--- title: Get an execution policy description: Retrieve an existing execution policy by ID. breadcrumbs: Docs > API > Get an execution policy --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Get an execution policy ## v2 (latest) {% alert level="warning" %} **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help.md). {% /alert %} | Datadog site | API endpoint | | ----------------- | ------------------------------------------------------------------------------- | | app.datadoghq.com | GET https://api.datadoghq.com/api/v2/actions/execution-policies/{policy_id} | | us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/actions/execution-policies/{policy_id} | | us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/actions/execution-policies/{policy_id} | | app.datadoghq.eu | GET https://api.datadoghq.eu/api/v2/actions/execution-policies/{policy_id} | | ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/actions/execution-policies/{policy_id} | | ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/actions/execution-policies/{policy_id} | | uk1.datadoghq.com | GET https://api.uk1.datadoghq.com/api/v2/actions/execution-policies/{policy_id} | | app.ddog-gov.com | GET https://api.ddog-gov.com/api/v2/actions/execution-policies/{policy_id} | | us2.ddog-gov.com | GET https://api.us2.ddog-gov.com/api/v2/actions/execution-policies/{policy_id} | ### Overview Retrieve an existing execution policy by ID. This endpoint requires the `execution_groups_read` permission. ### Arguments #### Path Parameters | Field | Type | Description | | ---------------------- | ------ | ------------------------------- | | policy_id [*required*] | string | The ID of the execution policy. | ### Response {% tabs %} {% tab label="200" %} OK {% tabs %} {% tab label="Model" %} Response object that includes a single execution policy. | Parent field | Field | Type | Description | | -------------------- | ----------------------------------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | data [*required*] | object | Object for a single execution policy. | | data | attributes [*required*] | object | An execution policy. | | attributes | action_pattern [*required*] | object | The set of actions this policy applies to. | | action_pattern | action_fqns [*required*] | [string] | The fully qualified action names this policy matches. Use `*` to match all actions of the integration, or a fully qualified name prefixed with the integration's action namespace (for example `com.datadoghq.script.*` for the Script integration). | | action_pattern | integration [*required*] | enum | The integration the action pattern applies to. Allowed enum values: `INTEGRATION_KUBERNETES`, `INTEGRATION_SCRIPT`, `INTEGRATION_REMOTE_ACTION`, `INTEGRATION_SLACK`. | | attributes | created_at [*required*] | date-time | The date and time the execution policy was created. | | attributes | created_by [*required*] | string | The ID of the user who created the execution policy. | | attributes | effect [*required*] | enum | Whether the policy allows or denies matching actions. Allowed enum values: `allow`, `deny`. | | attributes | name [*required*] | string | The name of the execution policy. | | attributes | scope | object | Restricts where the policy applies. At most one scope type can be set, and it must match the action pattern's integration. An empty object means the policy has no scope restriction. | | scope | kubernetes | object | Restricts the policy to specific Kubernetes namespaces. | | kubernetes | rules [*required*] | [object] | The Kubernetes scope rules. | | rules | target_namespaces [*required*] | [string] | The Kubernetes namespaces this rule applies to. | | scope | remote_action_rshell | object | Restricts the policy to specific remote shell paths. | | remote_action_rshell | rules [*required*] | [object] | The remote shell scope rules. | | rules | access [*required*] | enum | The level of remote shell access granted for the target paths. Allowed enum values: `read_only`, `read_write`. | | rules | target_paths [*required*] | [string] | The file system paths this rule applies to. | | scope | scripts | object | Restricts the policy to specific scripts. | | scripts | rules [*required*] | [object] | The script scope rules. | | rules | target_script_names [*required*] | [string] | The script names this rule applies to. | | scope | slack | object | Restricts the policy to specific Slack private channel names. | | slack | rules [*required*] | [object] | The Slack scope rules. | | rules | channel_name_selectors [*required*] | [string] | The private channel name selectors this rule applies to. Selectors are lowercase private channel names without the leading `#`, and can contain `*` wildcards. Use `*` alone to match any private channel name. | | attributes | targets [*required*] | [object] | The targets this policy applies to. | | targets | agent_tags [*required*] | [string] | The tags identifying the target. | | targets | name | string | A human-readable name for the target. | | attributes | updated_at [*required*] | date-time | The date and time the execution policy was last updated. | | attributes | updated_by [*required*] | string | The ID of the user who last updated the execution policy. | | attributes | version [*required*] | int32 | The version of the execution policy. Incremented on every update. | | data | id [*required*] | string | The ID of the execution policy. Read-only. | | data | type [*required*] | enum | The type of the resource. The value should always be `execution_policy`. Allowed enum values: `execution_policy`. Default: `execution_policy`. | {% /tab %} {% tab label="Example" %} ```json { "data": { "attributes": { "action_pattern": { "action_fqns": [ "com.datadoghq.script.*" ], "integration": "INTEGRATION_SCRIPT" }, "created_at": "2026-01-15T10:00:00.000Z", "created_by": "3fa85f64-5717-4562-b3fc-2c963f66afa6", "effect": "allow", "name": "Block prod restarts", "scope": { "kubernetes": { "rules": [ { "target_namespaces": [ "default" ] } ] }, "remote_action_rshell": { "rules": [ { "access": "read_only", "target_paths": [ "/var/log" ] } ] }, "scripts": { "rules": [ { "target_script_names": [ "restart_service.sh" ] } ] }, "slack": { "rules": [ { "channel_name_selectors": [ "incident-*" ] } ] } }, "targets": [ { "agent_tags": [ "env:prod" ], "name": "Production hosts" } ], "updated_at": "2026-01-15T10:00:00.000Z", "updated_by": "3fa85f64-5717-4562-b3fc-2c963f66afa6", "version": 1 }, "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6", "type": "execution_policy" } } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="403" %} Forbidden {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="404" %} Not Found {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="429" %} Too many requests {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% /tabs %} ### Code Example {% tabs %} {% tab label="Curl" %} ```bash # Path parameters export policy_id="3fa85f64-5717-4562-b3fc-2c963f66afa6" # Set your Datadog site and credentials export DD_SITE="datadoghq.com" # Or us3.datadoghq.com, us5.datadoghq.com, datadoghq.eu, ap1.datadoghq.com, ap2.datadoghq.com, uk1.datadoghq.com, ddog-gov.com, us2.ddog-gov.com # Use a Personal Access Token or Service Access Token export DD_BEARER_TOKEN="" curl -X GET "https://api.${DD_SITE}/api/v2/actions/execution-policies/${policy_id}" \ -H "Accept: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" ``` {% /tab %} {% tab label="Go" %} ```go // Get an execution policy returns "OK" response package main import ( "context" "encoding/json" "fmt" "os" "github.com/DataDog/datadog-api-client-go/v2/api/datadog" "github.com/DataDog/datadog-api-client-go/v2/api/datadogV2" ) func main() { // there is a valid "execution_policy" in the system ExecutionPolicyDataID := os.Getenv("EXECUTION_POLICY_DATA_ID") ctx := datadog.NewDefaultContext(context.Background()) ctx = context.WithValue(ctx, datadog.ContextAccessToken, os.Getenv("DD_BEARER_TOKEN")) configuration := datadog.NewConfiguration() configuration.SetUnstableOperationEnabled("v2.GetExecutionPolicy", true) apiClient := datadog.NewAPIClient(configuration) api := datadogV2.NewExecutionPolicyApi(apiClient) resp, r, err := api.GetExecutionPolicy(ctx, ExecutionPolicyDataID) if err != nil { fmt.Fprintf(os.Stderr, "Error when calling `ExecutionPolicyApi.GetExecutionPolicy`: %v\n", err) fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) } responseContent, _ := json.MarshalIndent(resp, "", " ") fmt.Fprintf(os.Stdout, "Response from `ExecutionPolicyApi.GetExecutionPolicy`:\n%s\n", responseContent) } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=go) and then save the example to `main.go` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" go run "main.go" ``` {% /tab %} {% tab label="Java" %} ```java // Get an execution policy returns "OK" response import com.datadog.api.client.ApiClient; import com.datadog.api.client.ApiException; import com.datadog.api.client.v2.api.ExecutionPolicyApi; import com.datadog.api.client.v2.model.ExecutionPolicyResponse; public class Example { public static void main(String[] args) { ApiClient defaultClient = ApiClient.getDefaultApiClient(); defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN")); defaultClient.setUnstableOperationEnabled("v2.getExecutionPolicy", true); ExecutionPolicyApi apiInstance = new ExecutionPolicyApi(defaultClient); // there is a valid "execution_policy" in the system String EXECUTION_POLICY_DATA_ID = System.getenv("EXECUTION_POLICY_DATA_ID"); try { ExecutionPolicyResponse result = apiInstance.getExecutionPolicy(EXECUTION_POLICY_DATA_ID); System.out.println(result); } catch (ApiException e) { System.err.println("Exception when calling ExecutionPolicyApi#getExecutionPolicy"); System.err.println("Status code: " + e.getCode()); System.err.println("Reason: " + e.getResponseBody()); System.err.println("Response headers: " + e.getResponseHeaders()); e.printStackTrace(); } } } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=java) and then save the example to `Example.java` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" java "Example.java" ``` {% /tab %} {% tab label="Python" %} ```python """ Get an execution policy returns "OK" response """ from os import environ from datadog_api_client import ApiClient, Configuration from datadog_api_client.v2.api.execution_policy_api import ExecutionPolicyApi # there is a valid "execution_policy" in the system EXECUTION_POLICY_DATA_ID = environ["EXECUTION_POLICY_DATA_ID"] configuration = Configuration() configuration.access_token = environ["DD_BEARER_TOKEN"] configuration.unstable_operations["get_execution_policy"] = True with ApiClient(configuration) as api_client: api_instance = ExecutionPolicyApi(api_client) response = api_instance.get_execution_policy( policy_id=EXECUTION_POLICY_DATA_ID, ) print(response) ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=python) and then save the example to `example.py` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" python3 "example.py" ``` {% /tab %} {% tab label="Ruby" %} ```ruby # Get an execution policy returns "OK" response require "datadog_api_client" DatadogAPIClient.configure do |config| config.access_token = ENV["DD_BEARER_TOKEN"] config.unstable_operations["v2.get_execution_policy".to_sym] = true end api_instance = DatadogAPIClient::V2::ExecutionPolicyAPI.new # there is a valid "execution_policy" in the system EXECUTION_POLICY_DATA_ID = ENV["EXECUTION_POLICY_DATA_ID"] p api_instance.get_execution_policy(EXECUTION_POLICY_DATA_ID) ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=ruby) and then save the example to `example.rb` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" ruby "example.rb" ``` {% /tab %} {% tab label="Rust" %} ```rust // Get an execution policy returns "OK" response use datadog_api_client::datadog; use datadog_api_client::datadogV2::api_execution_policy::ExecutionPolicyAPI; #[tokio::main] async fn main() { // there is a valid "execution_policy" in the system let execution_policy_data_id = std::env::var("EXECUTION_POLICY_DATA_ID").unwrap(); let mut configuration = datadog::Configuration::new(); configuration.set_unstable_operation_enabled("v2.get_execution_policy", true); let api = ExecutionPolicyAPI::with_config(configuration); let resp = api .get_execution_policy(execution_policy_data_id.clone()) .await; if let Ok(value) = resp { println!("{:#?}", value); } else { println!("{:#?}", resp.unwrap_err()); } } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=rust) and then save the example to `src/main.rs` and run following commands: ```bash DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" cargo run ``` {% /tab %} {% tab label="TypeScript" %} ```typescript /** * Get an execution policy returns "OK" response */ import { client, v2 } from "@datadog/datadog-api-client"; const configuration = client.createConfiguration({ authMethods: { AuthZ: { accessToken: process.env.DD_BEARER_TOKEN as string, }, }, }); configuration.unstableOperations["v2.getExecutionPolicy"] = true; const apiInstance = new v2.ExecutionPolicyApi(configuration); // there is a valid "execution_policy" in the system const EXECUTION_POLICY_DATA_ID = process.env.EXECUTION_POLICY_DATA_ID as string; const params: v2.ExecutionPolicyApiGetExecutionPolicyRequest = { policyId: EXECUTION_POLICY_DATA_ID, }; apiInstance .getExecutionPolicy(params) .then((data: v2.ExecutionPolicyResponse) => { console.log( "API called successfully. Returned data: " + JSON.stringify(data) ); }) .catch((error: any) => console.error(error)); ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=typescript) and then save the example to `example.ts` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" npx tsx "example.ts" ``` {% /tab %} {% /tabs %}