## List

**get** `/zones/{zone_id}/policy-sets/{policy_set_id}/versions`

List versions of a policy set

### Path Parameters

- `zone_id: string`

- `policy_set_id: string`

### Query Parameters

- `after: optional string`

  Cursor for forward pagination. Returned in `Pagination.after_cursor`. Mutually exclusive with `before`.

- `before: optional string`

  Cursor for backward pagination. Returned in `Pagination.before_cursor`. Mutually exclusive with `after`.

- `expand: optional array of "total_count"`

  Opt-in to additional response fields. Repeatable; matches the `expand[]` convention used across the Keycard API.

  - `"total_count"`

- `limit: optional number`

  Maximum number of items to return per page.

- `order: optional "asc" or "desc"`

  Sort direction. Default is desc (newest first).

  - `"asc"`

  - `"desc"`

- `sort: optional "created_at"`

  Field to sort by.

  - `"created_at"`

### Header Parameters

- `"X-API-Version": optional string`

- `"X-Client-Request-ID": optional string`

### Returns

- `items: array of PolicySetVersion`

  - `id: string`

  - `created_at: string`

  - `created_by: string`

  - `manifest: PolicySetManifest`

    - `entries: array of PolicySetManifestEntry`

      - `policy_id: string`

      - `policy_version_id: string`

      - `sha: optional string`

        SHA-256 of the policy version content, populated by the server

  - `manifest_sha: string`

    Hex-encoded SHA-256 of the canonicalized manifest

  - `owner_type: "platform" or "customer"`

    Who manages this policy set version:

    - `"platform"` — managed by the Keycard platform (system policy set versions).
    - `"customer"` — managed by the tenant (custom policy set versions).

    - `"platform"`

    - `"customer"`

  - `policy_set_id: string`

  - `schema_version: string`

    Schema version pinned to this policy set version. Determines the Cedar
    schema used for evaluation when activated.

  - `version: number`

  - `active: optional boolean`

    Whether this policy set version is currently bound with mode='active'

  - `archived_at: optional string`

  - `archived_by: optional string`

  - `attestation: optional AttestationStatement`

    Decoded content of an Attestation JWS payload. Describes the exact policy set version composition at attestation time. This schema defines what consumers see after base64url-decoding the Attestation.payload field.

    - `attested_at: string`

    - `attested_by: string`

    - `key_id: string`

      Key ID of the signing key used to produce the attestation signature. Matches the "kid" in the JWS protected header.

    - `manifest_sha: string`

      SHA-256 of the policy set version manifest. Verifiers MUST check this matches the policy_set_version.manifest_sha to detect attestation/version mismatches.

    - `policy_set_id: string`

    - `policy_set_version: number`

    - `status: "created" or "re_signed"`

      Event that produced this attestation. "created" is the initial attestation at version creation; "re_signed" is a re-attestation after key rotation (same content, new signature).

      - `"created"`

      - `"re_signed"`

    - `type: "policy_set_attestation"`

      Statement type discriminator

      - `"policy_set_attestation"`

    - `v: 1`

      Statement schema version

      - `1`

    - `zone_id: string`

- `pagination: object { after_cursor, before_cursor, total_count }`

  Cursor-based pagination metadata returned alongside a list of results

  - `after_cursor: string`

    An opaque cursor used for paginating through a list of results

  - `before_cursor: string`

    An opaque cursor used for paginating through a list of results

  - `total_count: optional number`

    Total number of items across all pages. Only present when the request includes ?expand[]=total_count.

### Example

```http
curl https://api.keycard.ai/zones/$ZONE_ID/policy-sets/$POLICY_SET_ID/versions
```