---
title: "Fetch the effective Policy Bundle for the user"
method: GET
path: "/policy/bundle"
tags: ["PolicyBundle"]
---

# Fetch the effective Policy Bundle for the user

`GET /policy/bundle`

Returns the effective Policy Bundle for the user identified by the
zone-issued resource-scoped token. When no user-scope binding exists,
one will be generated from the default set.

The response body is a binary archive in the codec selected via the
`Accept` header. The only codec supported today is
`application/vnd.keycard.policy-bundle.v1+tar+gzip`. Clients SHOULD send
an explicit `Accept` header; absent one, the server defaults to the
tar+gzip codec.

Supports conditional fetch via `If-None-Match`: when the supplied ETag
matches the current bundle, the server responds `304 Not Modified` with
no body.

## Headers

- `X-Client-Request-ID` string, uuid
- `If-None-Match` string

## Response `200`

Bundle archive in the negotiated codec

## Other responses

- `304` — Bundle matches the supplied `If-None-Match` ETag
- `400` — Malformed request
- `401` — Missing or invalid token
- `404` — Bundle not found
- `415` — Requested codec is not supported
- `500` — Internal server error
- `501` — Endpoint not yet implemented

## Changes

- **2026-08-26** `d65d51379d93` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/keycardai/apis/untitled-api/changes/policy/bundle/get.md)

---

[API](https://skmtc.dev/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.dev/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/keycardai/untitled-api/revisions/d65d51379d93/schema)