--- title: "Returns a list of MeshTrafficPermission in the mesh." method: GET path: "/v1/mesh/control-planes/{cpId}/api/meshes/{mesh}/meshtrafficpermissions" tags: ["MeshTrafficPermission"] --- # Returns a list of MeshTrafficPermission in the mesh. `GET /v1/mesh/control-planes/{cpId}/api/meshes/{mesh}/meshtrafficpermissions` ## Request - Base URL: `https://global.api.konghq.com` - URL: `https://global.api.konghq.com/v1/mesh/control-planes/{cpId}/api/meshes/{mesh}/meshtrafficpermissions` - Auth: one of: - HTTP bearer - HTTP bearer - HTTP bearer - HTTP bearer ## Path parameters - `mesh` string, required ## Query parameters - `offset` integer - `size` integer - `filter` object - `key` string - `value` string ## Response `200` List - object - `items` MeshTrafficPermissionItem[] - `type` 'MeshTrafficPermission', required: the type of the resource - `mesh` string: Mesh is the name of the Kuma mesh this resource belongs to. It may be omitted for cluster-scoped resources. - `kri` string: A unique identifier for this resource instance used by internal tooling and integrations. Typically derived from resource attributes and may be used for cross-references or indexing - `name` string, required: Name of the Kuma resource - `labels` object: The labels to help identity resources - `spec` object, required: Spec is the specification of the Kuma MeshTrafficPermission resource. - `from` object[]: From list makes a match between clients and corresponding configurations - `default` object: Default is a configuration specific to the group of clients referenced in 'targetRef' - `action` 'Allow' | 'Deny' | 'AllowWithShadowDeny': Action defines a behavior for the specified group of clients: - `targetRef` object, required: TargetRef is a reference to the resource that represents a group of clients. - `kind` 'Mesh' | 'MeshSubset' | 'MeshGateway' | 'MeshService' | 'MeshExternalService' | 'MeshMultiZoneService' | 'MeshServiceSubset' | 'MeshHTTPRoute' | 'Dataplane', required: Kind of the referenced resource - `labels` object: Labels are used to select group of MeshServices that match labels. Either Labels or Name and Namespace can be used. - `mesh` string: Mesh is reserved for future use to identify cross mesh resources. - `name` string: Name of the referenced resource. Can only be used with kinds: `MeshService`, `MeshServiceSubset` and `MeshGatewayRoute` - `namespace` string: Namespace specifies the namespace of target resource. If empty only resources in policy namespace will be targeted. - `proxyTypes` string[]: ProxyTypes specifies the data plane types that are subject to the policy. When not specified, all data plane types are targeted by the policy. - `sectionName` string: SectionName is used to target specific section of resource. For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected. - `tags` object: Tags used to select a subset of proxies by tags. Can only be used with kinds `MeshSubset` and `MeshServiceSubset` - `rules` object[]: Rules defines inbound permissions configuration - `default` object, required - `allow` object[]: Allow definees a list of matches for which access will be allowed - `sni` object: SNI defines a matcher configuration for matching by SNI value carried on the TLS connection - … - `spiffeID` object: SpiffeID defines a matcher configuration for SpiffeID matching - … - `allowWithShadowDeny` object[]: AllowWithShadowDeny defines a list of matches for which access will be allowed but emits logs as if requests are denied - `sni` object: SNI defines a matcher configuration for matching by SNI value carried on the TLS connection - … - `spiffeID` object: SpiffeID defines a matcher configuration for SpiffeID matching - … - `deny` object[]: Deny defines a list of matches for which access will be denied - `sni` object: SNI defines a matcher configuration for matching by SNI value carried on the TLS connection - … - `spiffeID` object: SpiffeID defines a matcher configuration for SpiffeID matching - … - `targetRef` object: TargetRef is a reference to the resource the policy takes an effect on. The resource could be either a real store object or virtual resource defined inplace. - `kind` 'Mesh' | 'MeshSubset' | 'MeshGateway' | 'MeshService' | 'MeshExternalService' | 'MeshMultiZoneService' | 'MeshServiceSubset' | 'MeshHTTPRoute' | 'Dataplane', required: Kind of the referenced resource - `labels` object: Labels are used to select group of MeshServices that match labels. Either Labels or Name and Namespace can be used. - `mesh` string: Mesh is reserved for future use to identify cross mesh resources. - `name` string: Name of the referenced resource. Can only be used with kinds: `MeshService`, `MeshServiceSubset` and `MeshGatewayRoute` - `namespace` string: Namespace specifies the namespace of target resource. If empty only resources in policy namespace will be targeted. - `proxyTypes` string[]: ProxyTypes specifies the data plane types that are subject to the policy. When not specified, all data plane types are targeted by the policy. - `sectionName` string: SectionName is used to target specific section of resource. For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected. - `tags` object: Tags used to select a subset of proxies by tags. Can only be used with kinds `MeshSubset` and `MeshServiceSubset` - `creationTime` string, date-time: Time at which the resource was created - `modificationTime` string, date-time: Time at which the resource was updated - `total` number: The total number of entities - `next` string: URL to the next page ## Changes - **2026-08-18** `658ffb748f95`: 3 info - added the optional property `items/items/spec/rules/items/default/allow/items/sni` to the response with the `200` status - added the optional property `items/items/spec/rules/items/default/allowWithShadowDeny/items/sni` to the response with the `200` status - added the optional property `items/items/spec/rules/items/default/deny/items/sni` to the response with the `200` status - **2025-11-06** `5d2b35832e3f`: 1 info - added the optional property `items/items/kri` to the response with the `200` status - **2025-10-02** `ecce2daf9de6`: 1 info - added the optional property `items/items/spec/rules` to the response with the `200` status [Operation history](https://skmtc.dev/kong/apis/konnect-api-beta/changes/v1/mesh/control-planes/:cpId/api/meshes/:mesh/meshtrafficpermissions/get.md) --- [API](https://skmtc.dev/kong/apis/konnect-api-beta.md) - [All operations](https://skmtc.dev/kong/apis/konnect-api-beta/llms.txt) - [OpenAPI document](https://skmtc.dev/kong/apis/konnect-api-beta/revisions/cef0f947e9c9?raw)