Get an organization policy

GET /v1/organizations/{org_id}/policies/{policy_kind} · permission organizations:read

Returns the organization's policy of one kind. If no policy of this kind is written the organization inherits the environment's value and the response is 404.

Request

Field	Type	Required	Description
`org_id`	path	yes	Organization ID (`org_…`).
`policy_kind`	path	yes	Policy kind: `authentication_methods`, `mfa`, `phishing_resistant`, `sso_enforcement`, `session` or `ip_allowlist`. Any other value returns `404`.

No request body.

Response

200 OK with the policy and an ETag header.

{
  "organization_id": "org_01j9xk3m7q8r2s4t6v8w0y2z4a",
  "policy_kind": "mfa",
  "schema_version": 1,
  "settings": {
    "required_for": "all",
    "allowed_factors": [
      "totp",
      "webauthn"
    ],
    "enrollment_grace_days": 7
  },
  "updated_at": "2026-10-12T09:30:00.123456Z",
  "version": 1
}

Errors

HTTP	code	When
404	`not_found`	The organization does not exist, the kind is unknown, or no policy of this kind is written.
401	`unauthenticated`	The credential is missing, invalid or revoked.
403	`insufficient_permissions`	The credential lacks the required permission.
429	`rate_limited`	The rate limit was exceeded; retry after the `Retry-After` period.
503	`service_unavailable`	A dependency is temporarily unavailable; retry after the `Retry-After` period.

Example

curl https://api.eu.keenauth.com/v1/organizations/org_01j9xk3m7q8r2s4t6v8w0y2z4a/policies/mfa \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"