---
title: "List policies on a vault"
method: GET
path: "/v1/vaults/{vault_id}/policies"
tags: ["Policies"]
---

# List policies on a vault

`GET /v1/vaults/{vault_id}/policies`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/vaults/{vault_id}/policies`
- Auth: HTTP bearer

## Path parameters

- `vault_id` string, uuid, required

## Response `200`

Policy list

- PolicyListResponse
  - `policies` PolicyResponse[]
    - `id` string, uuid, required
    - `vault_id` string, uuid, required
    - `secret_path_pattern` string, required
    - `principal_type` string, required
    - `principal_id` string, required
    - `permissions` string[], required
    - `conditions` object
    - `expires_at` string, date-time
    - `created_by` string
    - `created_by_type` string
    - `created_at` string, date-time, required
    - `effect` 'allow' | 'deny'
    - `priority` integer
    - `attribute_conditions` object
    - `consensus_trigger` ConsensusTrigger
      - `conditions` ConsensusCondition[], required
        - union
          - object
            - `type` 'value_above', required
            - `threshold_wei` string: Value threshold in wei (arbitrary-precision string). Preferred over threshold_gwei.
            - `threshold_gwei` integer: Deprecated — use threshold_wei for arbitrary precision
          - object
            - `type` 'chain_in', required
            - `chains` string[], required
          - object
            - `type` 'to_address_in', required
            - `addresses` string[], required
          - object
            - `type` 'function_selector_in', required
            - `selectors` string[], required
          - object
            - `type` 'erc20_amount_above', required
            - `threshold_raw` string, required
          - object
            - `type` 'intent_type_in', required
            - `intent_types` string[], required
          - object
            - `type` 'always', required
          - object
            - `type` 'action_in', required
            - `actions` string[], required: Control-plane actions to match, e.g. policy.create, policy.update, policy.delete, signing_key.export, member.role_change, member.remove
          - object
            - `type` 'action_kind_in', required
            - `action_kinds` string[], required: Version-agnostic action kind groups, e.g. signing_key.*, policy.*, member.*
      - `approval` ApprovalRequirement, required
        - `min_approvals` integer, required
        - `required_roles` string[]
        - `per_role_minimums` object
        - `require_credential_types` string[]: At least one approval must use one of these credential types
      - `expiry_secs` integer
      - `self_approval_allowed` boolean
      - `skip_when` FlatConditionSet[]: When ALL conditions in ANY entry match, consensus is bypassed. Useful for exempting known-safe recipients or low-value transfers.
        - `value_above` string: Native value threshold in gwei (numeric string)
        - `chain_in` string[]
        - `to_address_in` string[]
        - `function_selector_in` string[]
        - `erc20_amount_above` string: ERC-20 raw token amount threshold (numeric string)
        - `intent_type_in` string[]
        - `always` boolean: When true, this entry always matches regardless of other fields
        - `action_in` string[]: Control-plane actions to match (e.g. policy.create, signing_key.export)
        - `action_kind_in` string[]: Version-agnostic action kind groups (e.g. signing_key.*, policy.*, member.*)
      - `require_when` FlatConditionSet[]: Consensus is ONLY required when at least one entry matches. If set and none match, consensus is skipped entirely.
        - `value_above` string: Native value threshold in gwei (numeric string)
        - `chain_in` string[]
        - `to_address_in` string[]
        - `function_selector_in` string[]
        - `erc20_amount_above` string: ERC-20 raw token amount threshold (numeric string)
        - `intent_type_in` string[]
        - `always` boolean: When true, this entry always matches regardless of other fields
        - `action_in` string[]: Control-plane actions to match (e.g. policy.create, signing_key.export)
        - `action_kind_in` string[]: Version-agnostic action kind groups (e.g. signing_key.*, policy.*, member.*)
      - `deep_inspect` boolean: When true, also evaluate conditions against inner calls extracted from wrapper transactions (multicall, Safe execTransaction, ERC-4337 handleOps).
    - `tx_conditions` TxConditions: Signing-time conditions on access policies (all tiers). Ignored on secret reads. Evaluated when a TransactionContext is present. Fields are combined according to `match_mode` (default AND).
      - `match_mode` 'all' | 'any': How individual condition fields are combined. "all" (default): every present field must match (AND). "any": at least one present field must match (OR).
      - `function_name_in` string[]
      - `function_selector_in` string[]
      - `erc20_amount_above` string
      - `value_above` string: Native value threshold in wei (arbitrary-precision string)
      - `eip712_primary_type_in` string[]: Match EIP-712 typed_data primaryType (case-sensitive)
      - `eip712_verifying_contract_in` string[]: Match EIP-712 domain.verifyingContract (case-insensitive)
      - `eip712_domain_name_in` string[]: Match EIP-712 domain.name
      - `eip712_domain_chain_id_in` integer[]: Match EIP-712 domain.chainId
      - `eip7702_authorized_addresses_in` string[]: Match EIP-7702 authorization_list delegate addresses (case-insensitive)
      - `to_address_in` string[]
      - `chain_in` string[]
      - `intent_type_in` string[]
      - `decode_failed` boolean
      - `program_id_in` string[]
      - `deep_inspect` boolean: When true, conditions are also evaluated against inner calls extracted from wrapper transactions (multicall, Safe execTransaction, ERC-4337 handleOps). A match on any inner call counts as an overall match.
      - `expression` string: Mini expression DSL for policy conditions (schema version 2+). References transaction context fields (chain, value_wei, to_address, function_selector, etc.) with boolean operators. Fail-closed on parse or evaluation errors. Example: `chain == 'ethereum' && value_wei > 1000000000000000000`
    - `policy_schema_version` integer: Policy schema version (1 = legacy, 2 = expression engine)

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)