# Export Access Control Policies

Returns a policy export document for the selected policy IDs. Requires administrator or delegated-admin access and the eng-lc-sub-users feature flag. The document is a strict subset of the sub-user policy request payload — a consumer adds only `connector_display_name` before submitting it to the OAuth authorize endpoint.

Endpoint: GET /access_control/policies/export
Version: 3
Security: ApiKeyAuth

## Query parameters:

  - `policy_ids` (string, required)
    Comma-separated list of policy IDs to export. Each ID is a positive integer without leading zeros, and at most `PolicyRequestPayload::MAX_POLICIES` (20) may be listed.

## Response 200 fields (application/json):

  - `version` (integer, required)
    Document version. Opaque to callers; only the policy request parser reads it.
    Enum: 1

  - `site` (string)
    Deployment site identifier (e.g. aws, eu01, ap02, ap03, aws-tokyo). Omitted when the deployment cannot determine the site.
    Example: aws

  - `stage` (string)
    Deployment stage. Omitted when the deployment cannot determine the stage. The vocabulary is `PolicyRequestPayload::ALLOWED_STAGES`; a deployment outside it cannot export.
    Enum: "development", "staging", "production"

  - `account_id` (integer, required)
    The account ID that owns the selected policies.
    Example: 12345

  - `policy_ids` (array, required)
    Deduplicated, ascending-sorted list of selected policy IDs. At most `PolicyRequestPayload::MAX_POLICIES` (20) entries.
    Example: [101,205]