Skip to content
API Reference
Versions
List

List versions of a policy set

API Reference
Zones
Policy Sets
Versions

List versions of a policy set

GET/zones/{zone_id}/policy-sets/{policy_set_id}/versions

List versions of a policy set

Path ParametersExpand Collapse
zone_id: string
policy_set_id: string
Query ParametersExpand Collapse
after: optional string

Cursor for forward pagination. Returned in Pagination.after_cursor. Mutually exclusive with before.

minLength1
maxLength255
before: optional string

Cursor for backward pagination. Returned in Pagination.before_cursor. Mutually exclusive with after.

minLength1
maxLength255
expand: optional array of "total_count"

Opt-in to additional response fields. Repeatable; matches the expand[] convention used across the Keycard API.

limit: optional number

Maximum number of items to return per page.

minimum1
maximum100
order: optional "asc" or "desc"

Sort direction. Default is desc (newest first).

Accepts one of the following:
"asc"
"desc"
sort: optional "created_at"

Field to sort by.

Header ParametersExpand Collapse
"X-API-Version": optional string
"X-Client-Request-ID": optional string
formatuuid
ReturnsExpand Collapse
items: array of PolicySetVersion { id, created_at, created_by, 10 more }
id: string
created_at: string
formatdate-time
created_by: string
manifest: PolicySetManifest { entries }
entries: array of PolicySetManifestEntry { policy_id, policy_version_id, sha }
policy_id: string
policy_version_id: string
sha: optional string

SHA-256 of the policy version content, populated by the server

manifest_sha: string

Hex-encoded SHA-256 of the canonicalized manifest

owner_type: "platform" or "customer"

Who manages this policy set version:

  • "platform" — managed by the Keycard platform (system policy set versions).
  • "customer" — managed by the tenant (custom policy set versions).
Accepts one of the following:
"platform"
"customer"
policy_set_id: string
schema_version: string

Schema version pinned to this policy set version. Determines the Cedar schema used for evaluation when activated.

version: number
active: optional boolean

Whether this policy set version is currently bound with mode='active'

archived_at: optional string
formatdate-time
archived_by: optional string
attestation: optional AttestationStatement { attested_at, attested_by, key_id, 7 more }

Decoded content of an Attestation JWS payload. Describes the exact policy set version composition at attestation time. This schema defines what consumers see after base64url-decoding the Attestation.payload field.

attested_at: string
formatdate-time
attested_by: string
key_id: string

Key ID of the signing key used to produce the attestation signature. Matches the "kid" in the JWS protected header.

manifest_sha: string

SHA-256 of the policy set version manifest. Verifiers MUST check this matches the policy_set_version.manifest_sha to detect attestation/version mismatches.

policy_set_id: string
policy_set_version: number
status: "created" or "re_signed"

Event that produced this attestation. "created" is the initial attestation at version creation; "re_signed" is a re-attestation after key rotation (same content, new signature).

Accepts one of the following:
"created"
"re_signed"
type: "policy_set_attestation"

Statement type discriminator

v: 1

Statement schema version

zone_id: string

List versions of a policy set

curl https://api.keycard.ai/zones/$ZONE_ID/policy-sets/$POLICY_SET_ID/versions
{
  "items": [
    {
      "id": "id",
      "created_at": "2019-12-27T18:11:19.117Z",
      "created_by": "created_by",
      "manifest": {
        "entries": [
          {
            "policy_id": "policy_id",
            "policy_version_id": "policy_version_id",
            "sha": "sha"
          }
        ]
      },
      "manifest_sha": "manifest_sha",
      "owner_type": "platform",
      "policy_set_id": "policy_set_id",
      "schema_version": "schema_version",
      "version": 0,
      "active": true,
      "archived_at": "2019-12-27T18:11:19.117Z",
      "archived_by": "archived_by",
      "attestation": {
        "attested_at": "2019-12-27T18:11:19.117Z",
        "attested_by": "attested_by",
        "key_id": "key_id",
        "manifest_sha": "manifest_sha",
        "policy_set_id": "policy_set_id",
        "policy_set_version": 0,
        "status": "created",
        "type": "policy_set_attestation",
        "v": 1,
        "zone_id": "zone_id"
      }
    }
  ],
  "pagination": {
    "after_cursor": "x",
    "before_cursor": "x",
    "total_count": 0
  }
}
Returns Examples
{
  "items": [
    {
      "id": "id",
      "created_at": "2019-12-27T18:11:19.117Z",
      "created_by": "created_by",
      "manifest": {
        "entries": [
          {
            "policy_id": "policy_id",
            "policy_version_id": "policy_version_id",
            "sha": "sha"
          }
        ]
      },
      "manifest_sha": "manifest_sha",
      "owner_type": "platform",
      "policy_set_id": "policy_set_id",
      "schema_version": "schema_version",
      "version": 0,
      "active": true,
      "archived_at": "2019-12-27T18:11:19.117Z",
      "archived_by": "archived_by",
      "attestation": {
        "attested_at": "2019-12-27T18:11:19.117Z",
        "attested_by": "attested_by",
        "key_id": "key_id",
        "manifest_sha": "manifest_sha",
        "policy_set_id": "policy_set_id",
        "policy_set_version": 0,
        "status": "created",
        "type": "policy_set_attestation",
        "v": 1,
        "zone_id": "zone_id"
      }
    }
  ],
  "pagination": {
    "after_cursor": "x",
    "before_cursor": "x",
    "total_count": 0
  }
}