GET | List all access policies of a user group by [id]

Description

List the access policies bound to a user group. The response is paginated, and each row reports the bound policy, the profile the binding grants, its approval level, and who created it.

A binding is what connects the members of the group to a PAM access policy. For the policies themselves, access GET | List all access policies.

The listing returns only the bindings to PAM access policies released to the application's authorization in A2A. The rule also applies to an authorization with Super admin enabled. Bindings to any other access policy are left out of data, including bindings made on the user group screen. They are not counted in total_items. If the application has no active authorization in A2A, the list is empty.

Prerequisites

An application with the Users authorization granted by the administrator in A2A. For more information, access How to manage authorizations in A2A.
A valid OAuth 2.0 access token. For more information, access How to authenticate an application in A2A.
The access policies to list must be PAM access policies released to the application's authorization in A2A. For more information, access How to manage authorizations in A2A.

Request

GET /api/v2/iam/user-groups/{id}/access-policies

Path parameters

Parameter	Type	Required	Description
`id`	integer	Yes	Unique identification code of the user group.

Query parameters

Parameter	Type	Description
`page`	integer	1-indexed page number. Defaults to `1`.
`limit`	integer	Page size. Defaults to `50` and is bounded by the platform-wide maximum of `200`.

Example request

GET {{url}}/api/v2/iam/user-groups/7/access-policies?page=1&limit=50

Response

HTTP/1.1 200 OK
X-Request-Id: 7f3c1a90-2c4e-4b1a-9f5e-0a2b7c9d1e34

Example response body

{
  "data": [
    {
      "id": "200",
      "access_group": {
        "id": "1",
        "name": "Linux Servers"
      },
      "profile": "user",
      "level": 1,
      "added_by": "admin",
      "added_at": "2026-04-10T14:00:00+00:00"
    },
    {
      "id": "201",
      "access_group": {
        "id": "2",
        "name": "Windows Servers"
      },
      "profile": "approver",
      "level": 2,
      "added_by": "admin",
      "added_at": "2026-04-12T11:30:00+00:00"
    }
  ],
  "meta": {
    "pagination": {
      "page": 1,
      "limit": 50,
      "total_items": 2,
      "total_pages": 1
    },
    "links": {
      "self": "/api/v2/iam/user-groups/7/access-policies?page=1&limit=50"
    }
  }
}

Response body fields

Field	Type	Description
`data`	array[object]	Active bindings on the current page.
`data[].id`	string	Unique identification code of the binding. Use this value to remove the binding.
`data[].access_group`	object	The bound access policy.
`data[].access_group.id`	string	Unique identification code of the access policy.
`data[].access_group.name`	string	Name of the access policy.
`data[].profile`	string	Role the binding grants to the members of the group. Allowed values: `user`, `approver`, `user_approver`.
`data[].level`	integer	Approval level of the binding. Allowed values: `1`, `2`, `3`. Returns `null` when the binding carries no level.
`data[].added_by`	string	Display name of the user who created the binding. Returns `null` when the author is not recorded.
`data[].added_at`	datetime	Date and time when the binding was created.
`meta`	object	Listing metadata.
`meta.pagination`	object	Pagination state for the current request.
`meta.pagination.total_items`	integer	Number of bindings the listing returns across all pages. Bindings to access policies outside the application's scope are not counted.
`meta.links.self`	string	Path of the current page.

Errors

HTTP code	Message	Possible cause	Solution
`401`	`api.auth.unauthorized`	The access token is missing, invalid, or has expired.	Request a new access token.
`404`	`api.resource.not_found`	The user group does not exist or is outside the scope of the authorization. An access policy outside the scope never returns `404`; it is left out of the list.	Check the user group's identification code and the authorization scope.
`429`	`api.rate_limit_exceeded`	The request rate limit was exceeded.	Wait the number of seconds returned in the `Retry-After` header and try again.

For authentication error messages and the 403 versus 404 policy, access API v2 - Conventions and shared behaviors.