---
title: "List policy set bindings for a zone"
method: GET
path: "/zones/{zone_id}/policy-bindings"
tags: ["PolicyBindings"]
---

# List policy set bindings for a zone

`GET /zones/{zone_id}/policy-bindings`

## Request

- Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.keycard.ai/zones/{zone_id}/policy-bindings`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Client credentials
    - Token URL: `/service-account-token`

Returns bindings for the zone, filtered by target and mode.

`filter[target_type]` defaults to `zone` and `filter[mode]`
defaults to `shadow` when omitted (preserving the endpoint's
historical shadow-only listing); pass explicit values to widen.
The deprecated bare `scope_type` and `mode` parameters are honored
as equivalents and suppress the respective defaults; supplying a
bare parameter and its `filter[...]` form with different values
returns 400. With an effective target type set of exactly `zone`,
`filter[target_id]` values other than the zone ID return 400.

## Path parameters

- `zone_id` string, required

## Query parameters

- `scope_type` 'zone'
- `mode` 'shadow'
- `filter[target_type]` string[]: Value shape for `filter[<field>]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.
- `filter[target_id]` string[]: Value shape for `filter[<field>]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.
- `filter[mode]` string[]: Value shape for `filter[<field>]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.

## Headers

- `X-API-Version` string
- `X-Client-Request-ID` string, uuid

## Response `200`

List of bindings

- object
  - `items` PdpPolicySetBinding[], required
    - `id` string, required: Binding identifier (stable per slot)
    - `scope_type` 'zone', required: **Deprecated.** Use `target_type` instead. Carries the same value.
    - `scope_target_id` string, required: **Deprecated.** Use `target_id` instead. Carries the same value.
    - `target_type` 'zone' | 'user', required: What this binding targets
    - `target_id` string, required: Target entity ID. Equals zone_id for zone-targeted bindings.
    - `mode` 'active' | 'shadow', required: Binding mode
    - `policy_set_id` string, required: Public ID of the bound policy set
    - `policy_set_version_id` string, required: Public ID of the bound policy set version
    - `created_at` string, date-time, required

## Other responses

- `400`: bad request error response when caller supplied invalid input data
- `401`: unauthorized error response when caller session is not authenticated
- `403`: forbidden error response when caller does not have permissions to a resource
- `429`: rate limit exceeded error response when caller has exhausted api limits for the given time period
- `500`: internal server error response when server encountered error of its own creation
- `default`: internal server error response when server encountered error of its own creation

## Changes

- **2026-10-16** `0cfaff865771`: 12 breaking, 6 warning, 60 info
  - the response property `details/items/field` became optional for the status `400`
  - the response property `details/items/field` became optional for the status `401`
  - the response property `details/items/field` became optional for the status `403`
  - the response property `details/items/field` became optional for the status `429`
  - …74 more
- **2026-06-17** `1a0dd4d857ee`: 1 warning, 10 info
  - added the new `active` enum value to the `items/items/mode` response property for the response status `200`
  - added the new optional `query` request parameter `filter[mode]`
  - added the new optional `query` request parameter `filter[target_id]`
  - added the new optional `query` request parameter `filter[target_type]`
  - …7 more
- **2026-04-20** `932699a5ea16`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/changes/zones/:zone_id/policy-bindings/get.md)

---

[API](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api.md) - [All operations](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/revisions/0dee67e0a73a?raw)