--- title: "List captured evaluation requests" method: GET path: "/zones/{zone_id}/policy-evaluations/requests" tags: ["PolicyEvaluations"] --- # List captured evaluation requests `GET /zones/{zone_id}/policy-evaluations/requests` ## Request - Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from) - URL: `https://docs.keycard.ai/zones/{zone_id}/policy-evaluations/requests` - Auth: one of: - HTTP bearer - OAuth 2 - Client credentials - Token URL: `/service-account-token` Returns a paginated list of evaluation request entries captured from live credentials API traffic for the specified zone. Sorted by created_at descending (newest first). Use with the test evaluation endpoint for replay-based impact analysis. ## Path parameters - `zone_id` string, required ## Query parameters - `after` string: An opaque cursor used for paginating through a list of results - `before` string: An opaque cursor used for paginating through a list of results - `limit` integer - `expand[]` PdpExpandField[] - `sort` 'created_at' - `order` 'asc' | 'desc' - `query[action]` string[]: Value shape for `query[]` and `query[]` search parameters. Wire conventions: - Case-insensitive substring match (ILIKE). - Repeated parameter instances are OR-ed across terms. - Comma splitting is NOT performed; literal commas in a search term are preserved as part of the term. Examples: ?query[name]=alpha&query[name]=beta -> name ILIKE %alpha% OR name ILIKE %beta% ?query[]=alpha -> any searchable field ILIKE %alpha% Cross-field form is `query[]`; field-scoped form is `query[]`. Field names are endpoint-specific; services declare each query parameter per operation. - `filter[active_decision]` string[]: Value shape for `filter[]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[] parameter per operation with an appropriate items.type/items.enum override. - `filter[principal_type]` string[]: Value shape for `filter[]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[] parameter per operation with an appropriate items.type/items.enum override. - `filter[subject_type]` string[]: Value shape for `filter[]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[] parameter per operation with an appropriate items.type/items.enum override. - `filter[authority_type]` string[]: Value shape for `filter[]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[] parameter per operation with an appropriate items.type/items.enum override. - `filter[has_shadow]` boolean - `filter[principal_id]` string[]: Value shape for `filter[]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[] parameter per operation with an appropriate items.type/items.enum override. - `filter[resource_id]` string[]: Value shape for `filter[]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[] parameter per operation with an appropriate items.type/items.enum override. - `filter[subject_id]` string[]: Value shape for `filter[]` query parameters. Wire conventions: - Repeated parameter instances are OR-ed across values. - A single value containing comma-separated tokens is AND-ed across tokens. Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz Field names and allowed values are endpoint-specific; services declare each filter[] parameter per operation with an appropriate items.type/items.enum override. ## Headers - `X-API-Version` string - `X-Client-Request-ID` string, uuid ## Response `200` A paginated list of evaluation requests - PdpEvaluationRequestsList - `items` PdpEvaluationRequestItem[], required - `id` string, uuid, required: Unique identifier for this evaluation request entry. - `request_id` string, required: Correlation ID from the original credentials API request. - `principal_type` 'user' | 'application', required - `principal_id` string, required - `action` string, required - `resource_id` string, required - `subject_type` 'user' | 'application', nullable - `subject_id` string, nullable - `authority_type` 'delegation' | 'impersonation', nullable - `acting_principal_id` string, nullable: The verified RFC 8693 acting principal (nominated via actor_token) from the original check, when one was present. - `context` PdpEvaluationContext: Additional context for Cedar authorization evaluation. Fields here are mapped directly into the Cedar `context` record. - `scopes` string[]: OAuth scopes associated with the request. Mapped to `context.scopes` in the Cedar evaluation as a `Set`. - `session_id` string: Session identifier for the current authorization context. Mapped to `context.session_id` in Cedar. - `claims` PdpEvaluationClaims: Token claims for the actor, subject, and/or acting principal. Mapped to `context.actor_claims`, `context.subject_claims`, and `context.acting_principal_claims` in Cedar. - `actor` PdpClaimsData: Represents token claims passed into the Cedar context. Mapped to the Cedar `Keycard::Claims` type. Known fields (`email`, `groups`, `issuer_claims`) are typed; additional claims are passed through as untyped key-value pairs via `additionalProperties`. - `email` string: Email claim from the authentication token. - `groups` string[]: Group membership claims from the authentication token. - `issuer_claims` PdpIssuerClaims: Issuer-specific claims forwarded opaquely from STS (e.g. GHA OIDC assertion claims). Mapped to `context.actor_claims.issuer_claims` in Cedar. All fields are optional and issuer-dependent. See issuer documentation for available claim fields. - `subject` PdpClaimsData: Represents token claims passed into the Cedar context. Mapped to the Cedar `Keycard::Claims` type. Known fields (`email`, `groups`, `issuer_claims`) are typed; additional claims are passed through as untyped key-value pairs via `additionalProperties`. - `email` string: Email claim from the authentication token. - `groups` string[]: Group membership claims from the authentication token. - `issuer_claims` PdpIssuerClaims: Issuer-specific claims forwarded opaquely from STS (e.g. GHA OIDC assertion claims). Mapped to `context.actor_claims.issuer_claims` in Cedar. All fields are optional and issuer-dependent. See issuer documentation for available claim fields. - `acting_principal` PdpClaimsData: Represents token claims passed into the Cedar context. Mapped to the Cedar `Keycard::Claims` type. Known fields (`email`, `groups`, `issuer_claims`) are typed; additional claims are passed through as untyped key-value pairs via `additionalProperties`. - `email` string: Email claim from the authentication token. - `groups` string[]: Group membership claims from the authentication token. - `issuer_claims` PdpIssuerClaims: Issuer-specific claims forwarded opaquely from STS (e.g. GHA OIDC assertion claims). Mapped to `context.actor_claims.issuer_claims` in Cedar. All fields are optional and issuer-dependent. See issuer documentation for available claim fields. - `active_psv_id` string, uuid, required: ID of the active policy set version used for evaluation. - `active_schema_version` string, required: Cedar schema version of the active policy set version. - `active_decision` 'allow' | 'deny', required - `active_duration_ms` integer, required: Evaluation duration in milliseconds. - `shadow_psv_id` string, uuid, nullable: ID of the shadow policy set version, if a shadow binding existed. - `created_at` string, date-time, required - `pagination` PdpPagination, required: Cursor-based pagination metadata returned alongside a list of results - `before_cursor` string, required: An opaque cursor used for paginating through a list of results - `after_cursor` string, required: An opaque cursor used for paginating through a list of results - `total_count` integer: Total number of items across all pages. Only present when the request includes ?expand[]=total_count. ## Other responses - `400`: bad request error response when caller supplied invalid input data - `401`: unauthorized error response when caller session is not authenticated - `403`: forbidden error response when caller does not have permissions to a resource - `404`: not found error response when caller does not have permission to see a resource or the resource does not exist - `429`: rate limit exceeded error response when caller has exhausted api limits for the given time period - `500`: internal server error response when server encountered error of its own creation - `503`: service unavailable error when server you're attempting to reach is not available - `default`: internal server error response when server encountered error of its own creation ## Changes - **2026-10-16** `0cfaff865771`: 16 breaking, 8 warning, 83 info - the response property `details/items/field` became optional for the status `400` - the response property `details/items/field` became optional for the status `401` - the response property `details/items/field` became optional for the status `403` - the response property `details/items/field` became optional for the status `404` - …103 more - **2026-06-17** `1a0dd4d857ee`: 2 info - added the optional property `items/items/context/claims/actor/issuer_claims` to the response with the `200` status - added the optional property `items/items/context/claims/subject/issuer_claims` to the response with the `200` status - **2026-04-25** `abfbb819ecb9`: 1 info - endpoint added [Operation history](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/changes/zones/:zone_id/policy-evaluations/requests/get.md) --- [API](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api.md) - [All operations](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/revisions/0dee67e0a73a?raw)