# Get the age policy

`GET /v1/age-policy` · permission `identity-settings:read`

Returns the environment's age policy (one resource per environment; there are no per-application overrides). If the policy was never written, the table defaults are returned (`mode: off`, `min_age: 16`, empty country table) with `ETag: "0"` and `updated_at: null`. The `ETag` response header carries the version to send as `If-Match` on `PUT`. Uses the identity settings permissions, since the age policy is part of the environment identity settings.

## Request

This operation takes no path, query or body fields. The environment comes from the credential.

## Response

`200 OK` with the policy and the `ETag` header.

```json
{
  "mode": "attestation",
  "min_age": 16,
  "country_min_age": {"DE": 16, "FR": 15, "IT": 14},
  "country_source": "ip",
  "under_age_action": "block",
  "parental_consent_below": null,
  "pending_consent_action": "block_sign_in",
  "store_birthdate": false,
  "applies_to": "self_signup",
  "updated_at": "2026-10-05T09:30:00.123456Z"
}
```

## Errors

| HTTP | code | When |
|---|---|---|
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl https://api.eu.keenauth.com/v1/age-policy \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```