---
title: "POST /v2/organizations/{organization}/approvals/query"
method: POST
path: "/v2/organizations/{organization}/approvals/query"
tags: ["Approvals"]
---

# POST /v2/organizations/{organization}/approvals/query

`POST /v2/organizations/{organization}/approvals/query`

## Request

- Base URL: `https://docs.tetrate.io` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.tetrate.io/v2/organizations/{organization}/approvals/query`
- Auth: none declared
- TypeScript: <https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api/docs/v2/organizations/:organization/approvals/query/post.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `organization` string, required

## Request body

- object: QueryPoliciesRequest is the request message for QueryPolicies. Example: QueryPoliciesRequest { Parent: "organizations/demo/tenants/demo", Types: []string{"applications"}, IncludeDetails: true, IncludePermissions: true, }
  - `includeDetails` boolean: IncludeDetails indicates whether to include the details of the resources that are part of the policy. When set to true, the name and description of the resource are included in the response.
  - `includePermissions` boolean: IncludePermissions indicates whether to include the user level permissions on resources that are part of the policy. When set to true, the user level permissions are included in the response.
  - `types` string[], required: Type is the type of the resources to query for policies.

## Response `200`

A successful response.

- V2QueryPoliciesResponse: QueryPoliciesResponse is the response message for QueryPolicies.
  - `policies` V2ApprovalPolicy[]: Policies is a list of policies that match the query.
    - `etag` string
    - `mode` 'UNRESTRICTED' | 'ALLOW_REQUESTED' | 'REQUIRE_APPROVAL', required: - UNRESTRICTED: Allows all subjects in the same policy class to access the resource. - ALLOW_REQUESTED: Allows only the subjects in the request and approved list to access the resource. - REQUIRE_APPROVAL: Allows only the subjects in the approved list to access the resource.
    - `resource` string, required: Resource is a fully qualified name of the resource that the policy applies to.
    - `requested` V2Access[]: Requested is a list of subjects that are requested to access the resource but that have not yet been explicitly approved. The access mode of the policy will determine if the subjects in this list are given immediate access to the resource.
      - `subject` string, required: Subject is the subject that is requested to access the resource.
      - `permissions` string[], required: Permissions is a list of permissions that the subject is allowed to use.
      - `metadata` V2Metadata: Metadata includes additional information about an ApprovalPolicy or Access entity and their respective resources that they apply to.
        - `details` MetadataDetails: Details is additional information about a resource.
          - `name` string: Name is the resources name.
          - `description` string: Description is the resources description.
        - `rules` RoleRule[]: Permissions includes permissions for which an authenticated user is allowed to perform. This applies to ApprovalPolicy or Access entities respectively.
          - `types` RoleResourceType[]: The set of API groups and the api Kinds within the group on which this rule is applicable. If omitted, the permissions will globally apply to all resource types.
            - `apiGroup` string, required: A specific API group such as traffic.tsb.tetrate.io/v2.
            - `kinds` string[]: Specific kinds of APIs under the API group. If omitted, the role will apply to all kinds under the group.
          - `permissions` V2Permission[], required: The set of actions allowed for these APIs. The current version supports requires the kind, but this constraint will be relaxed in upcoming releases so that rules can apply globally to an entire API group.
    - `approved` V2Access[]: Approved is a list of subjects that are approved to access the resource.
      - `subject` string, required: Subject is the subject that is requested to access the resource.
      - `permissions` string[], required: Permissions is a list of permissions that the subject is allowed to use.
      - `metadata` V2Metadata: Metadata includes additional information about an ApprovalPolicy or Access entity and their respective resources that they apply to.
        - `details` MetadataDetails: Details is additional information about a resource.
          - `name` string: Name is the resources name.
          - `description` string: Description is the resources description.
        - `rules` RoleRule[]: Permissions includes permissions for which an authenticated user is allowed to perform. This applies to ApprovalPolicy or Access entities respectively.
          - `types` RoleResourceType[]: The set of API groups and the api Kinds within the group on which this rule is applicable. If omitted, the permissions will globally apply to all resource types.
            - `apiGroup` string, required: A specific API group such as traffic.tsb.tetrate.io/v2.
            - `kinds` string[]: Specific kinds of APIs under the API group. If omitted, the role will apply to all kinds under the group.
          - `permissions` V2Permission[], required: The set of actions allowed for these APIs. The current version supports requires the kind, but this constraint will be relaxed in upcoming releases so that rules can apply globally to an entire API group.
    - `metadata` V2Metadata: Metadata includes additional information about an ApprovalPolicy or Access entity and their respective resources that they apply to.
      - `details` MetadataDetails: Details is additional information about a resource.
        - `name` string: Name is the resources name.
        - `description` string: Description is the resources description.
      - `rules` RoleRule[]: Permissions includes permissions for which an authenticated user is allowed to perform. This applies to ApprovalPolicy or Access entities respectively.
        - `types` RoleResourceType[]: The set of API groups and the api Kinds within the group on which this rule is applicable. If omitted, the permissions will globally apply to all resource types.
          - `apiGroup` string, required: A specific API group such as traffic.tsb.tetrate.io/v2.
          - `kinds` string[]: Specific kinds of APIs under the API group. If omitted, the role will apply to all kinds under the group.
        - `permissions` V2Permission[], required: The set of actions allowed for these APIs. The current version supports requires the kind, but this constraint will be relaxed in upcoming releases so that rules can apply globally to an entire API group.

## Other responses

- `default`: An unexpected error response.

---

[API](https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api.md) - [All operations](https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api/revisions/2f19c3a1ae57?raw)