> ## Documentation Index > Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt > Use this file to discover all available pages before exploring further. # Get a group's inline policy by name ## OpenAPI ````yaml /api-reference/specs/iam.yaml get /v1/groups/{group_id}/inline-policies/{policy_name} openapi: 3.0.3 info: title: Basaltic IAM API version: 1.0.0 description: | Identity for the platform: organizations, accounts, users, groups, service accounts, roles and policies, together with the sign-in flows and the temporary STS credentials every other Basaltic API authenticates against. contact: name: Basaltic Support email: ping@basaltic.sh license: name: Proprietary url: https://basaltic.sh/terms servers: - url: https://iam.basaltic.sh description: Global API endpoint security: - SignatureAuth: [] paths: /v1/groups/{group_id}/inline-policies/{policy_name}: parameters: - name: group_id in: path required: true schema: type: string format: uuid example: a1b2c3d4-e5f6-7890-1234-567890abcdef - name: policy_name in: path required: true schema: type: string example: S3BucketAccess get: tags: - IAM summary: Get a group's inline policy by name operationId: getGroupInlinePolicy responses: '200': description: The inline policy content: application/json: schema: $ref: '#/components/schemas/InlinePolicyResponse' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalServerError' security: - SignatureAuth: [] components: schemas: InlinePolicyResponse: type: object properties: inline_policy: $ref: '#/components/schemas/InlinePolicy' InlinePolicy: type: object properties: id: type: string format: uuid example: d4e5f6a7-b8c9-0123-4567-890abcdef123 principal_id: type: string format: uuid example: 550e8400-e29b-41d4-a716-446655440000 principal_type: type: string enum: - user - service_account - role - group example: user name: type: string example: S3BucketAccess document: $ref: '#/components/schemas/PolicyDocument' created_at: type: string format: date-time example: '2026-01-15T09:30:00Z' updated_at: type: string format: date-time example: '2026-01-16T14:20:00Z' Error: type: object required: - error properties: error: type: object required: - code - message - request_id properties: code: type: string description: Error code identifying the type of error example: INVALID_INPUT message: type: string description: Human-readable error message example: Invalid request parameters request_id: type: string format: uuid description: Request ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 PolicyDocument: type: object description: IAM-style policy document required: - version - statements properties: version: type: string enum: - '2024-01-01' example: '2024-01-01' statements: type: array minItems: 1 items: $ref: '#/components/schemas/PolicyStatement' PolicyStatement: type: object description: > A single statement. The action set is named either positively (`actions`) or by exclusion (`not_actions`), and the resource set likewise (`resources` / `not_resources`) — exactly one of each pair. A statement that sets both sides of a pair, or neither, is rejected with `INVALID_INPUT` when the document is saved. required: - effect allOf: - oneOf: - required: - actions - required: - not_actions - oneOf: - required: - resources - required: - not_resources properties: sid: type: string description: Statement identifier example: AllowS3Read effect: type: string enum: - allow - deny example: allow actions: type: array minItems: 1 items: type: string description: Actions in service:action format example: - s3:GetObject - s3:ListBucket not_actions: type: array minItems: 1 items: type: string description: > The statement covers every action *except* these. Pairs naturally with `effect: deny` to carve a hole out of a broad allow; with `effect: allow` it grants everything the listed patterns don't name, including actions added by future services. example: - iam:* resources: type: array minItems: 1 items: type: string description: Resource identifiers or patterns example: - my-bucket/* - my-bucket not_resources: type: array minItems: 1 items: type: string description: > The statement covers every resource *except* these. Same trade-off as `not_actions`: with `effect: allow` it reaches resources that do not exist yet. example: - crn:iam:::user/* conditions: type: array description: Optional conditions for the statement items: $ref: '#/components/schemas/PolicyCondition' example: - operator: equals key: s3:prefix values: - home/ - shared/ PolicyCondition: type: object description: A condition that must be satisfied for the statement to apply required: - operator - key - values properties: operator: type: string enum: - equals - not_equals - starts_with - ends_with - contains - in - not_in - greater_than - less_than - greater_than_or_equals - less_than_or_equals - exists - not_exists - ip_address - not_ip_address description: The comparison operator example: equals key: type: string description: The condition key to evaluate example: s3:prefix values: type: array items: type: string description: Values to compare against example: - home/ - shared/ set_operator: type: string enum: - for_all_values - for_any_value description: > Evaluates `operator` against a multi-valued context key (a set, such as `basalt:TagKeys` — the tag keys a request carries) rather than a single value. Omit for an ordinary single-valued condition. - `for_all_values` — holds when every member of the request set satisfies `operator`. An absent or empty set holds vacuously, so a request carrying no tags is not fenced by a tag-key restriction. - `for_any_value` — holds when at least one member does. An absent or empty set does not hold. example: for_all_values responses: Unauthorized: description: Authentication required or token invalid content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: UNAUTHORIZED message: Authentication required request_id: 550e8400-e29b-41d4-a716-446655440000 Forbidden: description: Insufficient permissions content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: ACCESS_DENIED message: You don't have permission to perform this action request_id: 550e8400-e29b-41d4-a716-446655440000 NotFound: description: Resource not found content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: NOT_FOUND message: Resource not found request_id: 550e8400-e29b-41d4-a716-446655440000 InternalServerError: description: Internal server error content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: INTERNAL_ERROR message: An internal error occurred request_id: 550e8400-e29b-41d4-a716-446655440000 securitySchemes: SignatureAuth: type: apiKey in: header name: Authorization description: > Request signing with an access key issued to a service account. An HMAC-SHA256 over a canonical form of the request, close to AWS SigV4. The `basaltic` CLI signs for you. Send `Authorization`, `X-Date` (UTC, `YYYYMMDDTHHMMSSZ`) and `X-Nonce` (random per request); add `X-Content-Sha256` to bind a body, and `X-Amz-Security-Token` when using temporary credentials. ``` Authorization: BASALTIC-HMAC-SHA256 Credential=///basaltic/basaltic_request, SignedHeaders=host;x-date;x-nonce, Signature= ``` `` is the region code you are calling, or `global` for the global services. A signature is valid for 5 minutes from `X-Date`, and mutating requests are replay-guarded on the nonce. **Full signing procedure, including a working implementation:** https://docs.basaltic.sh/authentication ## Rate limits There is no global request budget. A limit applies only where an operation documents a `429`, and that operation says what it counts. Those responses carry `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` and, on a `429`, `Retry-After` — read them rather than hard-coding a number. Retrying before `Retry-After` is refused and extends the window. Everything else is bounded by quota, not by request rate. ````