> ## Documentation Index > Fetch the complete documentation index at: https://docs.sailresearch.com/llms.txt > Use this file to discover all available pages before exploring further. # List HTTP policies > Returns a page of your organization's HTTP policies. Each item includes usage counts and secret names, but not the policy document. ## OpenAPI ````yaml /sailbox-openapi.json get /http-policies openapi: 3.1.0 info: title: Sail Sailbox API version: '2026-08-24' description: >- Create and operate Sailboxes over HTTP. Sailboxes are fast-booting virtual machines that you can pause, resume, and checkpoint. Three things happen outside this API: running commands and moving files, turning on SSH, and building an image. The first two take an SDK or the CLI, and building an image takes an SDK. Once SSH is on you can use `ssh` and `scp` for the first of those. See the [HTTP API guide](/sailboxes-http-api). servers: - url: https://sailbox-api.sailresearch.com/v1 security: - BearerAuth: [] tags: - name: Apps description: Groups that own Sailboxes. One app per workload. - name: Lifecycle description: >- A Sailbox's whole life: create it, watch it, stop and start it, terminate it. - name: Checkpoints description: Save a Sailbox to start from later, and copy a running one. - name: Networking description: >- Publish ports, serve them on hostnames you own, and identify a Sailbox to other Sailboxes. - name: Secrets description: >- Organization values that HTTP policies can add to matching requests. Sail never returns a stored value. - name: HTTP policies description: Rules for HTTPS requests a Sailbox sends. - name: Volumes description: >- Shared storage that outlives any one Sailbox. Alpha: these endpoints can still change. - name: SSH access description: Certificates for connecting to a Sailbox with `ssh`. - name: Usage description: Resource usage and spend. - name: Identity description: Who your API key belongs to. paths: /http-policies: get: tags: - HTTP policies summary: List HTTP policies description: >- Returns a page of your organization's HTTP policies. Each item includes usage counts and secret names, but not the policy document. operationId: listHttpPolicies parameters: - name: limit in: query schema: type: integer minimum: 1 maximum: 100 default: 50 description: How many policies to return. - name: offset in: query schema: type: integer minimum: 0 maximum: 100000 default: 0 description: How many policies to skip before the page starts. - name: search in: query schema: type: string description: >- Only return policies whose ID or name contains this text, ignoring case. At most 256 characters after surrounding whitespace is trimmed. responses: '200': description: A page of policies. content: application/json: schema: $ref: '#/components/schemas/HttpPolicyList' example: data: - id: hp_6f3a8d21-4b7c-4e90-a125-9d2f6c8b3a41 org_id: org_1a2b3c name: github created_at: '2026-08-20T09:35:00Z' updated_at: '2026-08-20T09:35:00Z' host_count: 1 rule_count: 1 referenced_secret_names: - GITHUB_TOKEN attachment_count: 2 limit: 50 offset: 0 total: 1 has_more: false '400': description: >- The request was rejected. See the error message for the offending field. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: message: limit must be between 1 and 100 type: invalid_request_error param: null code: null '401': description: The API key is missing or invalid. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: message: Invalid API key type: authentication_error param: null code: invalid_api_key '402': description: >- The organization is out of credits. The error carries a `billing_url` pointing at the page where you add them. Retry once you have. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: message: >- Your API key has been disabled due to insufficient credits. Visit https://app.sailresearch.com/billing to add credits. type: billing_error param: null code: credits_exhausted billing_url: https://app.sailresearch.com/billing '403': description: The API key is not allowed to perform this operation. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: message: sailboxes require an organization-scoped API key type: permission_error param: null code: null '429': description: >- For its first ten minutes a new organization is capped on how many requests it can have in flight at once, and yours is over that cap. The request never started, so retry it unchanged after the delay in the `Retry-After` header. The limit clears as those requests finish. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: message: >- Too many concurrent requests. Please retry after some of your organization's in-flight requests complete. type: rate_limit_error param: null code: rate_limited headers: Retry-After: $ref: '#/components/headers/RetryAfter' '500': description: Server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: message: list HTTP policies failed type: server_error param: null code: null '503': description: >- Sail is momentarily unavailable. Retry after the delay in the `Retry-After` header when one is present, and with backoff otherwise. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: message: Authentication service unavailable type: server_error param: null code: null headers: Retry-After: $ref: '#/components/headers/RetryAfter' components: schemas: HttpPolicyList: type: object additionalProperties: false properties: data: type: array items: $ref: '#/components/schemas/HttpPolicySummary' description: The requested page of policy summaries. limit: type: integer minimum: 1 maximum: 100 description: Page size that was applied. offset: type: integer minimum: 0 maximum: 100000 description: Offset that was applied. total: type: integer minimum: 0 description: Total number of policies matching the search. has_more: type: boolean description: Whether another page follows this one. required: - data - limit - offset - total - has_more ErrorResponse: type: object required: - error properties: error: $ref: '#/components/schemas/ErrorObject' HttpPolicySummary: type: object additionalProperties: false properties: id: type: string pattern: >- ^hp_[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: Stable policy ID. org_id: type: string description: Organization that owns the policy. name: type: string description: Display name. created_at: type: string format: date-time description: When the policy was created. updated_at: type: string format: date-time description: When the policy name last changed. host_count: type: integer minimum: 1 maximum: 100 description: Number of host patterns in the document. rule_count: type: integer minimum: 1 maximum: 100 description: Number of rules across every host pattern. referenced_secret_names: type: array items: type: string pattern: ^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$ description: Secrets the document uses. attachment_count: type: integer minimum: 0 description: Number of Sailboxes currently using the policy. required: - id - org_id - name - created_at - updated_at - host_count - rule_count - referenced_secret_names - attachment_count ErrorObject: type: object required: - message - type - param - code properties: message: type: string description: Human-readable description of what went wrong. type: type: string description: >- Error category: `invalid_request_error`, `authentication_error`, `permission_error`, `billing_error`, `not_found_error`, `conflict_error`, `rate_limit_error`, `quota_exceeded_error`, or `server_error`. param: oneOf: - type: string - type: 'null' description: >- The request field the error refers to, when the error is about one field. code: oneOf: - type: string - type: integer - type: 'null' description: Stable short code for the error, when one applies. billing_url: type: string format: uri description: Page where you add credits. Sent with a 402. additionalProperties: true headers: RetryAfter: description: >- How many seconds to wait before retrying. On a 429 it also means the request never started, so the retry can reuse the same `Idempotency-Key`. schema: type: integer minimum: 0 securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: API Key ````