: 7fa130f2-44d4-4cd1-9590-7cb7fd15f558\n# name: GDPRPolicy\n# accessType: Allow\n# policyUse: DYNAMIC_AUTHORIZATION_SERVICE\n# sourceEnvironmentId: a8663674-c7cf-44e4-b9c5-e9adb513c5d2\n# applications: \n# - id: App\n# customAttributes:\n# regulatoryTags: [\"GDPR-PII\"]\n# policyScore: 2\npackage policy\nimport rego.v1\n\n# METADATA\n# custom:\n# plainid:\n# kind: DynamicGroup\n# name: import All Users\n# id: 38e3b716-8dcd-4ed7-a7b3-beeb15eeca0d\n# description: \"Predefined Dynamic Group. All Users contains all organization's users defined in the IDP\"\ndynamic_group(identity) if {\n\tidentity.template == \"import\"\n}\n\n# METADATA\n# custom:\n# plainid:\n# kind: Ruleset\n# name: All\n# id: 6a4fa454-e4b9-4b02-b543-0ad902fd9f02\n# description: \"Predefined Ruleset. All Assets contains all created assets defined in the Asset Type\"\nruleset(asset, identity, requestParams, action) if {\n\tasset.template == \"Claims\"\n\taction.id in [\"Access\"]\n}"
}
],
"meta": {
"total": 1,
"limit": 10,
"offset": 0
}
}{
"data": [
{
"policyId": "SF-ROW-ACCESS-001",
"displayName": "Snowflake Sales Region Row Access",
"state": "Active",
"accessType": "Allow",
"nativeCode": [
{
"applicationId": "snowflake-sales",
"language": "SQL",
"code": "CREATE OR REPLACE ROW ACCESS POLICY sales_region AS (region VARCHAR) RETURNS BOOLEAN -> CURRENT_ROLE() = 'ADMIN' OR region = 'US'",
"kind": "ROW_ACCESS_POLICY"
}
]
}
],
"meta": {
"total": 1,
"limit": 10,
"offset": 0
}
}The Policy ID.
The Policy display name.
Whether the Policy is active or inactive.
Whether the Policy allows or restricts access.
Structured Rego code wrapped in JSON. Only present when detailed=true.
The Native Policy's vendor code, one entry per Application. Only present when detailed=true, for a Policy that has native vendor code.
The Application ID. Omitted if it could not be resolved.
Native code language (e.g., SQL).
Native code content.
Vendor policy kind, when the vendor defines one.
Response Meta
Total number of matching policies.
Page size used for this request.
Offset used for this request.
Bad Request
Unauthorized
Validation Failed - an empty list was sent for a filter, or a filter matched too many rows to resolve
Internal Server Error