> ## Documentation Index > Fetch the complete documentation index at: https://docs.timbal.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get Policy > Fetch a single access-shaping rule by id. ## OpenAPI ````yaml GET /orgs/{org_id}/k2/{kb_id}/policies/{policy_id} openapi: 3.1.0 info: title: Timbal Platform API description: Public API documentation for the Timbal platform license: name: '' version: 2.0.0 servers: - url: https://api.timbal.ai description: Production - url: https://api.dev.timbal.ai description: Development security: [] tags: - name: ace description: Action Control Engine (ACE) operations - name: analytics description: Org and project analytics - name: billing description: Subscriptions, usage, and payment-related operations - name: content description: Re-sign stored content URLs - name: files description: File operations - name: iam description: IAM — actions, roles, users, and authorization introspection - name: k2 description: Knowledge Bases v2 operations - name: orgs description: Organization operations - name: projects description: Project operations - name: runs description: Execution operations - name: templates description: Public project template catalog - name: users description: Authenticated user profile paths: /orgs/{org_id}/k2/{kb_id}/policies/{policy_id}: get: tags: - k2 description: Fetch a single access-shaping rule by id. operationId: get parameters: - name: org_id in: path required: true schema: type: string - name: kb_id in: path required: true schema: type: string - name: policy_id in: path required: true schema: type: string responses: '200': description: Policy content: application/json: schema: $ref: '#/components/schemas/K2Policy' '404': description: Policy not found content: application/json: schema: $ref: '#/components/schemas/ErrorMessage' security: - bearer_auth: [] components: schemas: K2Policy: type: object required: - id - kb_id - name - enabled - row_filter_dsl - compliance_tags - purpose_tags - audit_level - break_glass_allowed - source - labels - revision - created_at - updated_at properties: audit_level: $ref: '#/components/schemas/K2PolicyAuditLevel' break_glass_allowed: type: boolean description: Whether sessions may bypass the rule via a logged escalation. column_masks: oneOf: - type: 'null' - $ref: '#/components/schemas/BTreeMap' description: >- Per-column transformation map. Null means no masks. `{"col": {"type":"redact"}}` is the canonical "hide this column". compliance_tags: type: array items: type: string description: Compliance classifications (e.g. `hipaa.phi`, `pci.pan`). created_at: type: string format: date-time description: type: - string - 'null' enabled: type: boolean description: When false, the rule body is inactive everywhere it is bound. external_id: type: - string - 'null' id: type: string kb_id: type: string labels: type: object description: Free-form key/value labels. name: type: string description: Operator-facing label. purpose_tags: type: array items: type: string description: Purpose-of-use bindings (e.g. `treatment`, `research`). revision: type: integer format: int32 description: Revision token for optimistic concurrency on update and delete. row_filter_dsl: type: object description: Row predicate authored as JSON. Stored opaquely in this release. source: $ref: '#/components/schemas/K2PolicySource' table_name: type: - string - 'null' description: Target table within the knowledge base. Null applies to every table. updated_at: type: string format: date-time ErrorMessage: type: object required: - code - message properties: code: type: string description: Machine-readable error code (e.g. `ALREADY_EXISTS`, `BAD_REQUEST`). message: type: string description: Human-readable description. K2PolicyAuditLevel: type: string description: Audit verbosity for matches against this rule. enum: - none - normal - verbose BTreeMap: type: object additionalProperties: oneOf: - type: object description: >- Replace the column value with a SQL literal expression (e.g. `'***'`). required: - value - type properties: type: type: string enum: - redact value: type: string - type: object description: Non-keyed hash. Use `pseudonymize` for stronger guarantees. required: - algorithm - type properties: algorithm: $ref: '#/components/schemas/HashAlg' type: type: string enum: - hash - type: object description: >- HMAC-keyed deterministic pseudonym. Stable across queries that share `key_ref`. required: - key_ref - algorithm - type properties: algorithm: $ref: '#/components/schemas/HashAlg' key_ref: type: string type: type: string enum: - pseudonymize - type: object description: >- Truncate a string column to `length` characters, optionally pad-suffixed. required: - length - type properties: length: type: integer format: int32 minimum: 0 pad: type: - string - 'null' type: type: string enum: - truncate - type: object description: Format-preserving redaction of a payment account number. required: - type properties: type: type: string enum: - pan_last4 - type: object description: Email with the local part hidden (`***@example.com`). required: - type properties: type: type: string enum: - email_domain_only - type: object description: Generalize a date or timestamp to the start of the given unit. required: - unit - type properties: type: type: string enum: - date_trunc unit: $ref: '#/components/schemas/DateTruncUnit' - type: object description: Cap a numeric column at a maximum value. required: - max - type properties: max: type: number format: double type: type: string enum: - cap - type: object description: Power-user pattern replacement. required: - pattern - replacement - type properties: pattern: type: string replacement: type: string type: type: string enum: - regexp_replace description: >- Per-column transformation applied to query results when this rule matches. The full vocabulary is reserved at the API boundary so future deployments can add masks without breaking existing clients. Only `redact`, `hash`, and `truncate` are accepted by the current release; the others return `400` until enforcement ships. propertyNames: type: string K2PolicySource: type: string description: Provenance of the rule. enum: - manual - imported - derived HashAlg: type: string description: Hash family for `hash` / `pseudonymize` masks. enum: - sha256 - sha512 DateTruncUnit: type: string description: Granularity for the `date_trunc` mask. enum: - year - quarter - month - week - day securitySchemes: bearer_auth: type: http scheme: bearer description: >- Timbal API key. Obtain your API key from the Timbal platform settings. See [Authentication](/api-reference/authentication) for more information. ````