---
title: "Retrieve a tenant's configuration for a specific type"
method: GET
path: "/tenant-configurations/by-configuration-type/{configurationTypeId}"
tags: ["Tenant Configuration"]
---

# Retrieve a tenant's configuration for a specific type

`GET /tenant-configurations/by-configuration-type/{configurationTypeId}`

Returns the stored configuration record for the given `configurationTypeId` and the tenant identified by the required `tenant-id` header.

Special behavior for `tenant-timezone-config`: if no record has been persisted for this tenant, the endpoint synthesizes and returns a default record using timezone `America/New_York`. In this synthetic default case the `id`, `namespace`, `updatedAt`, and `createdAt` fields of the returned `TenantConfigurationItemDto` are `null`.

The response is a `TenantConfigurationItemDto`. This shape differs from the flat `TenantTimezoneResponse` returned by the POST endpoint on the same path.

Use this endpoint to read a single configuration type. To read all types in one call, use `GET /tenant-configurations`. Results from this path are served from a server-side cache keyed by tenant and configuration type, so a write via the POST endpoint may not be immediately visible here.

Preconditions: the `tenant-id` header must be present; omitting it returns 400. Supplying a `configurationTypeId` for which no record exists (and which is not `tenant-timezone-config`) returns 404.

## Path parameters

- `configurationTypeId` string, required

## Headers

- `tenant-id` string, required

## Response `200`

The stored configuration record for the requested type, or — for `tenant-timezone-config` with nothing persisted — a synthesized default record with `null` id/namespace/timestamps.

- TenantConfigurationItemDto — A tenant configuration item
  - `id` string — Unique identifier for the configuration
  - `tenantId` string — Tenant ID this configuration belongs to
  - `namespace` string — Namespace for the configuration
  - `configurationTypeId` string — Type identifier for the configuration
  - `configuration` unknown
  - `updatedAt` string, date-time
  - `createdAt` string, date-time

## Other responses

- `400` — Request rejected because the required `tenant-id` header (or the `configurationTypeId` path parameter) is missing or blank. Supply both and retry.
- `401` — Authentication token is missing, expired, or invalid. Obtain a valid JWT and retry.
- `404` — No configuration record exists for the given `configurationTypeId` (applies to types other than `tenant-timezone-config`, which always returns a synthesized default). The response body is empty.
- `500` — An unexpected error occurred while reading the configuration from the data store, or the record could not be serialized. The response body is a bare `{"error": "..."}` object, not the structured `ApiError` shape used elsewhere in this API. The request was not fulfilled; retry after a short delay.
- `502` — The downstream data store (DAL) returned a server error (5xx) while reading the configuration. Retry after a short delay and escalate if it persists.
- `503` — Unable to connect to the downstream data store (network/connectivity failure). Retry after a short delay.

---

[API](https://skmtc.dev/certifyos/apis/certify-api-layer.md) · [All operations](https://skmtc.dev/certifyos/apis/certify-api-layer/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/certifyos/certify-api-layer/revisions/563848e0ecc0/schema)