---
title: "Policy Rules For Asset"
method: GET
path: "/api/3/assets/{assetId}/policies/{policyId}/rules"
tags: ["Policy"]
---

# Policy Rules For Asset

`GET /api/3/assets/{assetId}/policies/{policyId}/rules`

## Request

- Base URL: `https://<host>:<port>`
- URL: `https://<host>:<port>/api/3/assets/{assetId}/policies/{policyId}/rules`
- Auth: none declared
- TypeScript: <https://skmtc.dev/rapid7/apis/rapid7-vm-api/docs/api/3/assets/:assetId/policies/:policyId/rules/get.ts> (a function with typed inputs; its response is checked against the schema)

Retrieves the list of policy rules with compliance results for the specified asset and policy.

## Path parameters

- `assetId` integer, required: The identifier of the asset.
- `policyId` integer, required: The identifier of the policy

## Query parameters

- `page` integer
- `size` integer
- `sort` string[]

## Response `200`

OK

- PagedModelPolicyRule
  - `links` Link[], required
    - `deprecation` string
    - `href` string: A hypertext reference, which is either a URI (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc3986">RFC 3986</a>) or URI template (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc6570">RFC 6570</a>).
    - `hreflang` string
    - `media` string
    - `rel` string: The link relation type. This value is one from the <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc5988#section-6.2">Link Relation Type Registry</a> or is the type of resource being linked to.
    - `title` string
    - `type` string
  - `page` PageMetadata: Contains metadata about the paginated response.
    - `number` integer: The index (zero-based) of the current page returned.
    - `size` integer: The maximum size of the page returned.
    - `totalPages` integer: The total number of pages available.
    - `totalResources` integer: The total number of resources available across all pages.
  - `resources` PolicyRule[], required
    - `assets` AssetPolicyAssessment: A summary of asset compliance.
      - `links` Link[], required: Hypermedia links to corresponding or related resources.
        - `deprecation` string
        - `href` string: A hypertext reference, which is either a URI (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc3986">RFC 3986</a>) or URI template (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc6570">RFC 6570</a>).
        - `hreflang` string
        - `media` string
        - `rel` string: The link relation type. This value is one from the <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc5988#section-6.2">Link Relation Type Registry</a> or is the type of resource being linked to.
        - `title` string
        - `type` string
      - `total` integer: The total number of assets.
      - `totalFailed` integer: The total number of assets that are not compliant.
      - `totalNotApplicable` integer: The total number of assets that are not applicable.
      - `totalPassed` integer
    - `benchmark` PolicyBenchmark: Information about the policy benchmark.
      - `links` Link[], required: Hypermedia links to corresponding or related resources.
        - `deprecation` string
        - `href` string: A hypertext reference, which is either a URI (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc3986">RFC 3986</a>) or URI template (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc6570">RFC 6570</a>).
        - `hreflang` string
        - `media` string
        - `rel` string: The link relation type. This value is one from the <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc5988#section-6.2">Link Relation Type Registry</a> or is the type of resource being linked to.
        - `title` string
        - `type` string
      - `name` string: The name of the policy's benchmark.
      - `title` string: The title of the policy benchmark.
      - `version` string: The version number of the benchmark that includes the policy.
    - `description` string: A description of the rule.
    - `id` string: The textual representation of the policy rule identifier.
    - `isCustom` boolean: A flag indicating whether the policy rule is custom.
    - `links` Link[], required: Hypermedia links to corresponding or related resources.
      - `deprecation` string
      - `href` string: A hypertext reference, which is either a URI (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc3986">RFC 3986</a>) or URI template (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc6570">RFC 6570</a>).
      - `hreflang` string
      - `media` string
      - `rel` string: The link relation type. This value is one from the <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc5988#section-6.2">Link Relation Type Registry</a> or is the type of resource being linked to.
      - `title` string
      - `type` string
    - `name` string: The name of the rule.
    - `role` 'full' | 'unscored' | 'unchecked': The role of the policy rule. It's value determines how it's results affect compliance.
    - `scope` string: The textual representation of the policy rule scope. Policy rules that are automatically available have `"Built-in"` scope, whereas policy rules created by users have scope as `"Custom"`.
    - `status` 'PASS' | 'FAIL' | 'NOT_APPLICABLE': The overall compliance status of the policy rule.
    - `surrogateId` object: The identifier of the policy rule.
    - `title` string: The title of the policy rule as visible to the user.

## Other responses

- `401`: Unauthorized
- `404`: Not Found
- `500`: Internal Server Error
- `503`: Service Unavailable

## Changes

- **2026-08-06** `3a8197c22d71`: 5 info
  - added the media type `application/json;charset=UTF-8` for the response with the status `200`
  - added the media type `application/json;charset=UTF-8` for the response with the status `401`
  - added the media type `application/json;charset=UTF-8` for the response with the status `404`
  - added the media type `application/json;charset=UTF-8` for the response with the status `500`
  - …1 more

[Operation history](https://skmtc.dev/rapid7/apis/rapid7-vm-api/changes/api/3/assets/:assetId/policies/:policyId/rules/get.md)

---

[API](https://skmtc.dev/rapid7/apis/rapid7-vm-api.md) - [All operations](https://skmtc.dev/rapid7/apis/rapid7-vm-api/llms.txt) - [OpenAPI document](https://skmtc.dev/rapid7/apis/rapid7-vm-api/revisions/3a8197c22d71?raw)