---
title: "GET | List all access policies of a user group by [id]"
slug: "api-v2-get-list-user-group-access-policies"
updated: 2026-11-06T18:56:28Z
published: 2026-11-06T18:56:28Z
canonical: "docs.senhasegura.io/api-v2-get-list-user-group-access-policies"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# GET | List all access policies of a user group by [id]

## Description

List the access policies bound to a user group. The response is paginated, and each row reports the bound policy, the profile the binding grants, its approval level, and who created it.

A binding is what connects the members of the group to a PAM access policy. For the policies themselves, access [GET | List all access policies](/v4-2/docs/api-v2-get-list-all-access-policies).

The listing returns only the bindings to PAM access policies released to the application's authorization in A2A. The rule also applies to an authorization with **Super admin** enabled. Bindings to any other access policy are left out of `data`, including bindings made on the user group screen. They are not counted in `total_items`. If the application has no active authorization in A2A, the list is empty.

---

## Prerequisites

- An application with the **Users** authorization granted by the administrator in A2A. For more information, access [How to manage authorizations in A2A](/v4-2/docs/api-v2-how-to-manage-authorizations-in-a2a).
- A valid OAuth 2.0 access token. For more information, access [How to authenticate an application in A2A](/v4-2/docs/how-to-authenticate-an-application-in-a2a).
- The access policies to list must be PAM access policies released to the application's authorization in A2A. For more information, access [How to manage authorizations in A2A](/v4-2/docs/api-v2-how-to-manage-authorizations-in-a2a).

---

## Request

`GET` `/api/v2/iam/user-groups/{id}/access-policies`

### Path parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | integer | Yes | Unique identification code of the user group. |

### Query parameters

| Parameter | Type | Description |
| --- | --- | --- |
| `page` | integer | 1-indexed page number. Defaults to `1`. |
| `limit` | integer | Page size. Defaults to `50` and is bounded by the platform-wide maximum of `200`. |

---

### Example request

`GET` `{{url}}/api/v2/iam/user-groups/7/access-policies?page=1&limit=50`

---

## Response

```
HTTP/1.1 200 OK
X-Request-Id: 7f3c1a90-2c4e-4b1a-9f5e-0a2b7c9d1e34
```

### Example response body

```
{
  "data": [
    {
      "id": "200",
      "access_group": {
        "id": "1",
        "name": "Linux Servers"
      },
      "profile": "user",
      "level": 1,
      "added_by": "admin",
      "added_at": "2026-04-10T14:00:00+00:00"
    },
    {
      "id": "201",
      "access_group": {
        "id": "2",
        "name": "Windows Servers"
      },
      "profile": "approver",
      "level": 2,
      "added_by": "admin",
      "added_at": "2026-04-12T11:30:00+00:00"
    }
  ],
  "meta": {
    "pagination": {
      "page": 1,
      "limit": 50,
      "total_items": 2,
      "total_pages": 1
    },
    "links": {
      "self": "/api/v2/iam/user-groups/7/access-policies?page=1&limit=50"
    }
  }
}
```

---

## Response body fields

| Field | Type | Description |
| --- | --- | --- |
| `data` | array[object] | Active bindings on the current page. |
| `data[].id` | string | Unique identification code of the binding. Use this value to remove the binding. |
| `data[].access_group` | object | The bound access policy. |
| `data[].access_group.id` | string | Unique identification code of the access policy. |
| `data[].access_group.name` | string | Name of the access policy. |
| `data[].profile` | string | Role the binding grants to the members of the group. Allowed values: `user`, `approver`, `user_approver`. |
| `data[].level` | integer | Approval level of the binding. Allowed values: `1`, `2`, `3`. Returns `null` when the binding carries no level. |
| `data[].added_by` | string | Display name of the user who created the binding. Returns `null` when the author is not recorded. |
| `data[].added_at` | datetime | Date and time when the binding was created. |
| `meta` | object | Listing metadata. |
| `meta.pagination` | object | Pagination state for the current request. |
| `meta.pagination.total_items` | integer | Number of bindings the listing returns across all pages. Bindings to access policies outside the application's scope are not counted. |
| `meta.links.self` | string | Path of the current page. |

---

## Errors

| HTTP code | Message | Possible cause | Solution |
| --- | --- | --- | --- |
| `401` | `api.auth.unauthorized` | The access token is missing, invalid, or has expired. | Request a new access token. |
| `404` | `api.resource.not_found` | The user group does not exist or is outside the scope of the authorization. An access policy outside the scope never returns `404`; it is left out of the list. | Check the user group's identification code and the authorization scope. |
| `429` | `api.rate_limit_exceeded` | The request rate limit was exceeded. | Wait the number of seconds returned in the `Retry-After` header and try again. |

For authentication error messages and the `403` versus `404` policy, access [API v2 - Conventions and shared behaviors](/v4-2/docs/api-v2-conventions-and-shared-behaviors).