---
title: "Read the credential policy"
method: GET
path: "/credential-policy"
tags: ["Credentials"]
---

# Read the credential policy

`GET /credential-policy`

## Request

- Base URL: `https://api.primitive.dev/v1`
- URL: `https://api.primitive.dev/v1/credential-policy`
- Auth: HTTP bearer

The organization credential policy: key lifetime and expiry rules, who may create super admin keys, whether members may create keys and the other rules every new key is held to. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.

Person only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.

## Response `200`

Success

- object
  - `success` true, required
  - `data` CredentialsGetCredentialPolicyResult, required
    - `max_key_lifetime_days` integer, nullable, required
    - `require_key_expiry` boolean, required
    - `super_admin_key_creators` 'owners_and_admins' | 'owners', required
    - `members_may_mint_keys` boolean, required
    - `allow_org_mail_scope_keys` boolean, required
    - `cap_agents_below_person` boolean, required
    - `removal_suspends_created` boolean, required
    - `oauth_consent_admin_only` boolean, required
    - `cli_access` 'owners_admins_and_operators' | 'owners_and_admins' | 'all_members' | 'off'

## Other responses

- `400`: Invalid request parameters
- `401`: Invalid or missing API key
- `403`: Authenticated caller lacks permission for the operation
- `404`: Resource not found
- `429`: Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.

---

[API](https://skmtc.dev/primitive/apis/primitive-api.md) - [All operations](https://skmtc.dev/primitive/apis/primitive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/primitive/apis/primitive-api/revisions/bce409c97acb?raw)