# Get a configuration plan

`GET /v1/config-plans/{plan_id}` · permission `config:read` and the read permissions the plan needed when it was created

Returns a stored plan in the same form as [the response that created it](create.md). Plans contain no secret values.

## Request

| Parameter | Description |
|---|---|
| `plan_id` | The plan id, `cfgp_…`. |

## Response

`200 OK` with `Cache-Control: no-store`. A plan whose hour has passed and that was not applied has `status: expired`. Plans are deleted 7 days after they expire.

## Errors

| HTTP | code | When |
|---|---|---|
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks a permission the plan needs; `required_permissions` lists all of them. |
| 404 | `not_found` | The plan does not exist, belongs to another environment or was deleted. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |

## Example

```bash
curl "https://api.eu.keenauth.com/v1/config-plans/cfgp_01m4qpqtywfs7930tb6kqn5rc5" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"

keenauth config plans get cfgp_01m4qpqtywfs7930tb6kqn5rc5
```