> ## Documentation Index > Fetch the complete documentation index at: https://docs.nx1cloud.com/llms.txt > Use this file to discover all available pages before exploring further. # List Ranger policies overlapping a catalog / schema / table, with match type and effect summary ## OpenAPI ````yaml get /api/govern/data-access/policies/by-resource openapi: 3.1.0 info: title: Nx1 AI API description: | AI API for Nx1 Data Platform Management and Automated Data Tasks. Authentication is required via PSK in Authorization header. Default PSK is | [ask a friend] | version: 0.10.2 servers: [] security: [] paths: /api/govern/data-access/policies/by-resource: get: tags: - Policy management summary: >- List Ranger policies overlapping a catalog / schema / table, with match type and effect summary operationId: >- list_policies_by_resource_api_govern_data_access_policies_by_resource_get parameters: - name: catalog in: query required: true schema: type: string minLength: 1 description: Catalog / top-level resource container. title: Catalog description: Catalog / top-level resource container. - name: schema in: query required: false schema: type: string description: Schema. Omit to scope the whole catalog. default: '' title: Schema description: Schema. Omit to scope the whole catalog. - name: table in: query required: false schema: type: string description: Table. Omit to scope the whole schema. default: '' title: Table description: Table. Omit to scope the whole schema. responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/PolicyByResourceResponse' '422': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Unprocessable Content '502': description: Bad Gateway content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '503': description: Service Unavailable content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - OAuth2AuthorizationCodeBearer: [] - APIKeyHeader: [] components: schemas: PolicyByResourceResponse: properties: resource_fqn: type: string title: Resource Fqn description: >- The requested scope as 'catalog[.schema[.table]]' (blank segments dropped). policies: items: $ref: '#/components/schemas/PolicyByResourceItem' type: array title: Policies type: object required: - resource_fqn title: PolicyByResourceResponse description: >- Policies overlapping a catalog / schema / table scope, annotated for review. ErrorResponse: properties: error: type: string title: Error description: A brief description of the error that occurred. code: type: integer title: Code description: The HTTP status code associated with the error. default: 500 type: object required: - error title: ErrorResponse PolicyByResourceItem: properties: policy_id: type: integer title: Policy Id description: Ranger policy ID. policy_name: type: string title: Policy Name description: Ranger policy name. service: type: string title: Service description: Ranger service name. resources: additionalProperties: true type: object title: Resources description: Policy resource definitions. policyType: type: integer title: Policytype description: 0=ACCESS, 1=MASKING, 2=ROWFILTER. default: 0 isEnabled: type: boolean title: Isenabled default: true isAuditEnabled: type: boolean title: Isauditenabled default: true policyItems: items: additionalProperties: true type: object type: array title: Policyitems description: Allow access items. denyPolicyItems: items: additionalProperties: true type: object type: array title: Denypolicyitems description: Deny access items. allowExceptions: items: additionalProperties: true type: object type: array title: Allowexceptions description: Allow exception items. denyExceptions: items: additionalProperties: true type: object type: array title: Denyexceptions description: Deny exception items. rowFilterPolicyItems: items: additionalProperties: true type: object type: array title: Rowfilterpolicyitems description: Row filter items. dataMaskPolicyItems: items: additionalProperties: true type: object type: array title: Datamaskpolicyitems description: Masking items. policyPriority: type: integer title: Policypriority description: 0=NORMAL, 1=OVERRIDE. default: 0 isDenyAllElse: type: boolean title: Isdenyallelse default: false policyLabels: items: type: string type: array title: Policylabels description: Policy labels. description: type: string title: Description default: '' match_type: type: string enum: - exact - broader title: Match Type description: >- How the policy relates to the requested resource: 'exact' (values equal on all shared keys) or 'broader' (covers via wildcard/superset). effect_summary: type: string title: Effect Summary description: One-line human-readable summary of the policy's effect. type: object required: - policy_id - policy_name - service - resources - match_type - effect_summary title: PolicyByResourceItem description: |- A policy that overlaps a resource selector, for the by-resource listing. Extends the standard policy detail with two derived, read-only fields: - ``match_type`` — how the policy relates to the requested scope. ``exact`` means the policy's non-wildcard resource values equal the selector on every shared key; ``broader`` means it covers the scope via a wildcard / superset (e.g. ``table='*'``). The vocabulary mirrors ``RangerClient.list_policies_for_resource`` (which the crew also uses), not the design doc's ``wildcard`` — kept identical so the endpoint and the crew agree. Only meaningful at full ``catalog.schema.table`` depth: a shallower selector leaves the deeper keys out of the comparison, so every policy inside the scope compares as ``exact`` on what was asked. - ``effect_summary`` — a one-line human-readable description of what the policy does (e.g. "MASK_SHOW_LAST_4 on email for everyone except nx1_sales_admin"). Derived server-side so every consumer (Data Access table, Table 360) renders the same text. securitySchemes: OAuth2AuthorizationCodeBearer: type: oauth2 flows: authorizationCode: scopes: {} authorizationUrl: >- https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/auth tokenUrl: >- https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/token APIKeyHeader: type: apiKey in: header name: Authorization-PSK ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.