---
title: "Retrieve an API key rule."
method: GET
path: "/orgs/{org}/api-key-rules/{slug_perm}/"
tags: ["orgs"]
---

# Retrieve an API key rule.

`GET /orgs/{org}/api-key-rules/{slug_perm}/`

Retrieve an API key rule.

## Response `200`

OK

- OrganizationApiKeyRule
  - `created_at` string, date-time
  - `enforce_refresh` boolean — When enabled, API's keys that violate the organization's policy will be replaced automatically.
  - `is_enabled` boolean — Whether this policy is currently active and enforced.
  - `last_applied_at` string, date-time — The last time this policy was evaluated and applied by the expiry task.
  - `max_age_hours` integer, nullable — The maximum permitted age of an API key for use in the organization. API keys older than this will no longer have access until they are refreshed. To disable the policy unset this value.
  - `rule_type` 'All Accounts' | 'Service Accounts' | 'User Accounts', required — Specify which account types this rule applies to: all accounts (deprecated — prefer separate service/user rules), service accounts only, or user accounts only.
  - `slug` string, slug — Human-readable identifier for the policy type. Automatically generated based on policy_type.
  - `slug_perm` string, slug — An auto-generated id that uniquely identifies the API key policy.
  - `updated_at` string, date-time

## Other responses

- `400` — Request could not be processed (see detail).
- `422` — Missing or invalid parameters (see detail).

## Changes

- **2026-09-03** `d84142c9e5ad` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/cloudsmith/apis/cloudsmith-api-v1/changes/orgs/:org/api-key-rules/:slug_perm/get.md)

---

[API](https://skmtc.dev/cloudsmith/apis/cloudsmith-api-v1.md) · [All operations](https://skmtc.dev/cloudsmith/apis/cloudsmith-api-v1/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cloudsmith/cloudsmith-api-v1/revisions/d84142c9e5ad/schema)