---
title: "Access Control Decision API"
method: GET
path: "/decisions"
tags: ["api"]
---

# Access Control Decision API

`GET /decisions`

> This endpoint works with all HTTP Methods (GET, POST, PUT, ...) and matches every path prefixed with /decisions.

This endpoint mirrors the proxy capability of ORY Oathkeeper's proxy functionality but instead of forwarding the
request to the upstream server, returns 200 (request should be allowed), 401 (unauthorized), or 403 (forbidden)
status codes. This endpoint can be used to integrate with other API Proxies like Ambassador, Kong, Envoy, and many more.

## Response `200`

An empty response

## Other responses

- `401` — genericError
- `403` — genericError
- `404` — genericError
- `500` — genericError

## Changes

- **2022-02-08** `4a4308530ea1` — 4 info
  - added the media type `application/json` for the response with the status `401`
  - added the media type `application/json` for the response with the status `403`
  - added the media type `application/json` for the response with the status `404`
  - added the media type `application/json` for the response with the status `500`
- **2021-04-26** `26e7abf193b0` — 4 breaking
  - removed the media type `application/json` for the response with the status `401`
  - removed the media type `application/json` for the response with the status `403`
  - removed the media type `application/json` for the response with the status `404`
  - removed the media type `application/json` for the response with the status `500`

[Change history](https://skmtc.dev/ory/apis/ory-oathkeeper-api/changes/decisions/get.md)

---

[API](https://skmtc.dev/ory/apis/ory-oathkeeper-api.md) · [All operations](https://skmtc.dev/ory/apis/ory-oathkeeper-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ory/ory-oathkeeper-api/revisions/3a8f56666af1/schema)