Get Policy

GET

/iam/v1/workspaces/{workspace}/policies/{id}

curl --request GET \
  --url https://example.com/iam/v1/workspaces/example/policies/example

Returns a policy by unique ID within a workspace

Parameters

Path Parameters

workspace

required

string

The workspace the policy belongs to

id

required

string

The unique identifier of the policy to retrieve

Responses

200

OK

Media type application/json

Policy resource — a set of conditions that constrain when an IAM binding is effective

object

id

The unique identifier of the policy

stringOutput only

workspace_id

The workspace this policy belongs to

stringOutput only

name

required

The display name of the policy

string

description

An optional description of the policy

string

conditions

required

The conditions that must be satisfied for the policy to apply

Array<object>

Condition — a polymorphic condition within a policy

object

source_ip

Source IP address condition

object

operator

required

The comparison operator for the IP check

string format: enum

Allowed values: SOURCE_IP_OPERATOR_UNSPECIFIED SOURCE_IP_OPERATOR_IN_RANGE SOURCE_IP_OPERATOR_NOT_IN_RANGE

cidrs

required

The CIDR ranges to match against

Array<object>

IpAddress — an IP address (IPv4 or IPv6) with its CIDR prefix length

object

address

required

The IP address (e.g. “10.0.0.0” or “2001:db8::1”)

string

prefix

required

The CIDR prefix length (e.g. 8 for /8, 24 for /24)

integer format: uint32

time_window

Time window condition

object

operator

required

The comparison operator for the time check

string format: enum

Allowed values: TIME_WINDOW_OPERATOR_UNSPECIFIED TIME_WINDOW_OPERATOR_WITHIN TIME_WINDOW_OPERATOR_OUTSIDE

from

Start time of the window

object

hours

Hours of a day in 24 hour format. Must be greater than or equal to 0 and typically must be less than or equal to 23. An API may choose to allow the value “24:00:00” for scenarios like business closing time.

integer format: int32

minutes

Minutes of an hour. Must be greater than or equal to 0 and less than or equal to 59.

integer format: int32

seconds

Seconds of a minute. Must be greater than or equal to 0 and typically must be less than or equal to 59. An API may allow the value 60 if it allows leap-seconds.

integer format: int32

nanos

Fractions of seconds, in nanoseconds. Must be greater than or equal to 0 and less than or equal to 999,999,999.

integer format: int32

to

End time of the window

object

hours

Hours of a day in 24 hour format. Must be greater than or equal to 0 and typically must be less than or equal to 23. An API may choose to allow the value “24:00:00” for scenarios like business closing time.

integer format: int32

minutes

Minutes of an hour. Must be greater than or equal to 0 and less than or equal to 59.

integer format: int32

seconds

Seconds of a minute. Must be greater than or equal to 0 and typically must be less than or equal to 59. An API may allow the value 60 if it allows leap-seconds.

integer format: int32

nanos

Fractions of seconds, in nanoseconds. Must be greater than or equal to 0 and less than or equal to 999,999,999.

integer format: int32

timezone

IANA timezone identifier (e.g. “America/New_York”)

string

role

Role delegation condition

object

operator

required

The comparison operator for the role check

string format: enum

Allowed values: ROLE_CONDITION_OPERATOR_UNSPECIFIED ROLE_CONDITION_OPERATOR_MATCHES_SERVICE

services

required

The service names that the delegated role’s permissions must belong to

Array<string>

location

Location condition

object

operator

required

The comparison operator for the location check

string format: enum

Allowed values: LOCATION_CONDITION_OPERATOR_UNSPECIFIED LOCATION_CONDITION_OPERATOR_IN_SET

allowed_location_ids

required

The set of allowed location ids (weak references to topology Locations)

Array<string>

created

Created Timestamp

The timestamp when the policy was created

string format: date-time Output only

updated

Updated Timestamp

Timestamp when the Policy was last updated

string format: date-time Output only

Example

{
  "conditions": [
    {
      "source_ip": {
        "operator": "SOURCE_IP_OPERATOR_UNSPECIFIED"
      },
      "time_window": {
        "operator": "TIME_WINDOW_OPERATOR_UNSPECIFIED"
      },
      "role": {
        "operator": "ROLE_CONDITION_OPERATOR_UNSPECIFIED"
      },
      "location": {
        "operator": "LOCATION_CONDITION_OPERATOR_UNSPECIFIED"
      }
    }
  ]
}

default

Default error response

Media type application/json

The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.

object

code

The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].

integer format: int32

message

A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.

string

details

A list of messages that carry the error details. There is a common set of message types for APIs to use.

Array<object>

Contains an arbitrary serialized message along with a @type that describes the type of the serialized message.

object

@type

The type of the serialized message.

string

key

additional properties

any

Example ^generated

{
  "code": 1,
  "message": "example",
  "details": [
    {
      "@type": "example"
    }
  ]
}