Docs

List policies

GET
/policies

Lists the project's policies, one per operation, each as its newest revision, ordered by created_at (first publish) and then id. Filter by operation to read the policy of one operation; a project that never published one gets an empty list.

The lookup is scoped to the project in project_id.

Authorization

headerAuthorizationBearer <token>

Scope: policy.read

Query Parameters

project_id*string

The unique identifier of the project

Match^[a-zA-Z0-9_-]+$
limit?integer

Maximum number of items to return.

Range1 <= value <= 100
Default20
page_token?string

Token for fetching the next page of results. Obtain this value from next_page_token in the previous response. Omit to start from the beginning. Its format is opaque and may change between releases.

operation?"auth.factor.password.set"

Only the policy of this operation.

Value in"auth.factor.password.set"

Response Body

The policies were returned.

application/json
  1. response

Paginated list of the project's policies, one per operation, each as its newest revision.

policies*array<>
next_page_token?|

Token to pass as page_token in the next request to fetch the following page. Absent when there are no more results.

Example Request
import { configureZitadel, getApi } from "@zitadel/api/config";// In the browser, through the SDK proxy: the session cookie authenticates the call.const client = getApi(configureZitadel({ projectId: "proj_01KWH1P4MYS7F0N9WD3P2E4YM5" }));const policies = await client.listPolicies({ project_id: "proj_01KWH1P4MYS7F0N9WD3P2E4YM5" });
Example Response
{  "policies": [    {      "id": "pol_01KXA4F3Q8R7F0N9WD3P2E4YM5",      "revision_id": "polrev_01KXB7C2M4N7F0N9WD3P2E4YM7",      "project_id": "proj_01KWH1P4MYS7F0N9WD3P2E4YM5",      "operation": "auth.factor.password.set",      "config": {        "min_length": 12,        "history_depth": 4      },      "created_at": "2026-10-20T09:00:00Z",      "updated_at": "2026-10-20T10:30:00Z"    }  ]}

Was this helpful?