---
title: "Policy"
method: GET
path: "/v1/b2b/rbac/policy"
tags: ["B2B Rbac"]
---

# Policy

`GET /v1/b2b/rbac/policy`

## Request

- Base URL: `https://api.stytch.com`
- URL: `https://api.stytch.com/v1/b2b/rbac/policy`
- Auth: HTTP basic

Get the active RBAC Policy for your current Stytch Project. An RBAC Policy is the canonical document that stores all defined Resources and Roles within your RBAC permissioning model.

When using the backend SDKs, the RBAC Policy will be cached to allow for local evaluations, eliminating the need for an extra request to Stytch. The policy will be refreshed if an authorization check is requested and the RBAC policy was last updated more than 5 minutes ago.

Resources and Roles can be created and managed within the [RBAC page](https://stytch.com/dashboard/rbac) in the Dashboard.
Additionally, [Role assignment](https://stytch.com/docs/b2b/guides/rbac/role-assignment) can be programmatically managed through certain Stytch API endpoints.

Check out the [RBAC overview](https://stytch.com/docs/b2b/guides/rbac/overview) to learn more about Stytch's RBAC permissioning model.

## Response `200`

Successful response

- ApiB2bRbacV1PolicyResponse
  - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
  - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
  - `policy` ApiB2bRbacV1Policy
    - `roles` ApiB2bRbacV1PolicyRole[], required: An array of [Role objects](https://stytch.com/docs/b2b/api/rbac-role-object).
      - `role_id` string, required: The unique identifier of the RBAC Role, provided by the developer and intended to be human-readable. Reserved `role_id`s that are predefined by Stytch include: * `stytch_member` * `stytch_admin` Check out the [guide on Stytch default Roles](https://stytch.com/docs/b2b/guides/rbac/stytch-default) for a more detailed explanation.
      - `description` string, required: The description of the RBAC Role.
      - `permissions` ApiB2bRbacV1PolicyRolePermission[], required: A list of permissions that link a [Resource](https://stytch.com/docs/b2b/api/rbac-resource-object) to a list of actions.
        - `resource_id` string, required: A unique identifier of the RBAC Resource, provided by the developer and intended to be human-readable. A `resource_id` is not allowed to start with `stytch`, which is a special prefix used for Stytch default Resources with reserved `resource_id`s. These include: * `stytch.organization` * `stytch.member` * `stytch.sso` * `stytch.self` Check out the [guide on Stytch default Resources](https://stytch.com/docs/b2b/guides/rbac/stytch-default) for a more detailed explanation.
        - `actions` string[], required: A list of permitted actions the Scope is required to take with the provided Resource. You can use `*` as a wildcard to require a Scope permission to use all possible actions related to the Resource.
    - `resources` ApiB2bRbacV1PolicyResource[], required: An array of [Resource objects](https://stytch.com/docs/b2b/api/rbac-resource-object).
      - `resource_id` string, required: A unique identifier of the RBAC Resource, provided by the developer and intended to be human-readable. A `resource_id` is not allowed to start with `stytch`, which is a special prefix used for Stytch default Resources with reserved `resource_id`s. These include: * `stytch.organization` * `stytch.member` * `stytch.sso` * `stytch.self` Check out the [guide on Stytch default Resources](https://stytch.com/docs/b2b/guides/rbac/stytch-default) for a more detailed explanation.
      - `description` string, required: The description of the RBAC Resource.
      - `actions` string[], required: A list of all possible actions for a provided Resource. Reserved `actions` that are predefined by Stytch include: * `*` * For the `stytch.organization` Resource: * `update.info.name` * `update.info.slug` * `update.info.untrusted_metadata` * `update.info.email_jit_provisioning` * `update.info.logo_url` * `update.info.email_invites` * `update.info.allowed_domains` * `update.info.default_sso_connection` * `update.info.sso_jit_provisioning` * `update.info.mfa_policy` * `update.info.implicit_roles` * `delete` * For the `stytch.member` Resource: * `create` * `update.info.name` * `update.info.untrusted_metadata` * `update.info.mfa-phone` * `update.info.delete.mfa-phone` * `update.settings.is-breakglass` * `update.settings.mfa_enrolled` * `update.settings.roles` * `search` * `delete` * For the `stytch.sso` Resource: * `create` * `update` * `delete` * For the `stytch.self` Resource: * `update.info.name` * `update.info.untrusted_metadata` * `update.info.mfa-phone` * `update.info.delete.mfa-phone` * `update.info.delete.password` * `update.settings.mfa_enrolled` * `delete`
    - `scopes` ApiB2bRbacV1PolicyScope[], required: An array of [Scope objects](https://stytch.com/docs/b2b/api/rbac-scope-object).
      - `scope` string, required: The unique identifier of the RBAC Scope, provided by the developer and intended to be human-readable.
      - `description` string, required: The description of the RBAC Scope.
      - `permissions` ApiB2bRbacV1PolicyScopePermission[], required: A list of permissions that link a [Resource](https://stytch.com/docs/b2b/api/rbac-resource-object) to a list of actions.
        - `resource_id` string, required: A unique identifier of the RBAC Resource, provided by the developer and intended to be human-readable. A `resource_id` is not allowed to start with `stytch`, which is a special prefix used for Stytch default Resources with reserved `resource_id`s. These include: * `stytch.organization` * `stytch.member` * `stytch.sso` * `stytch.self` Check out the [guide on Stytch default Resources](https://stytch.com/docs/b2b/guides/rbac/stytch-default) for a more detailed explanation.
        - `actions` string[], required: A list of permitted actions the Scope is required to take with the provided Resource. You can use `*` as a wildcard to require a Scope permission to use all possible actions related to the Resource.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `429`: Too Many Requests
- `500`: Internal server error

## Changes

- **2026-03-07** `110f26a94e5b`: 1 info
  - endpoint added
- **2026-03-06** `9cab20b8eca7`: 1 breaking
  - api path removed without deprecation
- **2025-09-17** `8270cf3a3d4c`: 3 info
  - added the media type `application/json` for the response with the status `401`
  - added the media type `application/json` for the response with the status `500`
  - added the non-success response with the status `429`
- **2025-09-17** `864b9f438ac0`: 1 breaking
  - the `status_code` response's property type changed from `string` to `integer`, and format from no format to `int32` for status `200`

[Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/b2b/rbac/policy/get.md)

---

[API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)