KEkeycardai
PolicyBindings

List policy set bindings for a zone

Changed on

Returns bindings for the zone, filtered by target and mode.

filter[target_type] defaults to zone and filter[mode] defaults to shadow when omitted (preserving the endpoint's historical shadow-only listing); pass explicit values to widen. The deprecated bare scope_type and mode parameters are honored as equivalents and suppress the respective defaults; supplying a bare parameter and its filter[...] form with different values returns 400. With an effective target type set of exactly zone, filter[target_id] values other than the zone ID return 400.

get/zones/{zone_id}/policy-bindings

Request

  • Base URL
    https://docs.keycard.ai (the document declares no server; this is the origin it was published from)
  • URL
    https://docs.keycard.ai/zones/{zone_id}/policy-bindings
  • Auth
    • HTTP bearer
    • or OAuth 2
      Client credentials
      Token URL: /service-account-token

Path parameters

zone_idstring required

The zone identifier

Query parameters

scope_type'zone'

Deprecated. Use filter[target_type] instead. Still honored for backward compatibility but only accepts zone; other values return 400. Conflicts with filter[target_type] return 400.

mode'shadow'

Deprecated. Use filter[mode] instead. Still honored for backward compatibility but only accepts shadow; other values return 400. Conflicts with filter[mode] return 400.

filter[target_type]string[]

Value shape for filter[<field>] query parameters.

Wire conventions:

  • Repeated parameter instances are OR-ed across values.
  • A single value containing comma-separated tokens is AND-ed across tokens.

Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz

Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.

Filter on target_type. Repeatable; repeated instances OR across values. See FilterValues in the shared spec for the full wire convention.

Allowed values: zone, user (resource and session are reserved and not yet accepted). Unknown values return 400 with the list of allowed values. Comma-separated single values are rejected with a 400 pointing at the repeated-parameter OR form.

Defaults to zone when omitted (and no deprecated equivalent parameter is supplied), so listings exclude principal-scoped elements unless explicitly widened. On listPolicies the default is skipped when filter[id] is present, so by-ID fetches resolve regardless of target.

Note: the allowed-value enum is enforced in the handler (not as an OpenAPI items.enum) so the server can return a targeted error for the comma-AND form instead of a generic "not in allowed values" response.

filter[target_id]string[]

Value shape for filter[<field>] query parameters.

Wire conventions:

  • Repeated parameter instances are OR-ed across values.
  • A single value containing comma-separated tokens is AND-ed across tokens.

Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz

Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.

Filter on target_id. Repeatable; repeated instances OR across values. See FilterValues in the shared spec for the full wire convention.

Zone-targeted elements carry the zone ID as their target_id. When the effective filter[target_type] set is exactly zone (including via its default), any filter[target_id] value other than the path zone_id returns 400 Bad Request.

filter[mode]string[]

Value shape for filter[<field>] query parameters.

Wire conventions:

  • Repeated parameter instances are OR-ed across values.
  • A single value containing comma-separated tokens is AND-ed across tokens.

Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz

Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.

Filter on binding mode. Repeatable; repeated instances OR across values. See FilterValues in the shared spec for the full wire convention.

Allowed values: active, shadow. Unknown values return 400 with the list of allowed values. Comma-separated single values are rejected with a 400 pointing at the repeated-parameter OR form.

Defaults to shadow when omitted (and the deprecated bare mode parameter is absent), preserving the endpoint's historical shadow-only listing. Pass filter[mode]=active (or both values) to widen.

Headers

X-API-Versionstring

API version header (date-based, e.g. 2026-02-01)

X-Client-Request-IDstring uuid

Unique request identifier specified by the originating caller and passed along by proxies.

Response

List of bindings

Changes

  • 0cfaff865771Revision changes
    • breaking

      the response property // became optional for the status

    • breaking

      the response property // became optional for the status

    • breaking

      the response property // became optional for the status

    • breaking

      the response property // became optional for the status

    • breaking

      the response property // became optional for the status

    • breaking

      the response property // became optional for the status

    • breaking

      the // response's property type changed from string to no type for status

    • breaking

      the // response's property type changed from string to no type for status

    • breaking

      the // response's property type changed from string to no type for status

    • breaking

      the // response's property type changed from string to no type for status

    • breaking

      the // response's property type changed from string to no type for status

    • breaking

      the // response's property type changed from string to no type for status

    • warning

      added the new not_implemented enum value to the response property for the response status

    • warning

      added the new not_implemented enum value to the response property for the response status

    • warning

      added the new not_implemented enum value to the response property for the response status

    • warning

      added the new not_implemented enum value to the response property for the response status

    • warning

      added the new not_implemented enum value to the response property for the response status

    • warning

      added the new not_implemented enum value to the response property for the response status

    • info

      added subschema #2 to the // response property anyOf list for the response status

    • info

      added subschema #2 to the // response property anyOf list for the response status

    • info

      added subschema #2 to the // response property anyOf list for the response status

    • info

      added subschema #2 to the // response property anyOf list for the response status

    • info

      added subschema #2 to the // response property anyOf list for the response status

    • info

      added subschema #2 to the // response property anyOf list for the response status

    • info

      removed the bad_request enum value from the // response property for the response status

    • info

      removed the bad_request enum value from the // response property for the response status

    • info

      removed the bad_request enum value from the // response property for the response status

    • info

      removed the bad_request enum value from the // response property for the response status

    • info

      removed the bad_request enum value from the // response property for the response status

    • info

      removed the bad_request enum value from the // response property for the response status

    • info

      removed the conflict enum value from the // response property for the response status

    • info

      removed the conflict enum value from the // response property for the response status

    • info

      removed the conflict enum value from the // response property for the response status

    • info

      removed the conflict enum value from the // response property for the response status

    • info

      removed the conflict enum value from the // response property for the response status

    • info

      removed the conflict enum value from the // response property for the response status

    • info

      removed the forbidden enum value from the // response property for the response status

    • info

      removed the forbidden enum value from the // response property for the response status

    • info

      removed the forbidden enum value from the // response property for the response status

    • info

      removed the forbidden enum value from the // response property for the response status

    • info

      removed the forbidden enum value from the // response property for the response status

    • info

      removed the forbidden enum value from the // response property for the response status

    • info

      removed the internal_error enum value from the // response property for the response status

    • info

      removed the internal_error enum value from the // response property for the response status

    • info

      removed the internal_error enum value from the // response property for the response status

    • info

      removed the internal_error enum value from the // response property for the response status

    • info

      removed the internal_error enum value from the // response property for the response status

    • info

      removed the internal_error enum value from the // response property for the response status

    • info

      removed the not_found enum value from the // response property for the response status

    • info

      removed the not_found enum value from the // response property for the response status

    • info

      removed the not_found enum value from the // response property for the response status

    • info

      removed the not_found enum value from the // response property for the response status

    • info

      removed the not_found enum value from the // response property for the response status

    • info

      removed the not_found enum value from the // response property for the response status

    • info

      removed the rate_limit_exceeded enum value from the // response property for the response status

    • info

      removed the rate_limit_exceeded enum value from the // response property for the response status

    • info

      removed the rate_limit_exceeded enum value from the // response property for the response status

    • info

      removed the rate_limit_exceeded enum value from the // response property for the response status

    • info

      removed the rate_limit_exceeded enum value from the // response property for the response status

    • info

      removed the rate_limit_exceeded enum value from the // response property for the response status

    • info

      removed the service_unavailable enum value from the // response property for the response status

    • info

      removed the service_unavailable enum value from the // response property for the response status

    • info

      removed the service_unavailable enum value from the // response property for the response status

    • info

      removed the service_unavailable enum value from the // response property for the response status

    • info

      removed the service_unavailable enum value from the // response property for the response status

    • info

      removed the service_unavailable enum value from the // response property for the response status

    • info

      removed the unauthorized enum value from the // response property for the response status

    • info

      removed the unauthorized enum value from the // response property for the response status

    • info

      removed the unauthorized enum value from the // response property for the response status

    • info

      removed the unauthorized enum value from the // response property for the response status

    • info

      removed the unauthorized enum value from the // response property for the response status

    • info

      removed the unauthorized enum value from the // response property for the response status

    • info

      removed the validation_error enum value from the // response property for the response status

    • info

      removed the validation_error enum value from the // response property for the response status

    • info

      removed the validation_error enum value from the // response property for the response status

    • info

      removed the validation_error enum value from the // response property for the response status

    • info

      removed the validation_error enum value from the // response property for the response status

    • info

      removed the validation_error enum value from the // response property for the response status

  • 1a0dd4d857eeRevision changes
    • warning

      added the new active enum value to the // response property for the response status

    • info

      added the new optional query request parameter filter[mode]

    • info

      added the new optional query request parameter filter[target_id]

    • info

      added the new optional query request parameter filter[target_type]

    • info

      query request parameter mode was deprecated

    • info

      query request parameter scope_type was deprecated

    • info

      added the non-success response with the status

    • info

      response property items/items/scope_target_id deprecated

    • info

      response property items/items/scope_type deprecated

    • info

      added the required property // to the response with the status

    • info

      added the required property // to the response with the status