Get the age policy

GET /v1/age-policy · permission identity-settings:read

Returns the environment's age policy (one resource per environment; there are no per-application overrides). If the policy was never written, the table defaults are returned (mode: off, min_age: 16, empty country table) with ETag: "0" and updated_at: null. The ETag response header carries the version to send as If-Match on PUT. Uses the identity settings permissions, since the age policy is part of the environment identity settings.

Request

This operation takes no path, query or body fields. The environment comes from the credential.

Response

200 OK with the policy and the ETag header.

{
  "mode": "attestation",
  "min_age": 16,
  "country_min_age": {"DE": 16, "FR": 15, "IT": 14},
  "country_source": "ip",
  "under_age_action": "block",
  "parental_consent_below": null,
  "pending_consent_action": "block_sign_in",
  "store_birthdate": false,
  "applies_to": "self_signup",
  "updated_at": "2026-10-05T09:30:00.123456Z"
}

Errors

HTTP	code	When
401	`unauthenticated`	The credential is missing, invalid or revoked.
403	`insufficient_permissions`	The credential lacks the required permission.
429	`rate_limited`	The rate limit was exceeded; retry after the `Retry-After` period.
503	`service_unavailable`	A dependency is temporarily unavailable; retry after the `Retry-After` period.

Example

curl https://api.eu.keenauth.com/v1/age-policy \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"