---
title: "List policies"
method: GET
path: "/api/v1/tenants/{tenantId}/policies"
tags: ["Policies"]
---

# List policies

`GET /api/v1/tenants/{tenantId}/policies`

## Request

- Base URL: `http://dobby-ai.com`
- URL: `http://dobby-ai.com/api/v1/tenants/{tenantId}/policies`
- Auth: HTTP bearer

List policies for the tenant scope, optionally filtered by layer (1=Platform, 2=Org, 3=Tenant, 4=Process). Layer 4 requires `workflow_id`. Auth: NextAuth session OR an `sk_live_` API key (`Authorization: Bearer` or `X-API-Key`).

## Path parameters

- `tenantId` string, required

## Query parameters

- `layer` integer
- `include_inactive` '1'
- `workflow_id` string

## Response `200`

Policies for the requested scope

- object
  - `success` boolean
  - `data` object
    - `tenant_id` string
    - `org_id` string
    - `layer` integer, nullable
    - `count` integer
    - `policies` Policy[]
      - `policy_id` string
      - `layer` 1 | 2 | 3 | 4: 1=Platform, 2=Org, 3=Tenant, 4=Process
      - `scope_id` string, nullable: null for layer 1; org_id for layer 2; tenant_id for layer 3; workflow_id for layer 4
      - `text` string
      - `source` string
      - `framework_ref` string, nullable
      - `severity` 'critical' | 'high' | 'medium' | 'low'
      - `is_active` boolean
      - `version` integer
      - `authored_by` string, nullable
      - `created_at` string, date-time
      - `updated_at` string, date-time
    - `can_edit` boolean

## Other responses

- `400`: Bad Request - Invalid parameters
- `401`: Unauthorized - Missing or invalid authentication
- `403`: Forbidden - Missing required scope
- `404`: Not Found - Resource does not exist

---

[API](https://skmtc.dev/dobby-ai/apis/dobby-platform-api.md) · [All operations](https://skmtc.dev/dobby-ai/apis/dobby-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dobby-ai/apis/dobby-platform-api/revisions/398634f0306f?raw)