# Versions

## List

`client.Zones.PolicySets.Versions.List(ctx, policySetID, params) (*ZonePolicySetVersionListResponse, error)`

**get** `/zones/{zone_id}/policy-sets/{policy_set_id}/versions`

List versions of a policy set

### Parameters

- `policySetID string`

- `params ZonePolicySetVersionListParams`

  - `ZoneID param.Field[string]`

    Path param: The zone identifier

  - `After param.Field[string]`

    Query param: Cursor for forward pagination. Returned in `Pagination.after_cursor`. Mutually exclusive with `before`.

  - `Before param.Field[string]`

    Query param: Cursor for backward pagination. Returned in `Pagination.before_cursor`. Mutually exclusive with `after`.

  - `Expand param.Field[[]string]`

    Query param: Opt-in to additional response fields. Repeatable; matches the `expand[]` convention used across the Keycard API.

    - `const ZonePolicySetVersionListParamsExpandTotalCount ZonePolicySetVersionListParamsExpand = "total_count"`

  - `Limit param.Field[int64]`

    Query param: Maximum number of items to return per page.

  - `Order param.Field[ZonePolicySetVersionListParamsOrder]`

    Query param: Sort direction. Default is desc (newest first).

    - `const ZonePolicySetVersionListParamsOrderAsc ZonePolicySetVersionListParamsOrder = "asc"`

    - `const ZonePolicySetVersionListParamsOrderDesc ZonePolicySetVersionListParamsOrder = "desc"`

  - `Sort param.Field[ZonePolicySetVersionListParamsSort]`

    Query param: Field to sort by.

    - `const ZonePolicySetVersionListParamsSortCreatedAt ZonePolicySetVersionListParamsSort = "created_at"`

  - `XAPIVersion param.Field[string]`

    Header param: API version header (date-based, e.g. 2026-02-01)

  - `XClientRequestID param.Field[string]`

    Header param: Unique request identifier specified by the originating caller and passed along by proxies.

### Returns

- `type ZonePolicySetVersionListResponse struct{…}`

  - `Items []PolicySetVersion`

    - `ID string`

    - `CreatedAt Time`

    - `CreatedBy string`

    - `Manifest PolicySetManifest`

      - `Entries []PolicySetManifestEntry`

        - `PolicyID string`

        - `PolicyVersionID string`

        - `Sha string`

          SHA-256 of the policy version content, populated by the server

    - `ManifestSha string`

      Hex-encoded SHA-256 of the canonicalized manifest

    - `OwnerType PolicySetVersionOwnerType`

      Who manages this policy set version:

      - `"platform"` — managed by the Keycard platform (system policy set versions).
      - `"customer"` — managed by the tenant (custom policy set versions).

      - `const PolicySetVersionOwnerTypePlatform PolicySetVersionOwnerType = "platform"`

      - `const PolicySetVersionOwnerTypeCustomer PolicySetVersionOwnerType = "customer"`

    - `PolicySetID string`

    - `SchemaVersion string`

      Schema version pinned to this policy set version. Determines the Cedar
      schema used for evaluation when activated.

    - `Version int64`

    - `Active bool`

      Whether this policy set version is currently bound with mode='active'

    - `ArchivedAt Time`

    - `ArchivedBy string`

    - `Attestation AttestationStatement`

      Decoded content of an Attestation JWS payload. Describes the exact policy set version composition at attestation time. This schema defines what consumers see after base64url-decoding the Attestation.payload field.

      - `AttestedAt Time`

      - `AttestedBy string`

      - `KeyID string`

        Key ID of the signing key used to produce the attestation signature. Matches the "kid" in the JWS protected header.

      - `ManifestSha string`

        SHA-256 of the policy set version manifest. Verifiers MUST check this matches the policy_set_version.manifest_sha to detect attestation/version mismatches.

      - `PolicySetID string`

      - `PolicySetVersion int64`

      - `Status AttestationStatementStatus`

        Event that produced this attestation. "created" is the initial attestation at version creation; "re_signed" is a re-attestation after key rotation (same content, new signature).

        - `const AttestationStatementStatusCreated AttestationStatementStatus = "created"`

        - `const AttestationStatementStatusReSigned AttestationStatementStatus = "re_signed"`

      - `Type AttestationStatementType`

        Statement type discriminator

        - `const AttestationStatementTypePolicySetAttestation AttestationStatementType = "policy_set_attestation"`

      - `V int64`

        Statement schema version

        - `const AttestationStatementV1 AttestationStatementV = 1`

      - `ZoneID string`

  - `Pagination ZonePolicySetVersionListResponsePagination`

    Cursor-based pagination metadata returned alongside a list of results

    - `AfterCursor string`

      An opaque cursor used for paginating through a list of results

    - `BeforeCursor string`

      An opaque cursor used for paginating through a list of results

    - `TotalCount int64`

      Total number of items across all pages. Only present when the request includes ?expand[]=total_count.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/keycardai/keycard-go"
)

func main() {
  client := keycard.NewClient(

  )
  versions, err := client.Zones.PolicySets.Versions.List(
    context.TODO(),
    "policy_set_id",
    keycard.ZonePolicySetVersionListParams{
      ZoneID: "zone_id",
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", versions.Items)
}
```

## Create

`client.Zones.PolicySets.Versions.New(ctx, policySetID, params) (*PolicySetVersion, error)`

**post** `/zones/{zone_id}/policy-sets/{policy_set_id}/versions`

Validates the manifest, computes SHA, and creates an immutable version snapshot.

### Parameters

- `policySetID string`

- `params ZonePolicySetVersionNewParams`

  - `ZoneID param.Field[string]`

    Path param: The zone identifier

  - `Manifest param.Field[PolicySetManifest]`

    Body param

  - `SchemaVersion param.Field[string]`

    Body param: Schema version to pin to this policy set version.

  - `XAPIVersion param.Field[string]`

    Header param: API version header (date-based, e.g. 2026-02-01)

  - `XClientRequestID param.Field[string]`

    Header param: Unique request identifier specified by the originating caller and passed along by proxies.

### Returns

- `type PolicySetVersion struct{…}`

  - `ID string`

  - `CreatedAt Time`

  - `CreatedBy string`

  - `Manifest PolicySetManifest`

    - `Entries []PolicySetManifestEntry`

      - `PolicyID string`

      - `PolicyVersionID string`

      - `Sha string`

        SHA-256 of the policy version content, populated by the server

  - `ManifestSha string`

    Hex-encoded SHA-256 of the canonicalized manifest

  - `OwnerType PolicySetVersionOwnerType`

    Who manages this policy set version:

    - `"platform"` — managed by the Keycard platform (system policy set versions).
    - `"customer"` — managed by the tenant (custom policy set versions).

    - `const PolicySetVersionOwnerTypePlatform PolicySetVersionOwnerType = "platform"`

    - `const PolicySetVersionOwnerTypeCustomer PolicySetVersionOwnerType = "customer"`

  - `PolicySetID string`

  - `SchemaVersion string`

    Schema version pinned to this policy set version. Determines the Cedar
    schema used for evaluation when activated.

  - `Version int64`

  - `Active bool`

    Whether this policy set version is currently bound with mode='active'

  - `ArchivedAt Time`

  - `ArchivedBy string`

  - `Attestation AttestationStatement`

    Decoded content of an Attestation JWS payload. Describes the exact policy set version composition at attestation time. This schema defines what consumers see after base64url-decoding the Attestation.payload field.

    - `AttestedAt Time`

    - `AttestedBy string`

    - `KeyID string`

      Key ID of the signing key used to produce the attestation signature. Matches the "kid" in the JWS protected header.

    - `ManifestSha string`

      SHA-256 of the policy set version manifest. Verifiers MUST check this matches the policy_set_version.manifest_sha to detect attestation/version mismatches.

    - `PolicySetID string`

    - `PolicySetVersion int64`

    - `Status AttestationStatementStatus`

      Event that produced this attestation. "created" is the initial attestation at version creation; "re_signed" is a re-attestation after key rotation (same content, new signature).

      - `const AttestationStatementStatusCreated AttestationStatementStatus = "created"`

      - `const AttestationStatementStatusReSigned AttestationStatementStatus = "re_signed"`

    - `Type AttestationStatementType`

      Statement type discriminator

      - `const AttestationStatementTypePolicySetAttestation AttestationStatementType = "policy_set_attestation"`

    - `V int64`

      Statement schema version

      - `const AttestationStatementV1 AttestationStatementV = 1`

    - `ZoneID string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/keycardai/keycard-go"
)

func main() {
  client := keycard.NewClient(

  )
  policySetVersion, err := client.Zones.PolicySets.Versions.New(
    context.TODO(),
    "policy_set_id",
    keycard.ZonePolicySetVersionNewParams{
      ZoneID: "zone_id",
      Manifest: keycard.PolicySetManifestParam{
        Entries: []keycard.PolicySetManifestEntryParam{keycard.PolicySetManifestEntryParam{
          PolicyID: "policy_id",
          PolicyVersionID: "policy_version_id",
        }},
      },
      SchemaVersion: "schema_version",
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", policySetVersion.ID)
}
```

## Retrieve

`client.Zones.PolicySets.Versions.Get(ctx, versionID, params) (*PolicySetVersion, error)`

**get** `/zones/{zone_id}/policy-sets/{policy_set_id}/versions/{version_id}`

Get a specific policy set version

### Parameters

- `versionID string`

- `params ZonePolicySetVersionGetParams`

  - `ZoneID param.Field[string]`

    Path param: The zone identifier

  - `PolicySetID param.Field[string]`

    Path param: The policy set identifier

  - `XAPIVersion param.Field[string]`

    Header param: API version header (date-based, e.g. 2026-02-01)

  - `XClientRequestID param.Field[string]`

    Header param: Unique request identifier specified by the originating caller and passed along by proxies.

### Returns

- `type PolicySetVersion struct{…}`

  - `ID string`

  - `CreatedAt Time`

  - `CreatedBy string`

  - `Manifest PolicySetManifest`

    - `Entries []PolicySetManifestEntry`

      - `PolicyID string`

      - `PolicyVersionID string`

      - `Sha string`

        SHA-256 of the policy version content, populated by the server

  - `ManifestSha string`

    Hex-encoded SHA-256 of the canonicalized manifest

  - `OwnerType PolicySetVersionOwnerType`

    Who manages this policy set version:

    - `"platform"` — managed by the Keycard platform (system policy set versions).
    - `"customer"` — managed by the tenant (custom policy set versions).

    - `const PolicySetVersionOwnerTypePlatform PolicySetVersionOwnerType = "platform"`

    - `const PolicySetVersionOwnerTypeCustomer PolicySetVersionOwnerType = "customer"`

  - `PolicySetID string`

  - `SchemaVersion string`

    Schema version pinned to this policy set version. Determines the Cedar
    schema used for evaluation when activated.

  - `Version int64`

  - `Active bool`

    Whether this policy set version is currently bound with mode='active'

  - `ArchivedAt Time`

  - `ArchivedBy string`

  - `Attestation AttestationStatement`

    Decoded content of an Attestation JWS payload. Describes the exact policy set version composition at attestation time. This schema defines what consumers see after base64url-decoding the Attestation.payload field.

    - `AttestedAt Time`

    - `AttestedBy string`

    - `KeyID string`

      Key ID of the signing key used to produce the attestation signature. Matches the "kid" in the JWS protected header.

    - `ManifestSha string`

      SHA-256 of the policy set version manifest. Verifiers MUST check this matches the policy_set_version.manifest_sha to detect attestation/version mismatches.

    - `PolicySetID string`

    - `PolicySetVersion int64`

    - `Status AttestationStatementStatus`

      Event that produced this attestation. "created" is the initial attestation at version creation; "re_signed" is a re-attestation after key rotation (same content, new signature).

      - `const AttestationStatementStatusCreated AttestationStatementStatus = "created"`

      - `const AttestationStatementStatusReSigned AttestationStatementStatus = "re_signed"`

    - `Type AttestationStatementType`

      Statement type discriminator

      - `const AttestationStatementTypePolicySetAttestation AttestationStatementType = "policy_set_attestation"`

    - `V int64`

      Statement schema version

      - `const AttestationStatementV1 AttestationStatementV = 1`

    - `ZoneID string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/keycardai/keycard-go"
)

func main() {
  client := keycard.NewClient(

  )
  policySetVersion, err := client.Zones.PolicySets.Versions.Get(
    context.TODO(),
    "version_id",
    keycard.ZonePolicySetVersionGetParams{
      ZoneID: "zone_id",
      PolicySetID: "policy_set_id",
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", policySetVersion.ID)
}
```

## Update

`client.Zones.PolicySets.Versions.Update(ctx, versionID, params) (*PolicySetVersion, error)`

**patch** `/zones/{zone_id}/policy-sets/{policy_set_id}/versions/{version_id}`

Set active=true to bind this version as the active zone policy set.

### Parameters

- `versionID string`

- `params ZonePolicySetVersionUpdateParams`

  - `ZoneID param.Field[string]`

    Path param: The zone identifier

  - `PolicySetID param.Field[string]`

    Path param: The policy set identifier

  - `Active param.Field[bool]`

    Body param: Must be true. Binds this version as the active zone policy set.

    - `const ZonePolicySetVersionUpdateParamsActiveTrue ZonePolicySetVersionUpdateParamsActive = true`

  - `XAPIVersion param.Field[string]`

    Header param: API version header (date-based, e.g. 2026-02-01)

  - `XClientRequestID param.Field[string]`

    Header param: Unique request identifier specified by the originating caller and passed along by proxies.

### Returns

- `type PolicySetVersion struct{…}`

  - `ID string`

  - `CreatedAt Time`

  - `CreatedBy string`

  - `Manifest PolicySetManifest`

    - `Entries []PolicySetManifestEntry`

      - `PolicyID string`

      - `PolicyVersionID string`

      - `Sha string`

        SHA-256 of the policy version content, populated by the server

  - `ManifestSha string`

    Hex-encoded SHA-256 of the canonicalized manifest

  - `OwnerType PolicySetVersionOwnerType`

    Who manages this policy set version:

    - `"platform"` — managed by the Keycard platform (system policy set versions).
    - `"customer"` — managed by the tenant (custom policy set versions).

    - `const PolicySetVersionOwnerTypePlatform PolicySetVersionOwnerType = "platform"`

    - `const PolicySetVersionOwnerTypeCustomer PolicySetVersionOwnerType = "customer"`

  - `PolicySetID string`

  - `SchemaVersion string`

    Schema version pinned to this policy set version. Determines the Cedar
    schema used for evaluation when activated.

  - `Version int64`

  - `Active bool`

    Whether this policy set version is currently bound with mode='active'

  - `ArchivedAt Time`

  - `ArchivedBy string`

  - `Attestation AttestationStatement`

    Decoded content of an Attestation JWS payload. Describes the exact policy set version composition at attestation time. This schema defines what consumers see after base64url-decoding the Attestation.payload field.

    - `AttestedAt Time`

    - `AttestedBy string`

    - `KeyID string`

      Key ID of the signing key used to produce the attestation signature. Matches the "kid" in the JWS protected header.

    - `ManifestSha string`

      SHA-256 of the policy set version manifest. Verifiers MUST check this matches the policy_set_version.manifest_sha to detect attestation/version mismatches.

    - `PolicySetID string`

    - `PolicySetVersion int64`

    - `Status AttestationStatementStatus`

      Event that produced this attestation. "created" is the initial attestation at version creation; "re_signed" is a re-attestation after key rotation (same content, new signature).

      - `const AttestationStatementStatusCreated AttestationStatementStatus = "created"`

      - `const AttestationStatementStatusReSigned AttestationStatementStatus = "re_signed"`

    - `Type AttestationStatementType`

      Statement type discriminator

      - `const AttestationStatementTypePolicySetAttestation AttestationStatementType = "policy_set_attestation"`

    - `V int64`

      Statement schema version

      - `const AttestationStatementV1 AttestationStatementV = 1`

    - `ZoneID string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/keycardai/keycard-go"
)

func main() {
  client := keycard.NewClient(

  )
  policySetVersion, err := client.Zones.PolicySets.Versions.Update(
    context.TODO(),
    "version_id",
    keycard.ZonePolicySetVersionUpdateParams{
      ZoneID: "zone_id",
      PolicySetID: "policy_set_id",
      Active: true,
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", policySetVersion.ID)
}
```

## Archive

`client.Zones.PolicySets.Versions.Archive(ctx, versionID, params) (*PolicySetVersion, error)`

**delete** `/zones/{zone_id}/policy-sets/{policy_set_id}/versions/{version_id}`

Archive a policy set version

### Parameters

- `versionID string`

- `params ZonePolicySetVersionArchiveParams`

  - `ZoneID param.Field[string]`

    Path param: The zone identifier

  - `PolicySetID param.Field[string]`

    Path param: The policy set identifier

  - `XAPIVersion param.Field[string]`

    Header param: API version header (date-based, e.g. 2026-02-01)

  - `XClientRequestID param.Field[string]`

    Header param: Unique request identifier specified by the originating caller and passed along by proxies.

### Returns

- `type PolicySetVersion struct{…}`

  - `ID string`

  - `CreatedAt Time`

  - `CreatedBy string`

  - `Manifest PolicySetManifest`

    - `Entries []PolicySetManifestEntry`

      - `PolicyID string`

      - `PolicyVersionID string`

      - `Sha string`

        SHA-256 of the policy version content, populated by the server

  - `ManifestSha string`

    Hex-encoded SHA-256 of the canonicalized manifest

  - `OwnerType PolicySetVersionOwnerType`

    Who manages this policy set version:

    - `"platform"` — managed by the Keycard platform (system policy set versions).
    - `"customer"` — managed by the tenant (custom policy set versions).

    - `const PolicySetVersionOwnerTypePlatform PolicySetVersionOwnerType = "platform"`

    - `const PolicySetVersionOwnerTypeCustomer PolicySetVersionOwnerType = "customer"`

  - `PolicySetID string`

  - `SchemaVersion string`

    Schema version pinned to this policy set version. Determines the Cedar
    schema used for evaluation when activated.

  - `Version int64`

  - `Active bool`

    Whether this policy set version is currently bound with mode='active'

  - `ArchivedAt Time`

  - `ArchivedBy string`

  - `Attestation AttestationStatement`

    Decoded content of an Attestation JWS payload. Describes the exact policy set version composition at attestation time. This schema defines what consumers see after base64url-decoding the Attestation.payload field.

    - `AttestedAt Time`

    - `AttestedBy string`

    - `KeyID string`

      Key ID of the signing key used to produce the attestation signature. Matches the "kid" in the JWS protected header.

    - `ManifestSha string`

      SHA-256 of the policy set version manifest. Verifiers MUST check this matches the policy_set_version.manifest_sha to detect attestation/version mismatches.

    - `PolicySetID string`

    - `PolicySetVersion int64`

    - `Status AttestationStatementStatus`

      Event that produced this attestation. "created" is the initial attestation at version creation; "re_signed" is a re-attestation after key rotation (same content, new signature).

      - `const AttestationStatementStatusCreated AttestationStatementStatus = "created"`

      - `const AttestationStatementStatusReSigned AttestationStatementStatus = "re_signed"`

    - `Type AttestationStatementType`

      Statement type discriminator

      - `const AttestationStatementTypePolicySetAttestation AttestationStatementType = "policy_set_attestation"`

    - `V int64`

      Statement schema version

      - `const AttestationStatementV1 AttestationStatementV = 1`

    - `ZoneID string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/keycardai/keycard-go"
)

func main() {
  client := keycard.NewClient(

  )
  policySetVersion, err := client.Zones.PolicySets.Versions.Archive(
    context.TODO(),
    "version_id",
    keycard.ZonePolicySetVersionArchiveParams{
      ZoneID: "zone_id",
      PolicySetID: "policy_set_id",
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", policySetVersion.ID)
}
```

## List Policies

`client.Zones.PolicySets.Versions.ListPolicies(ctx, versionID, params) (*ZonePolicySetVersionListPoliciesResponse, error)`

**get** `/zones/{zone_id}/policy-sets/{policy_set_id}/versions/{version_id}/policies`

Returns the policy versions referenced by this policy set version's manifest as a paginated list.

### Parameters

- `versionID string`

- `params ZonePolicySetVersionListPoliciesParams`

  - `ZoneID param.Field[string]`

    Path param: The zone identifier

  - `PolicySetID param.Field[string]`

    Path param: The policy set identifier

  - `After param.Field[string]`

    Query param: Cursor for forward pagination. Returned in `Pagination.after_cursor`. Mutually exclusive with `before`.

  - `Before param.Field[string]`

    Query param: Cursor for backward pagination. Returned in `Pagination.before_cursor`. Mutually exclusive with `after`.

  - `Expand param.Field[[]string]`

    Query param: Opt-in to additional response fields. Repeatable; matches the `expand[]` convention used across the Keycard API.

    - `const ZonePolicySetVersionListPoliciesParamsExpandTotalCount ZonePolicySetVersionListPoliciesParamsExpand = "total_count"`

  - `Format param.Field[ZonePolicySetVersionListPoliciesParamsFormat]`

    Query param: Narrows which Cedar representation the response includes. When
    omitted, both `cedar_json` and `cedar_raw` are populated. Pass
    `json` to receive only `cedar_json`, or `cedar` to receive only
    `cedar_raw`. Callers that don't care about payload size can skip
    this parameter.

    - `const ZonePolicySetVersionListPoliciesParamsFormatCedar ZonePolicySetVersionListPoliciesParamsFormat = "cedar"`

    - `const ZonePolicySetVersionListPoliciesParamsFormatJson ZonePolicySetVersionListPoliciesParamsFormat = "json"`

  - `Limit param.Field[int64]`

    Query param: Maximum number of items to return per page.

  - `Order param.Field[ZonePolicySetVersionListPoliciesParamsOrder]`

    Query param: Sort direction. Default is desc (newest first).

    - `const ZonePolicySetVersionListPoliciesParamsOrderAsc ZonePolicySetVersionListPoliciesParamsOrder = "asc"`

    - `const ZonePolicySetVersionListPoliciesParamsOrderDesc ZonePolicySetVersionListPoliciesParamsOrder = "desc"`

  - `Sort param.Field[ZonePolicySetVersionListPoliciesParamsSort]`

    Query param: Field to sort by.

    - `const ZonePolicySetVersionListPoliciesParamsSortCreatedAt ZonePolicySetVersionListPoliciesParamsSort = "created_at"`

  - `XAPIVersion param.Field[string]`

    Header param: API version header (date-based, e.g. 2026-02-01)

  - `XClientRequestID param.Field[string]`

    Header param: Unique request identifier specified by the originating caller and passed along by proxies.

### Returns

- `type ZonePolicySetVersionListPoliciesResponse struct{…}`

  - `Items []PolicyVersion`

    - `ID string`

    - `CreatedAt Time`

    - `CreatedBy string`

    - `OwnerType PolicyVersionOwnerType`

      Who manages this policy version:

      - `"platform"` — managed by the Keycard platform (system policy versions).
      - `"customer"` — managed by the tenant (custom policy versions).

      - `const PolicyVersionOwnerTypePlatform PolicyVersionOwnerType = "platform"`

      - `const PolicyVersionOwnerTypeCustomer PolicyVersionOwnerType = "customer"`

    - `PolicyID string`

    - `SchemaVersion string`

      Schema version this policy was validated against when created.

    - `Sha string`

      Hex-encoded content hash

    - `Version int64`

    - `ZoneID string`

    - `ArchivedAt Time`

    - `ArchivedBy string`

    - `CedarJson any`

      Cedar policy in JSON representation. Populated by default
      and when `format=json` is passed; null when `format=cedar`
      narrows the response to the text representation only.

    - `CedarRaw string`

      Cedar policy in human-readable syntax. Populated by default
      and when `format=cedar` is passed; null when `format=json`
      narrows the response to the JSON representation only.

  - `Pagination ZonePolicySetVersionListPoliciesResponsePagination`

    Cursor-based pagination metadata returned alongside a list of results

    - `AfterCursor string`

      An opaque cursor used for paginating through a list of results

    - `BeforeCursor string`

      An opaque cursor used for paginating through a list of results

    - `TotalCount int64`

      Total number of items across all pages. Only present when the request includes ?expand[]=total_count.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/keycardai/keycard-go"
)

func main() {
  client := keycard.NewClient(

  )
  response, err := client.Zones.PolicySets.Versions.ListPolicies(
    context.TODO(),
    "version_id",
    keycard.ZonePolicySetVersionListPoliciesParams{
      ZoneID: "zone_id",
      PolicySetID: "policy_set_id",
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.Items)
}
```

## Domain Types

### Policy Set Version

- `type PolicySetVersion struct{…}`

  - `ID string`

  - `CreatedAt Time`

  - `CreatedBy string`

  - `Manifest PolicySetManifest`

    - `Entries []PolicySetManifestEntry`

      - `PolicyID string`

      - `PolicyVersionID string`

      - `Sha string`

        SHA-256 of the policy version content, populated by the server

  - `ManifestSha string`

    Hex-encoded SHA-256 of the canonicalized manifest

  - `OwnerType PolicySetVersionOwnerType`

    Who manages this policy set version:

    - `"platform"` — managed by the Keycard platform (system policy set versions).
    - `"customer"` — managed by the tenant (custom policy set versions).

    - `const PolicySetVersionOwnerTypePlatform PolicySetVersionOwnerType = "platform"`

    - `const PolicySetVersionOwnerTypeCustomer PolicySetVersionOwnerType = "customer"`

  - `PolicySetID string`

  - `SchemaVersion string`

    Schema version pinned to this policy set version. Determines the Cedar
    schema used for evaluation when activated.

  - `Version int64`

  - `Active bool`

    Whether this policy set version is currently bound with mode='active'

  - `ArchivedAt Time`

  - `ArchivedBy string`

  - `Attestation AttestationStatement`

    Decoded content of an Attestation JWS payload. Describes the exact policy set version composition at attestation time. This schema defines what consumers see after base64url-decoding the Attestation.payload field.

    - `AttestedAt Time`

    - `AttestedBy string`

    - `KeyID string`

      Key ID of the signing key used to produce the attestation signature. Matches the "kid" in the JWS protected header.

    - `ManifestSha string`

      SHA-256 of the policy set version manifest. Verifiers MUST check this matches the policy_set_version.manifest_sha to detect attestation/version mismatches.

    - `PolicySetID string`

    - `PolicySetVersion int64`

    - `Status AttestationStatementStatus`

      Event that produced this attestation. "created" is the initial attestation at version creation; "re_signed" is a re-attestation after key rotation (same content, new signature).

      - `const AttestationStatementStatusCreated AttestationStatementStatus = "created"`

      - `const AttestationStatementStatusReSigned AttestationStatementStatus = "re_signed"`

    - `Type AttestationStatementType`

      Statement type discriminator

      - `const AttestationStatementTypePolicySetAttestation AttestationStatementType = "policy_set_attestation"`

    - `V int64`

      Statement schema version

      - `const AttestationStatementV1 AttestationStatementV = 1`

    - `ZoneID string`