---
title: "GetPolicy returns the approval policy for the given resource."
method: GET
path: "/v2/organizations/{organization}/extensions/{extension}/approvals"
tags: ["Approvals"]
---

# GetPolicy returns the approval policy for the given resource.

`GET /v2/organizations/{organization}/extensions/{extension}/approvals`

## Request

- Base URL: `https://docs.tetrate.io` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.tetrate.io/v2/organizations/{organization}/extensions/{extension}/approvals`
- Auth: none declared
- TypeScript: <https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api/docs/v2/organizations/:organization/extensions/:extension/approvals/get.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `organization` string, required
- `extension` string, required

## Response `200`

A successful response.

- V2ApprovalPolicy: ApprovalPolicy is a set of authorization rules that define access to a resource. When applied to a resource, the rules enforce access to the resource based on the permission set. Example: ApprovalPolicy { Mode: ApprovalPolicy_REQUIRE_APPROVAL, Resource: "organizations/demo/tenants/demo/applications/target-app", Approved: []Access {{ Subject: "organizations/demo/tenants/demo/applications/calling-app", Permissions: []string{"GET", "POST"} }} }
  - `etag` string
  - `mode` 'UNRESTRICTED' | 'ALLOW_REQUESTED' | 'REQUIRE_APPROVAL', required: - UNRESTRICTED: Allows all subjects in the same policy class to access the resource. - ALLOW_REQUESTED: Allows only the subjects in the request and approved list to access the resource. - REQUIRE_APPROVAL: Allows only the subjects in the approved list to access the resource.
  - `resource` string, required: Resource is a fully qualified name of the resource that the policy applies to.
  - `requested` V2Access[]: Requested is a list of subjects that are requested to access the resource but that have not yet been explicitly approved. The access mode of the policy will determine if the subjects in this list are given immediate access to the resource.
    - `subject` string, required: Subject is the subject that is requested to access the resource.
    - `permissions` string[], required: Permissions is a list of permissions that the subject is allowed to use.
    - `metadata` V2Metadata: Metadata includes additional information about an ApprovalPolicy or Access entity and their respective resources that they apply to.
      - `details` MetadataDetails: Details is additional information about a resource.
        - `name` string: Name is the resources name.
        - `description` string: Description is the resources description.
      - `rules` RoleRule[]: Permissions includes permissions for which an authenticated user is allowed to perform. This applies to ApprovalPolicy or Access entities respectively.
        - `types` RoleResourceType[]: The set of API groups and the api Kinds within the group on which this rule is applicable. If omitted, the permissions will globally apply to all resource types.
          - `apiGroup` string, required: A specific API group such as traffic.tsb.tetrate.io/v2.
          - `kinds` string[]: Specific kinds of APIs under the API group. If omitted, the role will apply to all kinds under the group.
        - `permissions` V2Permission[], required: The set of actions allowed for these APIs. The current version supports requires the kind, but this constraint will be relaxed in upcoming releases so that rules can apply globally to an entire API group.
  - `approved` V2Access[]: Approved is a list of subjects that are approved to access the resource.
    - `subject` string, required: Subject is the subject that is requested to access the resource.
    - `permissions` string[], required: Permissions is a list of permissions that the subject is allowed to use.
    - `metadata` V2Metadata: Metadata includes additional information about an ApprovalPolicy or Access entity and their respective resources that they apply to.
      - `details` MetadataDetails: Details is additional information about a resource.
        - `name` string: Name is the resources name.
        - `description` string: Description is the resources description.
      - `rules` RoleRule[]: Permissions includes permissions for which an authenticated user is allowed to perform. This applies to ApprovalPolicy or Access entities respectively.
        - `types` RoleResourceType[]: The set of API groups and the api Kinds within the group on which this rule is applicable. If omitted, the permissions will globally apply to all resource types.
          - `apiGroup` string, required: A specific API group such as traffic.tsb.tetrate.io/v2.
          - `kinds` string[]: Specific kinds of APIs under the API group. If omitted, the role will apply to all kinds under the group.
        - `permissions` V2Permission[], required: The set of actions allowed for these APIs. The current version supports requires the kind, but this constraint will be relaxed in upcoming releases so that rules can apply globally to an entire API group.
  - `metadata` V2Metadata: Metadata includes additional information about an ApprovalPolicy or Access entity and their respective resources that they apply to.
    - `details` MetadataDetails: Details is additional information about a resource.
      - `name` string: Name is the resources name.
      - `description` string: Description is the resources description.
    - `rules` RoleRule[]: Permissions includes permissions for which an authenticated user is allowed to perform. This applies to ApprovalPolicy or Access entities respectively.
      - `types` RoleResourceType[]: The set of API groups and the api Kinds within the group on which this rule is applicable. If omitted, the permissions will globally apply to all resource types.
        - `apiGroup` string, required: A specific API group such as traffic.tsb.tetrate.io/v2.
        - `kinds` string[]: Specific kinds of APIs under the API group. If omitted, the role will apply to all kinds under the group.
      - `permissions` V2Permission[], required: The set of actions allowed for these APIs. The current version supports requires the kind, but this constraint will be relaxed in upcoming releases so that rules can apply globally to an entire API group.

## Other responses

- `default`: An unexpected error response.

---

[API](https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api.md) - [All operations](https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api/revisions/2f19c3a1ae57?raw)