Export Access Control Policies

Request

Returns a policy export document for the selected policy IDs. Requires administrator or delegated-admin access and the eng-lc-sub-users feature flag. The document is a strict subset of the sub-user policy request payload — a consumer adds only connector_display_name before submitting it to the OAuth authorize endpoint.

Security

ApiKeyAuth

Query

policy_idsstring^[1-9][0-9]*(,[1-9][0-9]*){0,19}$required

Comma-separated list of policy IDs to export. Each ID is a positive integer without leading zeros, and at most PolicyRequestPayload::MAX_POLICIES (20) may be listed.

Example:policy_ids=101,205

curl -i -X GET \
  'https://api.treasuredata.com/v3/access_control/policies/export?policy_ids=101%2C205' \
  -H 'Authorization: TD1 <YOUR_TOKEN_HERE>'

Responses

OK

Bodyapplication/json

versionintegerrequired

Document version. Opaque to callers; only the policy request parser reads it.

Value:1

Example:1

sitestring

Deployment site identifier (e.g. aws, eu01, ap02, ap03, aws-tokyo). Omitted when the deployment cannot determine the site.

Example:"aws"

stagestring

Deployment stage. Omitted when the deployment cannot determine the stage. The vocabulary is PolicyRequestPayload::ALLOWED_STAGES; a deployment outside it cannot export.

Enum:"development""staging""production"

Example:"production"

account_idintegerrequired

The account ID that owns the selected policies.

Example:12345

policy_idsArray of integers, [ 1 .. 20 ] itemsrequired

Deduplicated, ascending-sorted list of selected policy IDs. At most PolicyRequestPayload::MAX_POLICIES (20) entries.

Example:

Response

{
  "version": 1,
  "site": "aws",
  "stage": "production",
  "account_id": 12345,
  "policy_ids": [
    101,
    205
  ]
}