List policies
Retrieve an environment’s gateway policies in evaluation order: the gateway evaluates them top to bottom and the first rejection short-circuits the request.
The full policy list is returned in a single response.
Required Permissions
Your root key must have one of the following permissions:
environment.*.read_policies(for any environment)environment.<environment_id>.read_policies(for a specific environment)
Authorizations
Unkey uses bearer tokens for authentication. Public integrations use root keys, while the dashboard proxy uses short-lived JWTs. To authenticate, include the token in the Authorization header of each request:
Root keys have specific permissions attached to them, controlling what operations they can perform. Legacy permissions use tuple strings like api.*.create_key; resource permissions use Unkey Resource Names plus actions, like unkey:v1:ws_123:keyspaces/*#create_key.
Security best practices:
- Keep root keys secure and never expose them in client-side code
- Use different root keys for different environments
- Rotate keys periodically, especially after team member departures
- Create keys with minimal necessary permissions following least privilege principle
- Monitor key usage with audit logs.
Body
Response
Policies retrieved successfully