gateway

List policies

Retrieve an environment's gateway policies in evaluation order: the gateway evaluates them top to bottom and the first rejection short-circuits the request.

The full policy list is returned in a single response.

Required Permissions

Your root key must have one of the following permissions:

environment.*.read_policies (for any environment)
environment.<environment_id>.read_policies (for a specific environment)

post/v2/gateway.listPolicies

Request body

projectstring required

Identifies a resource by either its unique ID or its slug. Accepts a prefixed ID (such as 'proj_' or 'app_') or a slug.

appstring required

Identifies a resource by either its unique ID or its slug. Accepts a prefixed ID (such as 'proj_' or 'app_') or a slug.

environmentstring required

Identifies a resource by either its unique ID or its slug. Accepts a prefixed ID (such as 'proj_' or 'app_') or a slug.

Example request

{
  "project": "proj_1234abcd",
  "app": "proj_1234abcd",
  "environment": "proj_1234abcd"
}

Response

Policies retrieved successfully

Example response

{
  "meta": {
    "requestId": "req_123"
  },
  "data": [
    {
      "id": "pol_2gJbXhAr4",
      "name": "Block internal paths",
      "enabled": true,
      "match": [
        {
          "path": {
            "path": {
              "prefix": "/internal/"
            }
          }
        }
      ],
      "firewall": {
        "action": "ACTION_DENY"
      }
    }
  ]
}

Changes

Changed in 4 of the 92 revisions of this API.256

Aug 17, 202668e1a2c609c01See the full diff
- ○
  added the optional property data/items/logging to the response with the 200 status
  response-optional-property-added
Aug 13, 2026a021527e00d21See the full diff
- ○
  added the optional property data/items/keyauth/credits to the response with the 200 status
  response-optional-property-added
Aug 12, 20269bbd42d710cf253See the full diff
- ▲
  the response property data/items/ratelimit/identifier became optional for the status 200
  response-property-became-optional
- ▲
  the data/items/ratelimit/identifier response's property type/format changed from object/ to / for status 200
  response-property-type-changed
- ●
  removed the optional property data/items/ratelimit/identifier/authenticatedSubject from the response with the 200 status
  response-optional-property-removed
- ●
  removed the optional property data/items/ratelimit/identifier/header from the response with the 200 status
  response-optional-property-removed
- ●
  removed the optional property data/items/ratelimit/identifier/path from the response with the 200 status
  response-optional-property-removed
- ●
  removed the optional property data/items/ratelimit/identifier/principalField from the response with the 200 status
  response-optional-property-removed
- ●
  removed the optional property data/items/ratelimit/identifier/remoteIp from the response with the 200 status
  response-optional-property-removed
- ○
  added the optional property data/items/ratelimit/identifiers to the response with the 200 status
  response-optional-property-added
- ○
  added RatelimitIdentifier to the data/items/ratelimit/identifier response property allOf list for the response status 200
  response-property-all-of-added
- ○
  response property data/items/ratelimit/identifier deprecated
  response-property-deprecated
Jul 16, 2026cf64b605461b1See the full diff
- ○
  endpoint added
  endpoint-added

Full history