> ## Documentation Index
> Fetch the complete documentation index at: https://docs.timbal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# List Policies

> List the policies declared on an ACE.



## OpenAPI

````yaml GET /ace/{ace_uid}/policies
openapi: 3.1.0
info:
  title: Timbal Platform API
  description: Public API documentation for the Timbal platform
  license:
    name: ''
  version: 2.0.0
servers:
  - url: https://api.timbal.ai
    description: Production
  - url: https://api.dev.timbal.ai
    description: Development
security: []
tags:
  - name: ace
    description: Action Control Engine (ACE) operations
  - name: alarms
    description: Metric series and threshold alarms
  - name: analytics
    description: Org and project analytics
  - name: billing
    description: Subscriptions, usage, and payment-related operations
  - name: channels
    description: Delivery channels alarms notify through
  - name: content
    description: Re-sign stored content URLs
  - name: files
    description: File operations
  - name: iam
    description: IAM — actions, roles, users, and authorization introspection
  - name: k2
    description: Knowledge Bases v2 operations
  - name: orgs
    description: Organization operations
  - name: projects
    description: Project operations
  - name: runs
    description: Execution operations
  - name: templates
    description: Public project template catalog
  - name: users
    description: Authenticated user profile
paths:
  /ace/{ace_uid}/policies:
    get:
      tags:
        - ace
      description: List the policies declared on an ACE.
      operationId: list
      parameters:
        - name: ace_uid
          in: path
          description: ACE uid (UUID).
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Policies
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListPoliciesResBody'
        '403':
          description: Forbidden
        '404':
          description: ACE not found
      security:
        - bearer_auth: []
components:
  schemas:
    ListPoliciesResBody:
      type: object
      required:
        - policies
      properties:
        policies:
          type: array
          items:
            $ref: '#/components/schemas/AcePolicy'
    AcePolicy:
      allOf:
        - type: object
          description: Unknown keys preserved for round-tripping.
        - type: object
          required:
            - id
          properties:
            action:
              type: string
            condition:
              type: string
            id:
              type: string
            model:
              type:
                - string
                - 'null'
              description: |-
                Upstream model to route to when this policy matches
                (`provider/model` form, e.g. `"anthropic/claude-haiku-4-5"`).
            provides:
              type: array
              items:
                type: string
            requires: {}
            tool_action:
              oneOf:
                - type: 'null'
                - $ref: '#/components/schemas/ToolAction'
      description: >-
        A single policy entry.


        - `condition` is the fuzzy trigger evaluated by LLM voters. Empty /
          absent means the policy is **requires-only**: decided deterministically
          at prefilter time, never sent to voters (this also enables the
          one-LLM-call routing fast path).
        - `requires` gates the policy on extracted context variables; see the
          rule vocabulary in [`crate::matcher`].
        - `provides` deduplicates: a policy is skipped when every var it
        provides
          is already present in context.
        - `model` routes the proxied request to a different upstream model when
          this policy matches (first matched policy with a `model` wins).
    ToolAction:
      allOf:
        - type: object
          description: Unknown keys preserved for round-tripping.
        - type: object
          required:
            - tool
          properties:
            confirmation:
              type: string
              description: |-
                Matcher-confidence gate: `none` (prefilter alone suffices),
                `majority` (default), or `unanimous` (all voters must agree).
            params:
              type: object
            tool:
              type: string
      description: |-
        Deterministic tool invocation attached to a policy. `params` values of
        the form `"$var_id"` are resolved from extracted context variables at
        inference time; `$var_id` tokens embedded in longer strings (template
        params, e.g. a SQL string) interpolate in place.
  securitySchemes:
    bearer_auth:
      type: http
      scheme: bearer
      description: >-
        Timbal API key. Obtain your API key from the Timbal platform settings.
        See [Authentication](/api-reference/authentication) for more
        information.

````