---
title: "List policy overrides"
method: GET
path: "/api/v1/overrides"
tags: ["Decisions & Overrides"]
---

# List policy overrides

`GET /api/v1/overrides`

## Request

- Base URL: `https://orchestrator.getaxonflow.com`
- URL: `https://orchestrator.getaxonflow.com/api/v1/overrides`
- Auth: none declared. Required headers: `X-Tenant-ID`
- TypeScript: <https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/docs/api/v1/overrides/get.ts> (a function with typed inputs; its response is checked against the schema)

Lists the tenant's policy overrides, newest first, capped at 100
rows. Revoked overrides are excluded unless `include_revoked=true`.

**Role-scoped reads (#2922):** `admin`/`owner` list every override in
the tenant; every other role lists only the overrides they created
(`created_by`). Revoking an override is scoped the same way. The
role/scope is trusted only over the internal proxy-auth channel.

## Query parameters

- `policy_id` string
- `include_revoked` boolean

## Headers

- `X-Tenant-ID` string, required

## Response `200`

Override list

- object
  - `overrides` OverrideSummary[]: Always a JSON array (`[]` when empty)
    - `id` string, required
    - `policy_id` string, required: The policy this override applies to. **Its VALUE differs by view, deliberately, and has since before the three views were collapsed onto one shape.** `GET /api/v1/overrides` and `GET /api/v1/overrides/{id}` return the canonical UUID stored on the row. Before v11.0.0 the create ECHOED THE VALUE SENT IN THE REQUEST and does not resolve it to a UUID — a caller may create an override by slug or name, and the create response hands back what they sent. A client correlating a created override with a later listing must key on `id`, not on `policy_id`. One SHAPE across the views is what issue #3944 asked for and what these three now have; identical values on every member is a different property, and this member does not hold it.
    - `policy_type` string, required: `static` or `dynamic`. Deliberately NOT declared as an `enum`: on a RESPONSE property oasdiff reads a newly-declared enum as values being ADDED to a set clients already switch on, and reports four breaking changes for a constraint that tightens nothing.
    - `tenant_id` string: ABSENT on an org-scoped override — the key is omitted, not sent as `null`. A NULL tenant column is what makes a row org-scoped rather than tenant-scoped, and the platform marshals that as an omitted member. An earlier revision of this description said "null", which no response ever contains and which this schema would reject.
    - `org_id` string, required: The organisation that owns this override. This is the canonical spelling on this surface — it is what the column is called and what the agent plane's view of the same table has always emitted.
    - `organization_id` string, required: DEPRECATED alias of `org_id`, always carrying the same value. Read `org_id`. Retained rather than removed because this is a published endpoint and a shipped client may read it. Unrelated to the `organization_id` on the POLICY surface, which is current and not deprecated; the two share a name and nothing else.
    - `action_override` string: WHAT THE OVERRIDE DOES. Absent from this plane's views before #3944, which is why an operator could not tell one override from another. Every row created before v11.0.0 carries `allow`.
    - `enabled_override` boolean: Whether the policy is force-enabled or force-disabled by this override. Absent on a row created before v11.0.0 through `POST /api/v1/overrides`, which does not set it.
    - `override_reason` string, required: The mandatory ADR-044 justification (max 500 chars).
    - `expires_at` string, date-time
    - `tool_signature` string: Present when the override is restricted to a single tool.
    - `created_by` string, required
    - `created_at` string, date-time, required
    - `revoked_at` string, date-time: Present only on revoked overrides
    - `revoked_by` string: Present only on revoked overrides
  - `count` integer

## Other responses

- `400`: Missing X-Tenant-ID header
- `500`: Internal error

---

[API](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api.md) - [All operations](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/revisions/f408ef3ec9dd?raw)