---
title: "The human-approval policy of one credential"
method: GET
path: "/credentials/{id}/hitl-policy"
tags: ["Account"]
---

# The human-approval policy of one credential

`GET /credentials/{id}/hitl-policy`

## Request

- Base URL: `https://api.imprezahost.com/v1`
- URL: `https://api.imprezahost.com/v1/credentials/{id}/hitl-policy`
- Auth: API key in header `X-API-Key` and API key in header `X-API-Secret`

The credential's stored HITL policy (F46-7b) and the EFFECTIVE one —
the union of its own and every ancestor's, which is what actually
governs it, because a sub-credential can only ever be tightened.

A marked operation does not run: it becomes an approval request a
person decides in the clientarea (API Management → Approvals).
Read-only like everything about approvals on this surface: the policy
is written in the clientarea, or inherited — narrowed — at mint time,
never loosened through the API.

## Response `200`

stored_policy and effective_policy (classes, operations, ttl_minutes)

## Other responses

- `404`: No such credential on this account

---

[API](https://skmtc.dev/imprezahost/apis/impreza-host-public-api.md) · [All operations](https://skmtc.dev/imprezahost/apis/impreza-host-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/imprezahost/apis/impreza-host-public-api/revisions/db86511f604f?raw)