---
title: "Read a protected action"
method: GET
path: "/api/v1/actions/{action_id}"
tags: ["canonical"]
---

# Read a protected action

`GET /api/v1/actions/{action_id}`

## Request

- Base URL: `https://app.graypass.org` (the document declares no server; this is the origin it was published from)
- URL: `https://app.graypass.org/api/v1/actions/{action_id}`
- Auth: HTTP bearer

Inspect the action’s display metadata, mode and active policy settings before integration or a configuration change.

## Path parameters

- `action_id` string, required

## Response `200`

ProtectedAction with mode and effective active policy settings.

- ProtectedAction: Protected-action metadata together with the currently selected policy settings and evaluation mode.
  - `active_policy_version` integer, nullable: Currently active policy version number, or null when no version is active.
  - `allowed_audiences` string[], required: Relying-party audience identifiers allowed to receive proofs for this action.
  - `allowed_callers` string[], required: Credential identifiers allowed to authorize this action. An empty list permits any eligible server credential in the same environment.
  - `consequence` string, required: Plain-language consequence if the wrong person performs the protected action.
  - `context_schema` object, required: JSON Schema object applied to authorization context. Include every business value that must be bound to approval.
  - `created_at` string, required: Creation time as an ISO 8601 timestamp.
  - `environment` string, required: Environment identifier that scopes this record; sandbox and live resources are separate.
  - `id` string, required: Identifier of this record. Treat it as opaque and retain it for subsequent operations.
  - `key` string, required: Stable dotted action key used by authorization, such as payout.destination.change.
  - `mode` 'test' | 'shadow' | 'enforce', required: Action evaluation mode. Test and shadow return decisions without enforceable proofs. An eligible enforce-mode allow can carry a proof.
  - `name` string, required: Customer-visible display name for the action or evaluation.
  - `proof_ttl_seconds` integer, required: Proof lifetime in seconds, measured from issuance; the accepted range is 30-900 seconds.
  - `resource_type` string, required: Customer-defined category of the protected resource, such as merchant.
  - `risk_class` 'low' | 'elevated' | 'high' | 'critical', required: Customer-selected consequence category for the action: low, elevated, high or critical.
  - `updated_at` string, required: Most recent update time as an ISO 8601 timestamp.

## Other responses

- `422`: The canonical handler returns a Problem for invalid input; correct the request before retrying.

---

[API](https://skmtc.dev/graypass/apis/graypass-api.md) - [All operations](https://skmtc.dev/graypass/apis/graypass-api/llms.txt) - [OpenAPI document](https://skmtc.dev/graypass/apis/graypass-api/revisions/5f9ab64fdfdb?raw)