---
title: "List trusted workload policies"
method: GET
path: "/workload-identity/policies"
tags: ["Gateway"]
---

# List trusted workload policies

`GET /workload-identity/policies`

## Request

- Base URL: `https://api.phaseo.app/v1`
- URL: `https://api.phaseo.app/v1/workload-identity/policies`
- Auth: HTTP bearer

Lists the workspace's trusted workload policies: which Vercel deployments and GitHub Actions workflows may call the gateway with their OIDC token instead of an API key. Requires keys:read on management keys and OAuth tokens, or a workspace owner or admin. Available only to workspaces in the trusted workloads beta; other workspaces get 404.

## Response `200`

Trusted workload policies

- WorkloadIdentityPolicyListResponse
  - `data` WorkloadIdentityPolicy[], required
    - `id` string, uuid, required
    - `name` string, required
    - `provider` 'vercel' | 'github_actions', required: The platform that issues the OIDC tokens.
    - `issuer` string, required: Token issuer, for example https://oidc.vercel.com/acme or https://token.actions.githubusercontent.com.
    - `owner_id` string, required: The pinned Vercel team ID (owner_id claim) or GitHub organisation or user ID (repository_owner_id claim).
    - `claim_conditions` object, required: Extra claims the token must match, as claim name to allowed values, for example project_id and environment for Vercel, or repository_id and ref for GitHub Actions. Every claim must match one of its values. At most 15 claims and 20 values per claim; iss, aud, exp, iat, nbf and jti cannot be used, and the pinned owner claim is set with owner_id.
    - `max_token_lifetime_seconds` integer, required: Longest token lifetime (exp minus iat or nbf) the policy accepts.
    - `status` 'active' | 'disabled', required
    - `audience` string, required: The audience tokens must be issued for.
    - `key_id` string, uuid, required: The policy's key. Requests, usage and limits are recorded against it.
    - `last_used_at` string, date-time, nullable, required
    - `created_by` string, uuid, nullable, required
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
  - `audience` string, required: The audience tokens must be issued for.

## Other responses

- `default`: Request failed

## Changes

- **2026-10-27** `f48fc6c1db25`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/phaseo/apis/phaseo-gateway-api/changes/workload-identity/policies/get.md)

---

[API](https://skmtc.dev/phaseo/apis/phaseo-gateway-api.md) - [All operations](https://skmtc.dev/phaseo/apis/phaseo-gateway-api/llms.txt) - [OpenAPI document](https://skmtc.dev/phaseo/apis/phaseo-gateway-api/revisions/5ca9bb220d25?raw)