---
title: "Get the password policy"
method: GET
path: "/api/{org_id}/settings/password_policy"
tags: ["Organizations"]
---

# Get the password policy

`GET /api/{org_id}/settings/password_policy`

## Request

- Base URL: `https://api.openobserve.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.openobserve.ai/api/{org_id}/settings/password_policy`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/openobserve/apis/openobserve-api-http/docs/api/:org_id/settings/password_policy/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns the authentication policy enforced for native users across the whole deployment: password complexity, rotation, reuse prevention and account lockout. Requires Root or Admin on the meta organization, because the full policy includes lockout thresholds and history depth; callers who only need the password requirements should use /{org_id}/password_complexity. An instance that has never configured a policy returns the built-in defaults rather than an error, so this endpoint never 404s.

## Path parameters

- `org_id` string, required

## Response `200`

Success

- PasswordPolicy: The resolved instance-wide policy.
  - `apply_to_root` boolean: Whether root is held to rotation and lockout like every other native user. Default `false`, which is the documented exemption: root is the only account that can repair a misconfigured policy, and the only one whose lockout has no remedy from inside the product. Complexity and reuse already apply to root at password-set time whatever this says; the tightening sweep never touches root either way, so root is never mass-flagged.
  - `cookie_max_age_secs` integer: How long a sign-in cookie stays valid, in seconds. `0` defers to `ZO_COOKIE_MAX_AGE`. This is the browser's copy of the credential, not a server-side session: shortening it makes the browser stop sending the cookie sooner, and does nothing to a copy taken from it. It applies from the next sign-in — cookies already issued keep the lifetime they were given.
  - `history_count` integer: `0` disables reuse prevention.
  - `history_max_retained` integer: Hashes retained per user; kept at or above `history_count` so a later increase to `history_count` has history to check against.
  - `lockout` LockoutPolicy: Failed-login lockout knobs.
    - `backoff` 'linear' | 'exponential': How lockout duration grows with each successive lockout.
    - `bucket_size` integer: Failed attempts before each subsequent lockout. `0` reuses `threshold`.
    - `max_secs` integer
    - `start_secs` integer
    - `threshold` integer: Failed attempts before the first lockout. `0` disables lockout entirely.
  - `max_length` integer: Between `min_length` and 128; a stored legacy `0` still reads as unbounded.
  - `min_length` integer
  - `require_digit` boolean
  - `require_lowercase` boolean
  - `require_special` boolean
  - `require_uppercase` boolean
  - `rotation_days` integer: `0` disables rotation enforcement.
  - `rotation_warning_days` integer: Days before expiry to start warning. `0` = never warn; equal to `rotation_days` = warn on every request, since no live password is then outside the window.
  - `special_char_set` string: Empty means any non-alphanumeric character counts as special.

## Other responses

- `403`: Forbidden

---

[API](https://skmtc.dev/openobserve/apis/openobserve-api-http.md) - [All operations](https://skmtc.dev/openobserve/apis/openobserve-api-http/llms.txt) - [OpenAPI document](https://skmtc.dev/openobserve/apis/openobserve-api-http/revisions/0529b8a10252?raw)