---
title: "Get an assume service account policy"
method: GET
path: "/service-accounts/{service_account}/assume-policies/{assume_service_account_policy}"
tags: ["service-accounts"]
---

# Get an assume service account policy

`GET /service-accounts/{service_account}/assume-policies/{assume_service_account_policy}`

## Request

- Base URL: `https://example.scalr.io/api/iacp/v3`
- URL: `https://example.scalr.io/api/iacp/v3/service-accounts/{service_account}/assume-policies/{assume_service_account_policy}`
- Auth: HTTP bearer

Get an assume service account policy.

## Path parameters

- `service_account` string, required
- `assume_service_account_policy` string, required

## Query parameters

- `include` string[]

## Response `200`

Success.

- AssumeServiceAccountPolicyDocument: JSON:API Document. see: https://jsonapi.org/format/#document-structure
  - `data` AssumeServiceAccountPolicy: A trust configuration that maps authenticated workload identities to specific service account.
    - `attributes` object, required
      - `claim-conditions` object[], required: A claim mapping, defining the conditions under which the workload identity can impersonate the service account..
        - `claim` string, required: The name of the claim in the OIDC ID token that needs to be evaluated.
        - `operator` 'eq' | 'contains' | 'startswith' | 'endswith' | 'like': The operation to perform to evaluate the claim's value against the specified condition. Supported values: "eq": checks if the claim value is equal to the specified value; "contains": checks if the claim value contains the specified value as a substring; "startswith": checks if the claim value starts with the specified value; "endswith": checks if the claim value ends with the specified value; "like": checks whether the claim value matches a specified pattern using shell-style wildcards (* any string, ? any char, [seq] any in seq, [!seq] any not in seq).
        - `value` string, required: The expected value or pattern to match for the specified claim.
      - `created-at` string, date-time: The UTC datetime at which the assume service account policy was created.
      - `created-by-email` string, nullable: Email of the user who created assume service account policy.
      - `maximum-session-duration` integer, nullable: The maximum validity period, in seconds, for the token generated during the impersonation operation. Default: 3600 seconds or 1 hour. Range: 3600-43200 seconds (1-12 hours).
      - `name` string, required: The assume service account policy name.
    - `id` string
    - `links` object
    - `relationships` object
      - `provider` object
        - `data` object, nullable, required
          - `id` string, required
          - `type` 'workload-identity-providers' | '', required
      - `service-account` object
        - `data` object, nullable, required
          - `id` string, required
          - `type` 'service-accounts' | '', required
    - `type` 'assume-service-account-policies', required
  - `included` object[]
  - `meta` object

## Other responses

- `403`: User unauthorized to perform this action.
- `4XX`: Client error.
- `5XX`: Server error.

---

[API](https://skmtc.dev/scalr/apis/scalr-iacp-api.md) - [All operations](https://skmtc.dev/scalr/apis/scalr-iacp-api/llms.txt) - [OpenAPI document](https://skmtc.dev/scalr/apis/scalr-iacp-api/revisions/d3e1dc85657a?raw)