List Cedar policies for the authenticated org.
Returns Cedar policies scoped to the authenticated org (policies.workspaceId), optionally filtered by status or scope. Human principals only: a browser session or a WorkOS user-token bearer is accepted; rsk_* API keys and BYOA OAuth-agent tokens authenticate but are rejected 403.
Rensei API key presented as Authorization: Bearer rsk_live_. Required API-key scopes are recorded per operation in x-rensei-required-scopes.
In: header
Query Parameters
Filter by policy status.
Filter by policy scope (workspace / workflow / agent).
Response Body
application/json
curl -X GET "https://example.com/api/policies"{
"policies": [
{
"id": "string",
"workspaceId": "string",
"name": "string",
"description": "string",
"cedarPolicy": "string",
"scope": "string",
"scopeId": "string",
"status": "string",
"version": 0,
"regulatoryTags": [
"string"
],
"metadata": {
"property1": null,
"property2": null
},
"createdBy": "string",
"createdAt": "string",
"updatedAt": "string",
"archivedAt": "string"
}
]
}List A2A Cedar policies for a project in the authenticated org.
Returns the authenticated org's A2A Cedar policies for a project (project scope is encoded in the policy name prefix). Bearer-reachable read for human principals (user token or browser session) with at least the auditor org role; rsk_* API keys and BYOA OAuth-agent tokens carry no org role and are rejected 403. Strictly org-scoped.
Get one Cedar policy with its version history.
Returns a single Cedar policy scoped to the authenticated org, plus its full version history (newest first). A policy id belonging to another org returns 404.