---
title: "List policy schemas"
method: GET
path: "/zones/{zone_id}/policy-schemas"
tags: ["PolicySchemas"]
---

# List policy schemas

`GET /zones/{zone_id}/policy-schemas`

## Request

- Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.keycard.ai/zones/{zone_id}/policy-schemas`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Client credentials
    - Token URL: `/service-account-token`

## Path parameters

- `zone_id` string, required

## Query parameters

- `after` string: An opaque cursor used for paginating through a list of results
- `before` string: An opaque cursor used for paginating through a list of results
- `limit` integer
- `expand` PdpExpandField[]
- `expand[]` PdpExpandField[]
- `sort` 'created_at'
- `order` 'asc' | 'desc'
- `format` 'cedar' | 'json'
- `is_default` boolean
- `filter[default]` boolean

## Headers

- `X-API-Version` string
- `X-Client-Request-ID` string, uuid

## Response `200`

A paginated list of policy schemas

- PdpPolicySchemasList
  - `items` PdpSchemaVersionWithZoneInfo[], required
    - `version` string, required
    - `status` 'active' | 'deprecated' | 'archived', required: Controls what can be done with this schema version: - `"active"` - new policy versions can be created and validated against it. - `"deprecated"` - superseded by a newer version but still accepts new policy versions. - `"archived"` - closed to new policy versions. Existing policy set versions pinned to this schema still evaluate normally.
    - `cedar_schema` string, nullable: Cedar schema in human-readable syntax. Populated when format=cedar.
    - `cedar_schema_json` object, nullable: Cedar schema as JSON object. Populated when format=json (default).
    - `deprecated_at` string, date-time, nullable
    - `archived_at` string, date-time, nullable
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
    - `is_default` boolean, required: Whether this is the zone's default schema. Clients use this to pre-select which schema to write policies against. Has no effect on evaluation.
  - `pagination` PdpPagination, required: Cursor-based pagination metadata returned alongside a list of results
    - `before_cursor` string, required: An opaque cursor used for paginating through a list of results
    - `after_cursor` string, required: An opaque cursor used for paginating through a list of results
    - `total_count` integer: Total number of items across all pages. Only present when the request includes ?expand[]=total_count.

## Other responses

- `400`: bad request error response when caller supplied invalid input data
- `401`: unauthorized error response when caller session is not authenticated
- `403`: forbidden error response when caller does not have permissions to a resource
- `404`: not found error response when caller does not have permission to see a resource or the resource does not exist
- `429`: rate limit exceeded error response when caller has exhausted api limits for the given time period
- `500`: internal server error response when server encountered error of its own creation
- `503`: service unavailable error when server you're attempting to reach is not available
- `default`: internal server error response when server encountered error of its own creation

## Changes

- **2026-10-16** `0cfaff865771`: 16 breaking, 8 warning, 82 info
  - the response property `details/items/field` became optional for the status `400`
  - the response property `details/items/field` became optional for the status `401`
  - the response property `details/items/field` became optional for the status `403`
  - the response property `details/items/field` became optional for the status `404`
  - …102 more
- **2026-04-24** `fcab5a5e6cd0`: 2 breaking, 2 warning, 6 info
  - for the `query` request parameter `after`, the minLength was increased from `0` to `1`
  - for the `query` request parameter `before`, the minLength was increased from `0` to `1`
  - for the `query` request parameter `after`, the maxLength was set to `255`
  - for the `query` request parameter `before`, the maxLength was set to `255`
  - …6 more
- **2026-04-02** `aee6e66de0d3`: 1 info
  - the endpoint scheme security `OAuth2` was added to the API
- **2026-03-16** `d3d69f45bfed`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/keycardai/apis/untitled-api/changes/zones/:zone_id/policy-schemas/get.md)

---

[API](https://skmtc.dev/keycardai/apis/untitled-api.md) - [All operations](https://skmtc.dev/keycardai/apis/untitled-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/untitled-api/revisions/0dee67e0a73a?raw)