---
title: "List static policies"
method: GET
path: "/api/v1/static-policies"
tags: ["Static Policies"]
deprecated: true
---

# List static policies

`GET /api/v1/static-policies`

## Request

- Base URL: `https://agent.getaxonflow.com`
- URL: `https://agent.getaxonflow.com/api/v1/static-policies`
- Auth: none declared
- TypeScript: <https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/docs/api/v1/static-policies/get.ts> (a function with typed inputs; its response is checked against the schema)

> **Deprecated.**

Returns static policies with three-tier hierarchy resolution:
1. **System policies** - Managed by AxonFlow, immutable base
2. **Organization policies** - Enterprise tier, organization-wide (Enterprise only)
3. **Tenant policies** - Per-tenant customizations

**v2.0.0 Categories** (semantic naming):
- `security-sqli` - SQL injection detection (was: sql_injection)
- `security-admin` - Admin access protection (was: admin_access)
- `pii-global` - Global PII patterns (was: pii_detection)
- `pii-us` - US-specific PII (SSN, etc.)
- `pii-eu` - EU-specific PII (GDPR)
- `pii-india` - India-specific PII (Aadhaar, PAN)
- `custom` - Tenant-created policies

Legacy category names are still accepted and automatically mapped.

Part of ADR-019: Unified Policy Management System.

## Query parameters

- `page` integer
- `page_size` integer
- `category` 'security-sqli' | 'security-admin' | 'pii-global' | 'pii-us' | 'pii-eu' | 'pii-india' | 'custom' | 'sql_injection' | 'pii_detection' | 'dangerous_queries' | 'admin_access'
- `tier` 'system' | 'organization' | 'tenant'
- `severity` 'critical' | 'high' | 'medium' | 'low'
- `enabled` boolean

## Headers

- `Authorization` string

## Response `200`

List of static policies

- StaticPoliciesListResponse
  - `policies` StaticPolicy[]: List of static policies
    - `id` string, uuid, required: Unique policy UUID
    - `policy_id` string, required: Human-readable policy identifier (e.g., sys_sqli_union_select)
    - `name` string, required: Display name of the policy
    - `description` string: Detailed policy description
    - `category` 'security-sqli' | 'security-admin' | 'pii-global' | 'pii-us' | 'pii-eu' | 'pii-india' | 'custom', required: Policy category (v2.0.0 semantic naming)
    - `tier` 'system' | 'organization' | 'tenant': Policy tier in the hierarchy
    - `pattern` string, required: Regex pattern for detection
    - `severity` 'critical' | 'high' | 'medium' | 'low', required: Policy severity level
    - `action` 'block' | 'require_approval' | 'redact' | 'warn' | 'log', required: Action to take when pattern matches. require_approval triggers HITL queue for human oversight.
    - `enabled` boolean, required: Whether policy is active
    - `priority` integer: Evaluation priority (higher = evaluated first)
    - `version` integer: Policy version number
    - `has_override` boolean: Whether this policy has an override (Enterprise only)
    - `override` PolicyOverride: Override configuration for system policies (Enterprise only)
      - `id` string: Override identifier
      - `policy_id` string: ID of the policy being overridden
      - `policy_type` 'static' | 'dynamic': Type of policy being overridden
      - `tenant_id` string: Tenant ID for tenant-level overrides
      - `enabled_override` boolean: Override enabled status (null = no override)
      - `action_override` 'block' | 'require_approval' | 'redact' | 'warn' | 'log': Override action (must be more restrictive). require_approval triggers HITL queue.
      - `override_reason` string: Reason for the override (required for audit)
      - `expires_at` string, date-time: When the override automatically expires
      - `created_by` string: User who created the override
      - `created_at` string, date-time
      - `updated_by` string: User who last updated the override
      - `updated_at` string, date-time
    - `tenant_id` string, required: Tenant ID (for tenant-tier policies)
    - `created_at` string, date-time, required: When policy was created
    - `updated_at` string, date-time, required: When policy was last modified
  - `pagination` StaticPolicyPagination
    - `page` integer: Current page number (1-indexed)
    - `page_size` integer: Number of items per page
    - `total` integer: Total number of policies
    - `total_pages` integer: Total number of pages

## Other responses

- `400`: Invalid request body or parameters

---

[API](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api.md) - [All operations](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/revisions/34d30fcb7fa1?raw)