> ## Documentation Index
> Fetch the complete documentation index at: https://docs.baselayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List your application's acceptance policy versions

> Every version of your application's policy, newest first by default, a page at a time: `limit`, then `cursor` from `X-Next-Cursor`, or `offset`. `X-Total-Count` and `X-Total-Pages` count every version and are sent on the first cursor page and on every offset page.



## OpenAPI

````yaml /api-reference/openapi.json get /acceptance/policy/versions
openapi: 3.1.0
info:
  title: baselayer-api-service
  version: 0.1.0
servers:
  - url: https://api.baselayer.com/
security: []
paths:
  /acceptance/policy/versions:
    get:
      tags:
        - Acceptance
      summary: List your application's acceptance policy versions
      description: >-
        Every version of your application's policy, newest first by default, a
        page at a time: `limit`, then `cursor` from `X-Next-Cursor`, or
        `offset`. `X-Total-Count` and `X-Total-Pages` count every version and
        are sent on the first cursor page and on every offset page.
      operationId: acceptance_policy_versions_list
      parameters:
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            maximum: 1000
            minimum: 1
            description: >-
              Maximum number of records to return in a single page. Must be
              between 1 and 1000.
            default: 10
            title: Limit
          description: >-
            Maximum number of records to return in a single page. Must be
            between 1 and 1000.
        - name: offset
          in: query
          required: false
          schema:
            anyOf:
              - type: integer
                minimum: 0
              - type: 'null'
            description: >-
              Number of records to skip from the beginning. Use 0 for the first
              page. Cannot be used with cursor.
            title: Offset
          description: >-
            Number of records to skip from the beginning. Use 0 for the first
            page. Cannot be used with cursor.
        - name: cursor
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: >-
              Opaque pagination cursor token that identifies the position in the
              result set. Use the cursor from the previous response to get the
              next page. Cannot be used with offset.
            title: Cursor
          description: >-
            Opaque pagination cursor token that identifies the position in the
            result set. Use the cursor from the previous response to get the
            next page. Cannot be used with offset.
        - name: sort
          in: query
          required: false
          schema:
            anyOf:
              - $ref: '#/components/schemas/v1.AcceptancePolicyVersionSortField'
              - type: 'null'
            description: >-
              `version_number`: the order versions were made in; unique within
              the application, so it is its own tiebreak. Defaults to
              `version_number` `desc`.
            title: Sort
          description: >-
            `version_number`: the order versions were made in; unique within the
            application, so it is its own tiebreak. Defaults to `version_number`
            `desc`.
        - name: sort_direction
          in: query
          required: false
          schema:
            anyOf:
              - $ref: '#/components/schemas/SortMethod'
              - type: 'null'
            description: >-
              `asc` or `desc`, for every key of the sort. Defaults to the
              field's own: `version_number` `desc`.
            title: Sort Direction
          description: >-
            `asc` or `desc`, for every key of the sort. Defaults to the field's
            own: `version_number` `desc`.
      responses:
        '200':
          description: Policy versions in the requested order.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/v1.AcceptancePolicy'
            application/vnd.baselayer.v1+json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/v1.AcceptancePolicy'
          headers:
            X-Total-Count:
              description: Total number of records matching the query.
              schema:
                type: integer
            X-Total-Pages:
              description: Total number of pages available based on the current limit.
              schema:
                type: integer
            X-Next-Cursor:
              description: >-
                Cursor for the next page (only present when using the keyset
                pagination and if `has_more` is true.
              schema:
                type: string
        '422':
          description: The request is invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                title: ValidationFailed
                description: The request is invalid.
                examples:
                  - type: validation_failed
                    code: 7112
                    message: The request is invalid.
                    metadata: {}
      security:
        - APIKeyHeader: []
components:
  schemas:
    v1.AcceptancePolicyVersionSortField:
      type: string
      enum:
        - version_number
      title: AcceptancePolicyVersionSortField
      description: The field an acceptance policy version list sorts on.
    SortMethod:
      type: string
      enum:
        - asc
        - desc
      title: SortMethod
    v1.AcceptancePolicy:
      description: One immutable version of an application's acceptance policy.
      properties:
        policy_version_id:
          description: The version's id.
          format: uuid
          title: Policy Version Id
          type: string
        version_number:
          description: Its number; version 1 is the default.
          minimum: 1
          title: Version Number
          type: integer
        environment:
          $ref: '#/components/schemas/v1.ApplicationType'
          description: The application's environment.
        policy_hash:
          description: '`sha256:` and the hex digest of the policy body the SDK ran.'
          examples:
            - >-
              sha256:0000000000000000000000000000000000000000000000000000000000000000
          pattern: ^sha256:[0-9a-f]{64}$
          title: Policy Hash
          type: string
        created_at:
          description: When the version was made.
          format: date-time
          title: Created At
          type: string
        created_by:
          anyOf:
            - $ref: '#/components/schemas/v1.ActedBy'
            - type: 'null'
          default: null
          description: Who made it; null for the seeded default.
        minimum_policy_schema_version:
          description: >-
            The policy feature level an SDK needs to enforce this version; below
            it the SDK runs it report-only.
          minimum: 1
          title: Minimum Policy Schema Version
          type: integer
        policy:
          $ref: '#/components/schemas/v1.PolicyBody'
          description: The rules.
        warnings:
          description: Steps or rules that are allowed but suspect.
          items:
            $ref: '#/components/schemas/v1.PolicyWarning'
          title: Warnings
          type: array
      required:
        - policy_version_id
        - version_number
        - environment
        - policy_hash
        - created_at
        - minimum_policy_schema_version
        - policy
        - warnings
      title: AcceptancePolicy (v1)
      type: object
    Error:
      properties:
        type:
          type: string
          title: Type
          description: >-
            Stable snake_case name of the error. Branch on this, never on
            `message`.
        code:
          type: integer
          title: Code
          description: Integer catalog code of the error.
        message:
          type: string
          title: Message
          description: For a human reading a log; not stable and not localized.
        metadata:
          additionalProperties: true
          type: object
          title: Metadata
          description: Context documented per `type`.
        request_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Request Id
          description: The `X-Request-ID` of the failed request.
      type: object
      required:
        - type
        - code
        - message
      title: Error
      description: The one body of every error a KYA route answers.
    v1.ApplicationType:
      enum:
        - sandbox
        - production
      title: ApplicationType
      type: string
    v1.ActedBy:
      description: |-
        Who acted on a record, as they were named when they acted: the one actor
        shape every route answers.
      properties:
        kind:
          $ref: '#/components/schemas/v1.ActedByKind'
          description: '`USER` for a console user, `API_KEY` for a key.'
        label:
          description: >-
            The user's first and last name or the API key's name, as they were
            when they acted; never rewritten by a later rename or deletion.
          title: Label
          type: string
      required:
        - kind
        - label
      title: ActedBy (v1)
      type: object
    v1.PolicyBody:
      additionalProperties: false
      description: |-
        The editable part of an acceptance policy. Steps are tried in order and
        the first match wins, so a step an earlier one fully shadows is refused.
      properties:
        steps:
          description: The steps, most specific first.
          items:
            $ref: '#/components/schemas/v1.PolicyStep'
          title: Steps
          type: array
        conversions:
          description: What counts as a sale.
          items:
            $ref: '#/components/schemas/v1.Conversion'
          title: Conversions
          type: array
      required:
        - steps
      title: PolicyBody (v1)
      type: object
    v1.PolicyWarning:
      description: Something in a policy that is allowed but probably not meant.
      properties:
        code:
          $ref: '#/components/schemas/v1.PolicyWarningCode'
          description: What the warning flags.
        step:
          anyOf:
            - $ref: '#/components/schemas/v1.VisitStep'
            - type: 'null'
          default: null
          description: >-
            The step concerned: the partly shadowed one, or the one holding an
            unreachable rule.
        shadowed_by:
          anyOf:
            - $ref: '#/components/schemas/v1.VisitStep'
            - type: 'null'
          default: null
          description: The earlier step that partly shadows `step`.
        rule:
          anyOf:
            - type: string
            - type: 'null'
          default: null
          description: The unreachable rule's name.
          title: Rule
        conversion:
          anyOf:
            - type: string
            - type: 'null'
          default: null
          description: The uncovered conversion's name.
          title: Conversion
        message:
          description: For a human; not stable.
          title: Message
          type: string
      required:
        - code
        - message
      title: PolicyWarning (v1)
      type: object
    v1.ActedByKind:
      description: 'Who acted on a record: a console user or an API key.'
      enum:
        - USER
        - API_KEY
      title: ActedByKind
      type: string
    v1.PolicyStep:
      additionalProperties: false
      description: 'One funnel step: the requests it claims and its rules, first match wins.'
      properties:
        name:
          $ref: '#/components/schemas/v1.VisitStep'
          description: The step.
        match:
          $ref: '#/components/schemas/v1.StepMatch'
          description: The requests this step claims.
        enforcement_mode:
          $ref: '#/components/schemas/v1.EnforcementMode'
          description: Whether the step's decisions are applied.
        rules:
          description: Tried in order; the first match decides.
          items:
            $ref: '#/components/schemas/v1.StepRule'
          title: Rules
          type: array
        detection_fallback:
          $ref: '#/components/schemas/v1.DetectionFallback'
          default: local_rules
          description: What the step decides on without detection.
      required:
        - name
        - match
        - enforcement_mode
        - rules
      title: PolicyStep (v1)
      type: object
    v1.Conversion:
      additionalProperties: false
      description: A request that counts as a sale.
      properties:
        name:
          description: Its name.
          minLength: 1
          title: Name
          type: string
        activity_type:
          $ref: '#/components/schemas/v1.VisitActivityKind'
          default: purchase
          description: The activity a matching request records.
        event_kind:
          anyOf:
            - enum:
                - search
                - view_item
                - add_to_cart
                - begin_checkout
                - purchase
              type: string
            - type: 'null'
          default: null
          description: >-
            The server event a matching request records; when both are set it
            wins over `activity_type`.
          title: Event Kind
        match:
          $ref: '#/components/schemas/v1.StepMatch'
          description: The requests that count.
        response_statuses:
          description: Response statuses that count.
          examples:
            - - 200
              - 201
              - 303
          items:
            maximum: 599
            minimum: 100
            type: integer
          title: Response Statuses
          type: array
      required:
        - name
        - match
        - response_statuses
      title: Conversion (v1)
      type: object
    v1.PolicyWarningCode:
      description: What a policy warning flags. Values may be added.
      enum:
        - partly_shadowed_step
        - unreachable_rule
        - uncovered_conversion
      title: PolicyWarningCode
      type: string
    v1.VisitStep:
      description: The funnel step a request maps to under the acceptance policy.
      enum:
        - browse
        - search
        - cart
        - checkout
        - payment
        - account
        - signup
        - write
      title: VisitStep
      type: string
    v1.StepMatch:
      additionalProperties: false
      description: >-
        The requests a step or conversion claims. `*` matches one segment and

        `**` any number; an empty list matches nothing. `methods` filters
        `paths`

        only, since MCP and UCP calls carry no method of their own; empty means
        any.
      properties:
        paths:
          description: Path patterns, `/`-separated.
          examples:
            - - /checkout/**
          items:
            type: string
          title: Paths
          type: array
        methods:
          description: HTTP methods; empty means any.
          examples:
            - - POST
          items:
            pattern: ^[A-Z]+$
            type: string
          title: Methods
          type: array
        mcp_tools:
          description: MCP tool names; `*` is a plain wildcard.
          items:
            type: string
          title: Mcp Tools
          type: array
        ucp_operations:
          description: UCP operation patterns, `.`-separated.
          items:
            type: string
          title: Ucp Operations
          type: array
      title: StepMatch (v1)
      type: object
    v1.EnforcementMode:
      description: Whether a step's decisions are only recorded or also applied.
      enum:
        - report_only
        - enforce
      title: EnforcementMode
      type: string
    v1.StepRule:
      additionalProperties: false
      allOf:
        - if:
            properties:
              outcome:
                const: step_up
          then:
            properties:
              requirement:
                properties:
                  kind:
                    enum:
                      - identity_level
                      - scope
                type: object
            required:
              - requirement
        - if:
            properties:
              outcome:
                const: challenge
          then:
            properties:
              requirement:
                properties:
                  kind:
                    enum:
                      - challenge
                type: object
            required:
              - requirement
        - if:
            properties:
              outcome:
                enum:
                  - allow
                  - block
          then:
            properties:
              requirement:
                type: 'null'
      description: 'A named rule: when it matches, the outcome it recommends.'
      properties:
        name:
          description: Unique within its step.
          maxLength: 128
          minLength: 1
          title: Name
          type: string
        when:
          $ref: '#/components/schemas/v1.StepRuleCondition'
          description: When the rule matches.
        outcome:
          $ref: '#/components/schemas/v1.AcceptanceDecisionOutcome'
          description: What it recommends.
        requirement:
          anyOf:
            - $ref: '#/components/schemas/v1.Requirement'
            - type: 'null'
          default: null
          description: What a `step_up` or `challenge` asks for.
      required:
        - name
        - when
        - outcome
      title: StepRule (v1)
      type: object
    v1.DetectionFallback:
      description: |-
        What a step decides on when no detection verdict is available.
        Values may be added.
      enum:
        - local_rules
      title: DetectionFallback
      type: string
    v1.VisitActivityKind:
      description: |-
        Something observed during a visit that nobody decided.

        `visit_started`, `acceptance_decision` and `visit_ended` are derived by
        Baselayer, and an SDK never sends them. Values may be added.
      enum:
        - page_view
        - search
        - view_item
        - add_to_cart
        - begin_checkout
        - purchase
        - operation_call
        - interaction
        - challenge_served
        - challenge_passed
        - credential_presented
        - credential_refused
        - presence_changed
        - visit_started
        - acceptance_decision
        - visit_ended
      title: VisitActivityKind
      type: string
    v1.StepRuleCondition:
      additionalProperties: false
      description: When a rule matches; a field left out matches anything.
      properties:
        transport:
          anyOf:
            - items:
                $ref: '#/components/schemas/v1.VisitTransport'
              type: array
            - type: 'null'
          default: null
          description: Any of these transports.
          title: Transport
        kind:
          anyOf:
            - items:
                $ref: '#/components/schemas/v1.PresenceKind'
              type: array
            - type: 'null'
          default: null
          description: Any of these kinds.
          title: Kind
        trust:
          anyOf:
            - items:
                $ref: '#/components/schemas/v1.PresenceTrust'
              type: array
            - type: 'null'
          default: null
          description: Any of these trusts.
          title: Trust
        minimum_identity_level:
          anyOf:
            - $ref: '#/components/schemas/v1.IdentityLevel'
            - type: 'null'
          default: null
          description: >-
            An identity level at this level or above, as the SDK derives it for
            the request; a request with none never meets it. A policy that sets
            it needs policy schema version 2.
      title: StepRuleCondition (v1)
      type: object
    v1.AcceptanceDecisionOutcome:
      description: |-
        What a decision recommends for a request: let it through, serve a
        challenge, ask for a stronger credential, or refuse it.
      enum:
        - allow
        - challenge
        - step_up
        - block
      title: AcceptanceDecisionOutcome
      type: string
    v1.Requirement:
      additionalProperties: false
      description: |-
        What a `step_up` or `challenge` asks of the visitor: exactly the field
        named by `kind` is set.
      oneOf:
        - properties:
            kind:
              const: scope
            scope:
              not:
                type: 'null'
            identity_level:
              type: 'null'
            challenge:
              type: 'null'
          required:
            - kind
            - scope
        - properties:
            kind:
              const: identity_level
            identity_level:
              not:
                type: 'null'
            scope:
              type: 'null'
            challenge:
              type: 'null'
          required:
            - kind
            - identity_level
        - properties:
            kind:
              const: challenge
            challenge:
              not:
                type: 'null'
            scope:
              type: 'null'
            identity_level:
              type: 'null'
          required:
            - kind
            - challenge
      properties:
        kind:
          $ref: '#/components/schemas/v1.RequirementKind'
          description: What is asked for.
        scope:
          anyOf:
            - type: string
            - type: 'null'
          default: null
          description: A disclosure scope, as `profile_id#scope`.
          examples:
            - shop-example#checkout
          title: Scope
        identity_level:
          anyOf:
            - $ref: '#/components/schemas/v1.IdentityLevel'
            - type: 'null'
          default: null
          description: The minimum identity level.
        challenge:
          anyOf:
            - $ref: '#/components/schemas/v1.ChallengeKind'
            - type: 'null'
          default: null
          description: The challenge to solve.
      required:
        - kind
      title: Requirement (v1)
      type: object
    v1.VisitTransport:
      description: How a visitor reached the merchant. Values may be added.
      enum:
        - browser
        - api
        - mcp
        - ucp
      title: VisitTransport
      type: string
    v1.PresenceKind:
      description: |-
        What is behind a request at a merchant: a person, an AI agent, a
        crawler, other automation, or not yet known.
      enum:
        - human
        - agent
        - crawler
        - automation
        - unknown
      title: PresenceKind
      type: string
    v1.PresenceTrust:
      description: |-
        How strongly the evidence backs a request's presence, strongest first:
        `credentialed` (a KYA credential), `verified` (a verified signature
        such as Web Bot Auth), `declared` (a User-Agent corroborated by the
        platform's published IP range), `scored` (a detection verdict),
        `unobserved` (the first request of a browser visit, before any
        evidence), `none` (evidence that did not corroborate).
      enum:
        - credentialed
        - verified
        - declared
        - scored
        - unobserved
        - none
      title: PresenceTrust
      type: string
    v1.IdentityLevel:
      description: |-
        The deepest identity established for a visitor, lowest to highest:
        `L1` the operator is known, `L2` a consistent per-person identifier
        (pseudonymous), `L3` a verified-identity credential.
      enum:
        - L1
        - L2
        - L3
      title: IdentityLevel
      type: string
    v1.RequirementKind:
      description: |-
        What a `step_up` or `challenge` asks for: a disclosure scope, a
        minimum identity level, or a challenge to solve. Values may be added.
      enum:
        - scope
        - identity_level
        - challenge
      title: RequirementKind
      type: string
    v1.ChallengeKind:
      description: |-
        The challenge a `challenge` decision serves to a browser: a
        provider-run browser challenge, interactive or not. Values may be added.
      enum:
        - managed
      title: ChallengeKind
      type: string
  securitySchemes:
    APIKeyHeader:
      type: apiKey
      in: header
      name: X-API-Key

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.