> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-leet-slack-mcp-docs.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Get > Get a session policy by ID. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples get /api/v1/session-policies/{id} openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/session-policies/{id}: get: tags: - Session Policy summary: Get description: Get a session policy by ID. operationId: c1.api.session_policy.v1.SessionPolicyService.Get parameters: - in: path name: id required: true schema: description: The id field. type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.session_policy.v1.SessionPolicyServiceGetResponse description: Successful response x-codeSamples: - lang: go label: Get source: "package main\n\nimport(\n\t\"context\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/shared\"\n\tconductoronesdkgo \"github.com/conductorone/conductorone-sdk-go\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/operations\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := conductoronesdkgo.New(\n conductoronesdkgo.WithSecurity(shared.Security{\n BearerAuth: \"\",\n Oauth: \"\",\n }),\n )\n\n res, err := s.SessionPolicy.Get(ctx, operations.C1APISessionPolicyV1SessionPolicyServiceGetRequest{\n ID: \"\",\n })\n if err != nil {\n log.Fatal(err)\n }\n if res.SessionPolicyServiceGetResponse != nil {\n // handle response\n }\n}" components: schemas: c1.api.session_policy.v1.SessionPolicyServiceGetResponse: description: The SessionPolicyServiceGetResponse message. properties: sessionPolicy: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.SessionPolicy' - type: 'null' title: Session Policy Service Get Response type: object x-speakeasy-name-override: SessionPolicyServiceGetResponse c1.api.session_policy.v1.SessionPolicy: description: >- SessionPolicy defines session lifetime and continuous-evaluation behavior. properties: accessTokenTtlSeconds: description: How long an access token is valid, in seconds. format: int32 type: integer continuousDefaultOutcome: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.PolicyOutcome' - type: 'null' continuousRules: description: >- The continuous-evaluation rule cascade, re-checked on every request and on inbound shared-signals events. items: $ref: '#/components/schemas/c1.api.session_policy.v1.PolicyRule' type: - array - 'null' createdAt: format: date-time readOnly: true type: - string - 'null' credentialDurations: description: Per-credential-type lifetime overrides. items: $ref: >- #/components/schemas/c1.api.session_policy.v1.PerCredentialDuration type: - array - 'null' deletedAt: format: date-time readOnly: true type: - string - 'null' displayName: description: A human-readable name for the policy. type: string id: description: Unique identifier for the policy. readOnly: true type: string idleTimeoutSeconds: description: How long a session may be idle before it ends, in seconds. format: int32 type: integer isBuiltin: description: >- True for built-in policies provided by ConductorOne. Built-in policies cannot be edited or deleted. readOnly: true type: boolean maxSessionDurationSeconds: description: The maximum total lifetime of a session, in seconds. format: int32 type: integer persistence: description: Whether sessions may persist across browser restarts. enum: - PERSISTENCE_MODE_UNSPECIFIED - PERSISTENCE_MODE_ALLOW_USER_CHOICE - PERSISTENCE_MODE_ALWAYS_PERSIST - PERSISTENCE_MODE_SESSION_ONLY type: string x-speakeasy-unknown-values: allow priority: description: >- When a user matches more than one policy, the policy with the highest priority applies. format: int32 type: integer refreshRotationWindowSeconds: description: >- Grace window after rotation during which the previous refresh token is still accepted, in seconds (covers in-flight client retries). format: int32 type: integer refreshTokenTtlSeconds: description: How long a refresh token is valid, in seconds. format: int32 type: integer rotateRefreshOnUse: description: Whether to issue a new refresh token each time one is used. type: boolean ssfReceive: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.SSFReceiverConfig' - type: 'null' ssfTransmit: oneOf: - $ref: >- #/components/schemas/c1.api.session_policy.v1.SSFTransmitterConfig - type: 'null' updatedAt: format: date-time readOnly: true type: - string - 'null' title: Session Policy type: object x-speakeasy-entity: SessionPolicy x-speakeasy-name-override: SessionPolicy c1.api.session_policy.v1.PolicyOutcome: description: > PolicyOutcome is the effect of a matched rule. Exactly one kind is set. For session continuous-evaluation, the meaningful kinds are Allow (continue), Deny (terminate), and StepUpRequired. This message contains a oneof named kind. Only a single field of the following list may be set at a time: - allow - deny - stepUpRequired - challengeRequired - enrollmentRequired properties: allow: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.Allow' - type: 'null' challengeRequired: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.ChallengeRequired' - type: 'null' deny: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.Deny' - type: 'null' enrollmentRequired: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.EnrollmentRequired' - type: 'null' stepUpRequired: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.StepUpRequired' - type: 'null' title: Policy Outcome type: object x-speakeasy-name-override: SessionPolicyPolicyOutcome c1.api.session_policy.v1.PolicyRule: description: >- PolicyRule is one rung of the ordered continuous-evaluation cascade. Rules are evaluated top to bottom on every request; the first enforced rule whose condition matches supplies the outcome. properties: description: description: The description field. type: string id: description: The id field. type: string matchCel: description: The matchCel field. type: string mode: description: The mode field. enum: - POLICY_RULE_MODE_UNSPECIFIED - POLICY_RULE_MODE_ENFORCE - POLICY_RULE_MODE_OBSERVE - POLICY_RULE_MODE_DISABLED type: string x-speakeasy-unknown-values: allow outcome: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.PolicyOutcome' - type: 'null' title: Policy Rule type: object x-speakeasy-name-override: SessionPolicyPolicyRule c1.api.session_policy.v1.PerCredentialDuration: description: >- PerCredentialDuration overrides session lifetimes for sessions established with a particular credential type — stronger credentials can earn longer sessions. properties: accessTokenTtlSeconds: description: Access-token lifetime for this credential type, in seconds. format: int32 type: integer credentialType: description: The credentialType field. enum: - CREDENTIAL_TYPE_UNSPECIFIED - CREDENTIAL_TYPE_PASSKEY - CREDENTIAL_TYPE_PASSWORD - CREDENTIAL_TYPE_TOTP - CREDENTIAL_TYPE_EMAIL_OTP - CREDENTIAL_TYPE_RECOVERY_CODE - CREDENTIAL_TYPE_DELEGATED_GOOGLE - CREDENTIAL_TYPE_DELEGATED_MICROSOFT - CREDENTIAL_TYPE_UPSTREAM_IDP type: string x-speakeasy-unknown-values: allow maxSessionDurationSeconds: description: Maximum total session duration for this credential type, in seconds. format: int32 type: integer title: Per Credential Duration type: object x-speakeasy-name-override: PerCredentialDuration c1.api.session_policy.v1.SSFReceiverConfig: description: >- SSFReceiverConfig selects which inbound shared-signals streams this session trusts. Each stream's issuer, keys, expected audience, and per-event actions are configured on the stream itself; this policy just lists the stream IDs. properties: enabled: description: >- Whether inbound shared-signals consumption is enabled for this policy. type: boolean ssfReceiverStreamIds: description: The inbound stream IDs this policy trusts. items: type: string type: - array - 'null' title: Ssf Receiver Config type: object x-speakeasy-name-override: SSFReceiverConfig c1.api.session_policy.v1.SSFTransmitterConfig: description: |- SSFTransmitterConfig selects which outbound shared-signals streams this session emits security events to. Each stream's delivery endpoint, authentication, and per-event allowlist are configured on the stream itself; this policy just lists the stream IDs and the event types to emit. properties: enabled: description: Whether outbound shared-signals emission is enabled for this policy. type: boolean eventTypes: description: The shared-signals event types to emit at the policy level. items: type: string type: - array - 'null' ssfTransmitterStreamIds: description: The outbound stream IDs this policy emits to. items: type: string type: - array - 'null' title: Ssf Transmitter Config type: object x-speakeasy-name-override: SSFTransmitterConfig c1.api.session_policy.v1.Allow: description: Allow continues the session. properties: floorLevel: description: The minimum assurance level that satisfies this rule. enum: - AUTH_LEVEL_UNSPECIFIED - AUTH_LEVEL_NONE - AUTH_LEVEL_SINGLE_FACTOR - AUTH_LEVEL_MULTI_FACTOR - AUTH_LEVEL_PHR - AUTH_LEVEL_PHRH type: string x-speakeasy-unknown-values: allow title: Allow type: object x-speakeasy-name-override: SessionPolicyAllow c1.api.session_policy.v1.ChallengeRequired: description: ChallengeRequired asks for an additional factor. properties: types: description: The types field. items: enum: - CREDENTIAL_TYPE_UNSPECIFIED - CREDENTIAL_TYPE_PASSKEY - CREDENTIAL_TYPE_PASSWORD - CREDENTIAL_TYPE_TOTP - CREDENTIAL_TYPE_EMAIL_OTP - CREDENTIAL_TYPE_RECOVERY_CODE - CREDENTIAL_TYPE_DELEGATED_GOOGLE - CREDENTIAL_TYPE_DELEGATED_MICROSOFT - CREDENTIAL_TYPE_UPSTREAM_IDP type: string x-speakeasy-unknown-values: allow type: - array - 'null' title: Challenge Required type: object x-speakeasy-name-override: SessionPolicyChallengeRequired c1.api.session_policy.v1.Deny: description: Deny terminates the session. properties: reasonAdmin: description: Reason shown in admin-only audit. type: string reasonUser: description: Reason safe to show the end user. type: string title: Deny type: object x-speakeasy-name-override: SessionPolicyDeny c1.api.session_policy.v1.EnrollmentRequired: description: >- EnrollmentRequired tells the user to enroll a credential before continuing. properties: credentialTypes: description: The credentialTypes field. items: enum: - CREDENTIAL_TYPE_UNSPECIFIED - CREDENTIAL_TYPE_PASSKEY - CREDENTIAL_TYPE_PASSWORD - CREDENTIAL_TYPE_TOTP - CREDENTIAL_TYPE_EMAIL_OTP - CREDENTIAL_TYPE_RECOVERY_CODE - CREDENTIAL_TYPE_DELEGATED_GOOGLE - CREDENTIAL_TYPE_DELEGATED_MICROSOFT - CREDENTIAL_TYPE_UPSTREAM_IDP type: string x-speakeasy-unknown-values: allow type: - array - 'null' title: Enrollment Required type: object x-speakeasy-name-override: SessionPolicyEnrollmentRequired c1.api.session_policy.v1.StepUpRequired: description: >- StepUpRequired demands a stronger re-authentication before the session may continue. properties: level: description: The level field. enum: - AUTH_LEVEL_UNSPECIFIED - AUTH_LEVEL_NONE - AUTH_LEVEL_SINGLE_FACTOR - AUTH_LEVEL_MULTI_FACTOR - AUTH_LEVEL_PHR - AUTH_LEVEL_PHRH type: string x-speakeasy-unknown-values: allow maxAgeSeconds: description: How fresh the step-up must be, in seconds. format: int32 type: integer types: description: The types field. items: enum: - CREDENTIAL_TYPE_UNSPECIFIED - CREDENTIAL_TYPE_PASSKEY - CREDENTIAL_TYPE_PASSWORD - CREDENTIAL_TYPE_TOTP - CREDENTIAL_TYPE_EMAIL_OTP - CREDENTIAL_TYPE_RECOVERY_CODE - CREDENTIAL_TYPE_DELEGATED_GOOGLE - CREDENTIAL_TYPE_DELEGATED_MICROSOFT - CREDENTIAL_TYPE_UPSTREAM_IDP type: string x-speakeasy-unknown-values: allow type: - array - 'null' title: Step Up Required type: object x-speakeasy-name-override: SessionPolicyStepUpRequired securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````