# List policy

URL: https://docs.hanzo.ai/docs/openapi/risk/riskpolicy

> Reports the caller organisation's own decision-regime history: every distinct regime it has adopted, which version is in force, and what retention has taken.

`GET /v1/risk/policy`

> [Risk →](https://docs.hanzo.ai/docs/openapi/risk) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides)

|               |                                        |
| ------------- | -------------------------------------- |
| **Address**   | `https://api.hanzo.ai/v1/risk/policy`  |
| **Method**    | `GET`                                  |
| **Operation** | `riskPolicy`                           |
| **Auth**      | `Authorization: Bearer $HANZO_API_KEY` |

Reports the caller organisation's own decision-regime history: every
distinct regime it has adopted, which version is in force, and what retention
has taken.

WHY IT EXISTS. Every score cites the version it was decided under
(\[riskScoreOut.Policy]), and the threshold that score was measured against is
derived from the appetite that version states. Restate the appetite and, without
this record, every earlier decision becomes unreconstructible — the cut it was
judged by no longer exists anywhere. An adverse decision that cannot be
explained against the policy in force when it was taken cannot be defended.

It covers ONE organisation. The history is on that organisation's own shelf, so
another's versions are not filtered out of the answer — they are not in the file
the answer is read from.

## Request

`GET /v1/risk/policy` takes no parameters and no body — the credential is the whole request.

## Response

| Status    | Body               | Meaning |
| --------- | ------------------ | ------- |
| `200`     | risk.riskPolicyOut | ok      |
| `default` | problem-details    | refused |

`200` body — 12 fields.

| Field               | In   | Type                      | Always | Description                                                                                                                       |
| ------------------- | ---- | ------------------------- | ------ | --------------------------------------------------------------------------------------------------------------------------------- |
| `changes`           | body | integer (int64)           | —      | Changes is how many DISTINCT regimes may be adopted per Window.                                                                   |
| `disposed`          | body | integer (int64)           | —      | Disposed is how many versions retention has taken.                                                                                |
| `history`           | body | risk.riskPolicyVersion\[] | —      | History is the retained versions, newest first.                                                                                   |
| `history[].at`      | body | string                    | —      | At is when it entered force, RFC 3339, from the server clock.                                                                     |
| `history[].by`      | body | string                    | —      | By is the identity that stated it, stamped server-side from the validated principal at the moment it entered force.               |
| `history[].live`    | body | boolean                   | —      | Live is whether the model was permitted to change an outcome under it.                                                            |
| `history[].review`  | body | number (double)           | —      | Review is the share of the stream the regime states may be examined.                                                              |
| `history[].sample`  | body | number (double)           | —      | Sample is the share of below-the-line events the regime retains for review.                                                       |
| `history[].version` | body | integer (int64)           | —      | Version names this regime in this organisation's history.                                                                         |
| `retained`          | body | integer (int64)           | —      | Retained is how many versions this organisation's history holds at most, derived from the byte budget its rows are a multiple of. |
| `version`           | body | integer (int64)           | —      | Version is the version in force — the one every score currently cites.                                                            |
| `window`            | body | string                    | —      | Window is the period Changes is measured over.                                                                                    |

Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors).

## Examples

**CLI**

```bash
hanzo risk policy get
```

**SDK**

**.ts**

```ts
import { Configuration, RiskApi } from 'hanzoai';

const api = new RiskApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.riskPolicy();
```

**.py**

```python
from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import RiskApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = RiskApi(client).risk_policy()
```

**.go**

```go
cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.RiskAPI.RiskPolicy(context.Background()).Execute()
if err != nil {
	return err
}
```

**.rs**

```rust
use hanzo_client::apis::{configuration::Configuration, risk_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = risk_api::risk_policy(&cfg, Default::default()).await?;
```

**.java**

```java
import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.RiskApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new RiskApi(client).riskPolicy();
```

**HTTP**

```bash
curl https://api.hanzo.ai/v1/risk/policy \
  -H "Authorization: Bearer $HANZO_API_KEY"
```

**MCP**

Tool `risk`, op `riskPolicy` — POST the JSON-RPC envelope to `https://api.hanzo.ai/v1/mcp`.

```bash
curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "risk",
         "arguments": {
           "op": "riskPolicy",
           "input": {}
         }
       }
     }'
```

---

[Risk API](https://docs.hanzo.ai/docs/openapi/risk) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)