> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oneshotagent.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get action policy

> Read the agent’s action policy

## Authentication

`X-Agent-ID` plus a signed `x-agent-proof` with `scope: "read"`. See [proof authentication](/sdk/overview#read-authentication).

An access token can also read the policy. See [token authentication](/sdk/overview#read-authentication).

<RequestExample>
  ```bash cURL theme={null}
  curl "https://win.oneshotagent.com/v1/agents/me/action-policy" \
    -H "X-Agent-ID: 0xYourWalletAddress" \
    -H "x-agent-proof: <base64 signed proof, scope=read>"
  ```
</RequestExample>

## Parameters

No path, query or body parameters.

## Response

`200` returns `data: null` when no policy is configured, otherwise the policy below.

<ResponseExample>
  ```json theme={null}
  {
    "success": true,
    "data": {
      "enabled": true,
      "rules": [
        {
          "id": "review-email",
          "tool": "email",
          "when": {
            "always": true
          },
          "action": "require_approval"
        }
      ],
      "approver": {
        "email": "ops@acme.com",
        "phone": null
      },
      "timeout_seconds": 3600
    }
  }
  ```
</ResponseExample>

<ResponseField name="data.enabled" type="boolean">Whether the configured policy is active.</ResponseField>
<ResponseField name="data.rules" type="object[]">Rules with `tool`, `when`, `action` and optional `id`. See [rule conditions](/api-reference/approvals/overview#action-policy).</ResponseField>
<ResponseField name="data.approver" type="object">Configured `email` and `phone`, each nullable.</ResponseField>
<ResponseField name="data.timeout_seconds" type="integer">Time allowed for a decision.</ResponseField>

`503 action_policy_unavailable` means the policy could not be read; retry later.

## Held calls

A matching `require_approval` rule makes the protected call return `403 approval_required` before it runs or is charged. This is a response from the protected endpoint, not this policy endpoint. Response excerpt:

```json theme={null}
{
  "error": "approval_required",
  "status": "pending_approval",
  "message": "This email call needs a human approval (rule review-email). It was not run or charged. Retry the same call with X-Approval-Id once approved.",
  "approval_id": "appr_01J...",
  "approval": { "approval_id": "appr_01J...", "source": "policy", "tool": "email", "status": "pending", "policy_rule": "review-email" }
}
```

`approval` is the full [approval object](/api-reference/approvals/get#response). [Poll it](/api-reference/approvals/get), then retry the same call with `X-Approval-Id` once approved. See [held-call behavior](/api-reference/approvals/overview#when-a-call-is-held).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.