---
title: "Get the manifest of a policy set version"
method: GET
path: "/zones/{zone_id}/policy-sets/{policy_set_id}/manifest"
tags: ["PolicySetManifest"]
---

# Get the manifest of a policy set version

`GET /zones/{zone_id}/policy-sets/{policy_set_id}/manifest`

## Request

- Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.keycard.ai/zones/{zone_id}/policy-sets/{policy_set_id}/manifest`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Client credentials
    - Token URL: `/service-account-token`

Returns the resolved manifest of the **latest non-archived version** by
default. Pass `?version=` with a policy set version public ID to read a
specific version's manifest (e.g. for rollback: GET an old manifest,
PUT it back — which mints a new version at the tip with the old
content; history is never re-pointed).

There is deliberately no `?version=active` keyword: a binding slot is
`(zone, target_type, target_id, mode)` and a set may have zero or
several active bindings, so "the active version" is not a function of
the set alone. Resolve the version ID first — from the enriched policy
set representation (`active_version_id`) or `GET /policy-bindings` —
then pass it here.

The default (latest) read anchors the apply flow: the `ETag` response
header is the JCS SHA-256 digest of the latest manifest and is the
value to send as `If-Match` on `PUT`. **`ETag` is emitted only on the
default latest read** — versioned reads return `manifest_sha` in the
body but no `ETag`, so a stale token cannot be round-tripped as a
precondition.

A policy set with no versions yet returns `200` with empty `entries`,
null `policy_set_version_id`/`version`/`schema_version`/`manifest_sha`,
and the digest of the empty manifest as `ETag`, so even the first
apply can be conditional.

## Path parameters

- `zone_id` string, required
- `policy_set_id` string, required

## Query parameters

- `version` string

## Headers

- `X-API-Version` string
- `X-Client-Request-ID` string, uuid

## Response `200`

The resolved manifest

- PdpPolicySetManifestDetail: Readback shape of a policy set version's manifest, richer than the write shape: each entry carries the resolved policy version ID and content SHA.
  - `policy_set_id` string, required
  - `policy_set_version_id` string, nullable: Null only for a policy set with no versions yet.
  - `version` integer, nullable: Monotonic version number. Null when no versions exist yet.
  - `schema_version` string, nullable: Null when no versions exist yet.
  - `manifest_sha` string, nullable: JCS SHA-256 digest of the stored manifest of the returned version. Null when no versions exist yet. On the default latest read this is the same value the `ETag` header carries.
  - `entries` PdpPolicySetManifestEntry[], required
    - `policy_id` string, required
    - `policy_version_id` string, required
    - `sha` string: SHA-256 of the policy version content, populated by the server

## Other responses

- `400`: bad request error response when caller supplied invalid input data
- `401`: unauthorized error response when caller session is not authenticated
- `403`: forbidden error response when caller does not have permissions to a resource
- `404`: Policy set not found (`policy_set_not_found`), or `?version=` names a version that does not exist (`policy_set_version_not_found`).
- `429`: rate limit exceeded error response when caller has exhausted api limits for the given time period
- `500`: internal server error response when server encountered error of its own creation
- `503`: service unavailable error when server you're attempting to reach is not available
- `default`: internal server error response when server encountered error of its own creation

## Changes

- **2026-10-16** `0cfaff865771`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/keycardai/apis/untitled-api/changes/zones/:zone_id/policy-sets/:policy_set_id/manifest/get.md)

---

[API](https://skmtc.dev/keycardai/apis/untitled-api.md) - [All operations](https://skmtc.dev/keycardai/apis/untitled-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/untitled-api/revisions/0dee67e0a73a?raw)