---
title: "List Authorisation Policies"
method: GET
path: "/api/workflows/{team_key}/authorisation-policies"
tags: ["workflows"]
---

# List Authorisation Policies

`GET /api/workflows/{team_key}/authorisation-policies`

## Request

- Base URL: `https://api.superit.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.superit.ai/api/workflows/{team_key}/authorisation-policies`
- Auth: HTTP bearer

## Path parameters

- `team_key` string, required

## Response `200`

Successful Response

- AuthorisationPolicyListItem[]
  - `key` string, required
  - `name` string, required
  - `description` string, required
  - `authorisation` AuthorizationMatrix, required: Ordered list of rules, evaluated top-down, first match wins.
    - `rules` AuthorizationRule[], required
      - `requester` union, required
        - GroupTagMatcher: Match users by membership in one or more superit tags.
          - `tag` 'group', required
          - `tags` string[], required
        - SelfTagMatcher: Match the requesting user.
          - `tag` 'self', required
        - NoneTagMatcher: Match unconditionally — no tag required. Evaluated by ``_matches`` (services/authorization.py) as an unconditional ``True``, so it means opposite things depending on which field it's used in: as a requester/target matcher it means "anyone" (no restriction); as an approver it means "no approval needed" (self-service). The UI labels it accordingly per field (``TagMatcherEditor.tsx``'s ``REQUESTER_MODES`` vs ``APPROVER_MODES``) rather than showing one generic label.
          - `tag` 'none', required
      - `approver` union, required
        - GroupTagMatcher: Match users by membership in one or more superit tags.
          - `tag` 'group', required
          - `tags` string[], required
        - SelfTagMatcher: Match the requesting user.
          - `tag` 'self', required
        - NoneTagMatcher: Match unconditionally — no tag required. Evaluated by ``_matches`` (services/authorization.py) as an unconditional ``True``, so it means opposite things depending on which field it's used in: as a requester/target matcher it means "anyone" (no restriction); as an approver it means "no approval needed" (self-service). The UI labels it accordingly per field (``TagMatcherEditor.tsx``'s ``REQUESTER_MODES`` vs ``APPROVER_MODES``) rather than showing one generic label.
          - `tag` 'none', required
      - `target` union
        - GroupTagMatcher: Match users by membership in one or more superit tags.
          - `tag` 'group', required
          - `tags` string[], required
        - SelfTagMatcher: Match the requesting user.
          - `tag` 'self', required
        - NoneTagMatcher: Match unconditionally — no tag required. Evaluated by ``_matches`` (services/authorization.py) as an unconditional ``True``, so it means opposite things depending on which field it's used in: as a requester/target matcher it means "anyone" (no restriction); as an approver it means "no approval needed" (self-service). The UI labels it accordingly per field (``TagMatcherEditor.tsx``'s ``REQUESTER_MODES`` vs ``APPROVER_MODES``) rather than showing one generic label.
          - `tag` 'none', required
    - `target_input` string, nullable
  - `linkedActionCount` integer, required
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required

## Other responses

- `400`: Invalid input
- `401`: Not authenticated
- `403`: Forbidden
- `404`: Not found
- `405`: Method not allowed
- `409`: Conflict
- `422`: Validation Error

---

[API](https://skmtc.dev/superit/apis/super-it-api.md) - [All operations](https://skmtc.dev/superit/apis/super-it-api/llms.txt) - [OpenAPI document](https://skmtc.dev/superit/apis/super-it-api/revisions/4944d556c2bb?raw)