curl --request GET \
--url https://api.citadel.example/api/v1/policy \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.citadel.example/api/v1/policy', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.citadel.example/api/v1/policy"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.citadel.example/api/v1/policy"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"version": 3,
"key_id": "merchant-policy-admin",
"published_at": "2026-10-08T12:00:00Z",
"document": "---\nceiling:\n TRX/6: '100000000'\nchains:\n tron:\n assets:\n native: TRX/6\n chain_module_version: 1\n wallets: {}\n whitelist: []\nreferences: {}\nversion: 3\n",
"signature": "mW4TRk7ILsg10NERnzqJ14UZMMeybgsDNWVrOH0ivkYciGtaWCd6AvK2lVJR59kRyNEC1YySITfcn7VZsKrwEA=="
}Get the policy document
The policy document last published to your policy engine: the whitelist, limits and
networks it enforces. document is the exact YAML your policy key signed, byte for byte,
and signature your key’s Ed25519 signature over those bytes (base64): check it with your
own key’s public half, and compare the document with the one you signed. Your engine
verifies the signature before it installs a document; what it enforces is its own copy.
One document rules every network and every vault: it takes no network. Needs the read
scope. A key limited to vaults is refused with 403 vault_limited. Before the first
document is published, 404.
curl --request GET \
--url https://api.citadel.example/api/v1/policy \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.citadel.example/api/v1/policy', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.citadel.example/api/v1/policy"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.citadel.example/api/v1/policy"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"version": 3,
"key_id": "merchant-policy-admin",
"published_at": "2026-10-08T12:00:00Z",
"document": "---\nceiling:\n TRX/6: '100000000'\nchains:\n tron:\n assets:\n native: TRX/6\n chain_module_version: 1\n wallets: {}\n whitelist: []\nreferences: {}\nversion: 3\n",
"signature": "mW4TRk7ILsg10NERnzqJ14UZMMeybgsDNWVrOH0ivkYciGtaWCd6AvK2lVJR59kRyNEC1YySITfcn7VZsKrwEA=="
}Authorizations
An API key minted in the console (ctd_…). Authenticates; never authorizes funds. A key
carries scopes (read, wallets.write, transactions.write, events.write,
webhooks.write, policy.write) and may be limited to vaults, to IP addresses, and in
lifetime — see Authentication.
Response
The document in force.
Rises with every document published; your engine keeps the highest it has seen.
The policy key that signed it.
The YAML document, exactly the bytes signed.
The Ed25519 signature over document, in standard base64.