--- title: List execution policies description: Retrieve a list of execution policies for the current organization. breadcrumbs: Docs > API > List execution policies --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # List execution policies ## v2 (latest) {% alert level="warning" %} **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help.md). {% /alert %} | Datadog site | API endpoint | | ----------------- | ------------------------------------------------------------------- | | app.datadoghq.com | GET https://api.datadoghq.com/api/v2/actions/execution-policies | | us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/actions/execution-policies | | us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/actions/execution-policies | | app.datadoghq.eu | GET https://api.datadoghq.eu/api/v2/actions/execution-policies | | ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/actions/execution-policies | | ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/actions/execution-policies | | uk1.datadoghq.com | GET https://api.uk1.datadoghq.com/api/v2/actions/execution-policies | | app.ddog-gov.com | GET https://api.ddog-gov.com/api/v2/actions/execution-policies | | us2.ddog-gov.com | GET https://api.us2.ddog-gov.com/api/v2/actions/execution-policies | ### Overview Retrieve a list of execution policies for the current organization. This endpoint requires the `execution_groups_read` permission. ### Arguments #### Query Strings | Field | Type | Description | | ------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | page[size] | integer | The number of execution policies to return per page. Default: `100`. | | page[number] | integer | The page number to return. Default: `0`. | | filter[name] | string | Filter execution policies by name. | | filter[ids] | array | Filter execution policies by a list of IDs. | | filter[integration] | array | Filter execution policies by a list of integrations. | | filter[effects] | array | Filter execution policies by a list of effects. | | filter[creator_ids] | array | Filter execution policies by a list of creator IDs. | | sort | array | The sort order for the results. Prefix a field with `-` to sort in descending order. Valid fields are `name`, `effect`, `integration`, `created_at`, and `updated_at`. | ### Response {% tabs %} {% tab label="200" %} OK {% tabs %} {% tab label="Model" %} Response object that includes a list of execution policies. | Parent field | Field | Type | Description | | -------------------- | ----------------------------------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | data [*required*] | [object] | The execution policies. | | data | attributes [*required*] | object | An execution policy. | | attributes | action_pattern [*required*] | object | The set of actions this policy applies to. | | action_pattern | action_fqns [*required*] | [string] | The fully qualified action names this policy matches. Use `*` to match all actions of the integration, or a fully qualified name prefixed with the integration's action namespace (for example `com.datadoghq.script.*` for the Script integration). | | action_pattern | integration [*required*] | enum | The integration the action pattern applies to. Allowed enum values: `INTEGRATION_KUBERNETES`, `INTEGRATION_SCRIPT`, `INTEGRATION_REMOTE_ACTION`, `INTEGRATION_SLACK`. | | attributes | created_at [*required*] | date-time | The date and time the execution policy was created. | | attributes | created_by [*required*] | string | The ID of the user who created the execution policy. | | attributes | effect [*required*] | enum | Whether the policy allows or denies matching actions. Allowed enum values: `allow`, `deny`. | | attributes | name [*required*] | string | The name of the execution policy. | | attributes | scope | object | Restricts where the policy applies. At most one scope type can be set, and it must match the action pattern's integration. An empty object means the policy has no scope restriction. | | scope | kubernetes | object | Restricts the policy to specific Kubernetes namespaces. | | kubernetes | rules [*required*] | [object] | The Kubernetes scope rules. | | rules | target_namespaces [*required*] | [string] | The Kubernetes namespaces this rule applies to. | | scope | remote_action_rshell | object | Restricts the policy to specific remote shell paths. | | remote_action_rshell | rules [*required*] | [object] | The remote shell scope rules. | | rules | access [*required*] | enum | The level of remote shell access granted for the target paths. Allowed enum values: `read_only`, `read_write`. | | rules | target_paths [*required*] | [string] | The file system paths this rule applies to. | | scope | scripts | object | Restricts the policy to specific scripts. | | scripts | rules [*required*] | [object] | The script scope rules. | | rules | target_script_names [*required*] | [string] | The script names this rule applies to. | | scope | slack | object | Restricts the policy to specific Slack private channel names. | | slack | rules [*required*] | [object] | The Slack scope rules. | | rules | channel_name_selectors [*required*] | [string] | The private channel name selectors this rule applies to. Selectors are lowercase private channel names without the leading `#`, and can contain `*` wildcards. Use `*` alone to match any private channel name. | | attributes | targets [*required*] | [object] | The targets this policy applies to. | | targets | agent_tags [*required*] | [string] | The tags identifying the target. | | targets | name | string | A human-readable name for the target. | | attributes | updated_at [*required*] | date-time | The date and time the execution policy was last updated. | | attributes | updated_by [*required*] | string | The ID of the user who last updated the execution policy. | | attributes | version [*required*] | int32 | The version of the execution policy. Incremented on every update. | | data | id [*required*] | string | The ID of the execution policy. Read-only. | | data | type [*required*] | enum | The type of the resource. The value should always be `execution_policy`. Allowed enum values: `execution_policy`. Default: `execution_policy`. | | | meta [*required*] | object | Pagination metadata for the list of execution policies. | | meta | page [*required*] | object | Pagination details. | | page | total [*required*] | int32 | The total number of execution policies matching the query. | {% /tab %} {% tab label="Example" %} ```json { "data": [ { "attributes": { "action_pattern": { "action_fqns": [ "com.datadoghq.script.*" ], "integration": "INTEGRATION_SCRIPT" }, "created_at": "2026-01-15T10:00:00.000Z", "created_by": "3fa85f64-5717-4562-b3fc-2c963f66afa6", "effect": "allow", "name": "Block prod restarts", "scope": { "kubernetes": { "rules": [ { "target_namespaces": [ "default" ] } ] }, "remote_action_rshell": { "rules": [ { "access": "read_only", "target_paths": [ "/var/log" ] } ] }, "scripts": { "rules": [ { "target_script_names": [ "restart_service.sh" ] } ] }, "slack": { "rules": [ { "channel_name_selectors": [ "incident-*" ] } ] } }, "targets": [ { "agent_tags": [ "env:prod" ], "name": "Production hosts" } ], "updated_at": "2026-01-15T10:00:00.000Z", "updated_by": "3fa85f64-5717-4562-b3fc-2c963f66afa6", "version": 1 }, "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6", "type": "execution_policy" } ], "meta": { "page": { "total": 1 } } } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="400" %} Bad Request {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="403" %} Forbidden {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="429" %} Too many requests {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% /tabs %} ### Code Example {% tabs %} {% tab label="Curl" %} ```bash # Set your Datadog site and credentials export DD_SITE="datadoghq.com" # Or us3.datadoghq.com, us5.datadoghq.com, datadoghq.eu, ap1.datadoghq.com, ap2.datadoghq.com, uk1.datadoghq.com, ddog-gov.com, us2.ddog-gov.com # Use a Personal Access Token or Service Access Token export DD_BEARER_TOKEN="" curl -X GET "https://api.${DD_SITE}/api/v2/actions/execution-policies" \ -H "Accept: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" ``` {% /tab %} {% tab label="Go" %} ```go // List execution policies returns "OK" response package main import ( "context" "encoding/json" "fmt" "os" "github.com/DataDog/datadog-api-client-go/v2/api/datadog" "github.com/DataDog/datadog-api-client-go/v2/api/datadogV2" ) func main() { ctx := datadog.NewDefaultContext(context.Background()) ctx = context.WithValue(ctx, datadog.ContextAccessToken, os.Getenv("DD_BEARER_TOKEN")) configuration := datadog.NewConfiguration() configuration.SetUnstableOperationEnabled("v2.ListExecutionPolicies", true) apiClient := datadog.NewAPIClient(configuration) api := datadogV2.NewExecutionPolicyApi(apiClient) resp, r, err := api.ListExecutionPolicies(ctx, *datadogV2.NewListExecutionPoliciesOptionalParameters()) if err != nil { fmt.Fprintf(os.Stderr, "Error when calling `ExecutionPolicyApi.ListExecutionPolicies`: %v\n", err) fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) } responseContent, _ := json.MarshalIndent(resp, "", " ") fmt.Fprintf(os.Stdout, "Response from `ExecutionPolicyApi.ListExecutionPolicies`:\n%s\n", responseContent) } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=go) and then save the example to `main.go` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" go run "main.go" ``` {% /tab %} {% tab label="Java" %} ```java // List execution policies returns "OK" response import com.datadog.api.client.ApiClient; import com.datadog.api.client.ApiException; import com.datadog.api.client.v2.api.ExecutionPolicyApi; import com.datadog.api.client.v2.model.ExecutionPolicyListResponse; public class Example { public static void main(String[] args) { ApiClient defaultClient = ApiClient.getDefaultApiClient(); defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN")); defaultClient.setUnstableOperationEnabled("v2.listExecutionPolicies", true); ExecutionPolicyApi apiInstance = new ExecutionPolicyApi(defaultClient); try { ExecutionPolicyListResponse result = apiInstance.listExecutionPolicies(); System.out.println(result); } catch (ApiException e) { System.err.println("Exception when calling ExecutionPolicyApi#listExecutionPolicies"); System.err.println("Status code: " + e.getCode()); System.err.println("Reason: " + e.getResponseBody()); System.err.println("Response headers: " + e.getResponseHeaders()); e.printStackTrace(); } } } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=java) and then save the example to `Example.java` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" java "Example.java" ``` {% /tab %} {% tab label="Python" %} ```python """ List execution policies returns "OK" response """ from os import environ from datadog_api_client import ApiClient, Configuration from datadog_api_client.v2.api.execution_policy_api import ExecutionPolicyApi configuration = Configuration() configuration.access_token = environ["DD_BEARER_TOKEN"] configuration.unstable_operations["list_execution_policies"] = True with ApiClient(configuration) as api_client: api_instance = ExecutionPolicyApi(api_client) response = api_instance.list_execution_policies() print(response) ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=python) and then save the example to `example.py` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" python3 "example.py" ``` {% /tab %} {% tab label="Ruby" %} ```ruby # List execution policies returns "OK" response require "datadog_api_client" DatadogAPIClient.configure do |config| config.access_token = ENV["DD_BEARER_TOKEN"] config.unstable_operations["v2.list_execution_policies".to_sym] = true end api_instance = DatadogAPIClient::V2::ExecutionPolicyAPI.new p api_instance.list_execution_policies() ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=ruby) and then save the example to `example.rb` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" ruby "example.rb" ``` {% /tab %} {% tab label="Rust" %} ```rust // List execution policies returns "OK" response use datadog_api_client::datadog; use datadog_api_client::datadogV2::api_execution_policy::ExecutionPolicyAPI; use datadog_api_client::datadogV2::api_execution_policy::ListExecutionPoliciesOptionalParams; #[tokio::main] async fn main() { let mut configuration = datadog::Configuration::new(); configuration.set_unstable_operation_enabled("v2.list_execution_policies", true); let api = ExecutionPolicyAPI::with_config(configuration); let resp = api .list_execution_policies(ListExecutionPoliciesOptionalParams::default()) .await; if let Ok(value) = resp { println!("{:#?}", value); } else { println!("{:#?}", resp.unwrap_err()); } } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=rust) and then save the example to `src/main.rs` and run following commands: ```bash DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" cargo run ``` {% /tab %} {% tab label="TypeScript" %} ```typescript /** * List execution policies returns "OK" response */ import { client, v2 } from "@datadog/datadog-api-client"; const configuration = client.createConfiguration({ authMethods: { AuthZ: { accessToken: process.env.DD_BEARER_TOKEN as string, }, }, }); configuration.unstableOperations["v2.listExecutionPolicies"] = true; const apiInstance = new v2.ExecutionPolicyApi(configuration); apiInstance .listExecutionPolicies() .then((data: v2.ExecutionPolicyListResponse) => { console.log( "API called successfully. Returned data: " + JSON.stringify(data) ); }) .catch((error: any) => console.error(error)); ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=typescript) and then save the example to `example.ts` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" npx tsx "example.ts" ``` {% /tab %} {% /tabs %}