List all policies for the organisation.
**Required scope:** `rls_policies:read`
Authorization
BearerAuth Security scheme for OpenAPI endpoints. Validates both JWT tokens and API keys.
In: header
Path Parameters
uuidResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/organisations/497f6eca-6276-4993-bfeb-53cbbbba6f08/policies"[ { "id": "string", "tableFqn": "string", "tableId": "string", "columnName": "string", "kind": "rls", "policyText": "string", "definition": { "effect": "permit", "subject": { "everyone": null, "role": null, "attribute": null, "op": null, "value": null }, "condition": null }, "enabled": true, "version": 0, "createdAt": "string", "updatedAt": "string" }]{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}Unlink an OAuth provider from the authenticated user.
Cleans up: `user_provider_identity_linking` row, vault secret + token cache, and any storage configurations tied to this provider's scheme. Gated on `oauth:unlink` (not `users:write`) so non-Admin roles can self-recover from expired/revoked tokens without needing an Admin to intervene. The endpoint only acts on the caller's own `user_id` derived from `AuthContext`, so no IDOR exposure. **Required scope:** `oauth:unlink`
Create a Cedar RLS/CLS policy for the organisation.
**Required scope:** `rls_policies:write`