---
title: "Get a policy set binding by ID"
method: GET
path: "/zones/{zone_id}/policy-bindings/{binding_id}"
tags: ["PolicyBindings"]
---

# Get a policy set binding by ID

`GET /zones/{zone_id}/policy-bindings/{binding_id}`

## Request

- Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.keycard.ai/zones/{zone_id}/policy-bindings/{binding_id}`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Client credentials
    - Token URL: `/service-account-token`

Returns a specific binding by its stable identifier.

## Path parameters

- `zone_id` string, required
- `binding_id` string, required

## Headers

- `X-API-Version` string
- `X-Client-Request-ID` string, uuid

## Response `200`

The binding

- PdpPolicySetBinding
  - `id` string, required: Binding identifier (stable per slot)
  - `scope_type` 'zone', required: **Deprecated.** Use `target_type` instead. Carries the same value.
  - `scope_target_id` string, required: **Deprecated.** Use `target_id` instead. Carries the same value.
  - `target_type` 'zone' | 'user', required: What this binding targets
  - `target_id` string, required: Target entity ID. Equals zone_id for zone-targeted bindings.
  - `mode` 'active' | 'shadow', required: Binding mode
  - `policy_set_id` string, required: Public ID of the bound policy set
  - `policy_set_version_id` string, required: Public ID of the bound policy set version
  - `created_at` string, date-time, required

## Other responses

- `401`: unauthorized error response when caller session is not authenticated
- `403`: forbidden error response when caller does not have permissions to a resource
- `404`: not found error response when caller does not have permission to see a resource or the resource does not exist
- `429`: rate limit exceeded error response when caller has exhausted api limits for the given time period
- `500`: internal server error response when server encountered error of its own creation
- `default`: internal server error response when server encountered error of its own creation

## Changes

- **2026-10-16** `0cfaff865771`: 12 breaking, 6 warning, 60 info
  - the response property `details/items/field` became optional for the status `401`
  - the response property `details/items/field` became optional for the status `403`
  - the response property `details/items/field` became optional for the status `404`
  - the response property `details/items/field` became optional for the status `429`
  - …74 more
- **2026-06-17** `1a0dd4d857ee`: 1 warning, 4 info
  - added the new `active` enum value to the `mode` response property for the response status `200`
  - response property `scope_target_id` deprecated
  - response property `scope_type` deprecated
  - added the required property `target_id` to the response with the `200` status
  - …1 more
- **2026-04-20** `932699a5ea16`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/changes/zones/:zone_id/policy-bindings/:binding_id/get.md)

---

[API](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api.md) - [All operations](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/revisions/0dee67e0a73a?raw)