> ## Documentation Index > Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt > Use this file to discover all available pages before exploring further. # Fetch one enforcement policy ## OpenAPI ````yaml /api-reference/openapi.yaml get /api/dlp/admin/v1/enforcement-policies/{id} openapi: 3.1.0 info: title: Barndoor.ai Public API description: Unified public API specification for Barndoor.ai platform version: 2.18.0 servers: - url: https://{host} description: Barndoor public API variables: host: default: platform.barndoor.ai description: >- The host serving your Barndoor deployment. Defaults to production; override it for another environment or a dedicated deployment. security: - ApiKey: [] - OAuth2: - openid - profile - email tags: - name: dlp x-group: Data Control Center - name: identity x-group: Identity - name: llm-gateway x-group: LLM Gateway - name: notification x-group: Notifications - name: policy x-group: Policies - name: registry x-group: MCP Gateway - name: system-management x-group: Log Exports paths: /api/dlp/admin/v1/enforcement-policies/{id}: get: tags: - dlp summary: Fetch one enforcement policy operationId: get_enforcement_policy parameters: - name: id in: path description: Identifier, a UUID required: true schema: type: string responses: '200': description: The enforcement policy content: application/json: schema: $ref: '#/components/schemas/EnforcementPolicyResponse' '401': description: Missing or invalid bearer token content: application/json: schema: $ref: '#/components/schemas/DlpErrorResponse' '403': description: Caller lacks a tenant-admin role content: application/json: schema: $ref: '#/components/schemas/DlpErrorResponse' '404': description: No such enforcement policy in this organization content: application/json: schema: $ref: '#/components/schemas/DlpErrorResponse' components: schemas: EnforcementPolicyResponse: type: object required: - id - org_id - name - target_kind - provider_ids - runtime_stage - action - priority - dry_run - mcp_targets - principals - agent_scope - detection_engine_ids - created_by - updated_by - created_at - updated_at properties: action: type: string agent_scope: $ref: '#/components/schemas/AgentScopeResponse' created_at: type: string created_by: type: string detection_engine_ids: type: array items: type: string dry_run: type: boolean id: type: string mask_format: oneOf: - $ref: '#/components/schemas/MaskFormat' - type: 'null' mcp_targets: type: array items: $ref: '#/components/schemas/EnforcementPolicyMcpTargetResponse' model_alias: type: - string - 'null' name: type: string org_id: type: string principals: type: array items: $ref: '#/components/schemas/EnforcementPolicyPrincipalResponse' priority: type: integer format: int32 provider_ids: type: array items: type: string runtime_stage: type: string target_kind: type: string updated_at: type: string updated_by: type: string DlpErrorResponse: type: object description: >- The error body every `/admin/v1` handler returns. Two shapes reach the wire and both are modelled here as optional fields: the shared auth/role gate in [`super`] emits `{"error": ...}`, while [`super::json_message`] — which the handlers themselves use — emits `{"message": ...}`. Exactly one is present on any given response. This is documentation of what the service already does, not a new contract; a handler is not free to send both. properties: error: type: - string - 'null' description: Set by the authentication and tenant-admin role gate (401 and 403). message: type: - string - 'null' description: Set by handler-level validation and store failures. AgentScopeResponse: type: object required: - mode - agent_ids properties: agent_ids: type: array items: type: string description: >- Selected agent ids. Can include agents deleted since the save, which no longer match any request. mode: type: string description: '`ALL` or `SELECTED`.' MaskFormat: type: object description: >- The `mask_format` object stored on `dlp.enforcement_policies.mask_format` and carried on the admin REST surface. `deny_unknown_fields` so a typo in a client (or a future key an older server does not understand) fails loudly. required: - keep - keep_chars properties: keep: $ref: '#/components/schemas/MaskKeep' keep_chars: type: integer format: int32 minimum: 0 mask_char: type: string preserve_separators: type: boolean additionalProperties: false EnforcementPolicyMcpTargetResponse: type: object required: - id - mcp_server_id - direction properties: direction: type: string id: type: string mcp_server_id: type: string EnforcementPolicyPrincipalResponse: type: object required: - id - principal_type - principal_id properties: id: type: string principal_id: type: string principal_type: type: string MaskKeep: type: string enum: - PREFIX - SUFFIX securitySchemes: ApiKey: type: http scheme: bearer description: >- A Barndoor API key, sent as `Authorization: Bearer `. Keys are prefixed `bdai_` and are opaque — do not attempt to decode one. Interchangeable with an OAuth 2.0 access token. OAuth2: type: oauth2 x-issuer: https://auth.barndoor.ai/realms/barndoor description: >- An OAuth 2.0 access token from Barndoor's identity provider, sent as `Authorization: Bearer `. Public clients must use PKCE. Interchangeable with an API key. flows: authorizationCode: authorizationUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/auth tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. clientCredentials: tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.