---
title: "List compliance policies"
method: GET
path: "/v1/policies"
tags: ["Policies"]
---

# List compliance policies

`GET /v1/policies`

Lists compliance policies for the organization. Use this to find a policy by name, look up a policy ID, browse drafts, or get an overview of all policies for SOC 2, ISO 27001, HIPAA, and GDPR workflows. Returns id, name, status, department, and other metadata for each policy. Pass excludeContent=true to skip the heavy TipTap content fields — recommended when you only need to identify a policy. To read or edit a single policy in detail, fetch it by ID via get-compliance-policy.

## Query parameters

- `excludeContent` boolean

## Headers

- `X-Organization-Id` string

## Response `200`

Policies retrieved successfully

- object
  - `data` PolicyResponseDto[], required — Array of policies
    - `id` string, required — The policy ID
    - `name` string, required — Name of the policy
    - `description` string, nullable, required — Description of the policy
    - `status` 'draft' | 'published' | 'needs_review', required — Status of the policy
    - `content` object[], required — Content of the policy as TipTap JSON (array of nodes)
    - `frequency` 'monthly' | 'quarterly' | 'yearly', nullable, required — Review frequency of the policy
    - `department` 'none' | 'admin' | 'gov' | 'hr' | 'it' | 'itsm' | 'qms', nullable, required — Department this policy applies to
    - `isRequiredToSign` boolean, required — Whether this policy requires a signature
    - `signedBy` string[], required — List of user IDs who have signed this policy
    - `reviewDate` string, date-time, nullable, required — Review date for the policy
    - `isArchived` boolean, required — Whether this policy is archived
    - `createdAt` string, date-time, required — When the policy was created
    - `updatedAt` string, date-time, required — When the policy was last updated
    - `lastArchivedAt` string, date-time, nullable, required — When the policy was last archived
    - `lastPublishedAt` string, date-time, nullable, required — When the policy was last published
    - `organizationId` string, required — Organization ID this policy belongs to
    - `assigneeId` string, nullable, required — ID of the user assigned to this policy
    - `approverId` string, nullable, required — ID of the user who approved this policy
    - `policyTemplateId` string, nullable, required — ID of the policy template this policy is based on
  - `authType` 'api-key' | 'session', required — How the request was authenticated
  - `authenticatedUser` object — Authenticated user information (only present for session auth)
    - `id` string — User ID
    - `email` string — User email

## Other responses

- `401` — Unauthorized - Invalid authentication or insufficient permissions

## Changes

- **2026-05-28** `7c0713bef5b1` — 1 info
  - added the new optional `query` request parameter `excludeContent`

[Change history](https://skmtc.dev/trycompai/apis/comp-ai-api/changes/v1/policies/get.md)

---

[API](https://skmtc.dev/trycompai/apis/comp-ai-api.md) · [All operations](https://skmtc.dev/trycompai/apis/comp-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/trycompai/comp-ai-api/revisions/aeefe4f00ad8/schema)