# Get security policy spec Gets editable name, description and complete spec, including Basic Auth passwords and authentication header values. Requires readSpec permission. Required permission: Account > Networking > SecurityPolicies > Read Spec **Path parameters:** {object} - `securityPolicyId`: (string) (required) ID of the security policy **Response body:** {object} - `data`: {object} - `name`: (string) (required) (pattern: ^[a-zA-Z]((-|\s)?[a-zA-Z0-9]+((-|\s)[a-zA-Z0-9]+)*)?$) (min length: 3) (max length: 39) - `description`: (string) (pattern: ^[a-zA-Z0-9.,?\s\\/'"()[\];`%^&*\-_:!]+$) (max length: 200) - `spec`: (multiple options) {object} - `enabled`: (boolean) (required) - `priority`: (integer) (required) - `paths`: [array of] {object} - `path`: (string) (required) (min length: 1) - `matchMode`: (string) (required) (enum: exact, pathPrefix) - `accessMode`: (string) (required) (enum: protected, unprotected) - `securityPolicies`: {object} - `orPolicies`: {object} - `ip`: [array of] {object} - `addresses`: [array of] (string) (pattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))?$) - `action`: (string) (required) (enum: ALLOW, DENY) - `headers`: [array of] (multiple options) {object} - `regexMode`: (boolean) - `name`: (string) (required) (pattern: ^[a-zA-Z0-9_\-%$+]+$) - `value`: (string) (required) | {object} - `regexMode`: (boolean) - `name`: (string) (required) - `value`: (string) (required) - `credentials`: [array of] {object} - `username`: (string) (required) (pattern: ^[a-zA-Z](-?[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*)?$) (min length: 3) (max length: 39) - `password`: (string) (required) - `type`: (string) (required) (enum: basic-auth) - `sso`: {object} - `organizationId`: (string) (required) - `directoryGroupIds`: [array of] (string) - `allowAnyOrgUsers`: (boolean) - `validateInternalTraffic`: (boolean) - `setCookieOnRootDomain`: (boolean) - `noindexRedirect`: (boolean) - `allowInternalTrafficViaPublicDns`: (boolean) - `requiredPolicies`: {object} - `ip`: [array of] {object} - `addresses`: [array of] (string) (pattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))?$) - `action`: (string) (required) (enum: ALLOW, DENY) - `headers`: [array of] (multiple options) {object} - `regexMode`: (boolean) - `name`: (string) (required) (pattern: ^[a-zA-Z0-9_\-%$+]+$) - `value`: (string) (required) | {object} - `regexMode`: (boolean) - `name`: (string) (required) - `value`: (string) (required) - `credentials`: [array of] {object} - `username`: (string) (required) (pattern: ^[a-zA-Z](-?[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*)?$) (min length: 3) (max length: 39) - `password`: (string) (required) - `type`: (string) (required) (enum: basic-auth) - `sso`: {object} - `organizationId`: (string) (required) - `directoryGroupIds`: [array of] (string) - `allowAnyOrgUsers`: (boolean) - `validateInternalTraffic`: (boolean) - `setCookieOnRootDomain`: (boolean) - `noindexRedirect`: (boolean) - `allowInternalTrafficViaPublicDns`: (boolean) - `targets`: {object} - `projects`: {object} - `mode`: (string) (required) (enum: all, selected) - `ids`: [array of] (string) - `workloads`: {object} - `mode`: (string) (required) (enum: all, selected) - `items`: [array of] {object} - `projectId`: (string) (required) - `serviceId`: (string) (required) - `tags`: {object} - `enabled`: (boolean) (required) - `items`: [array of] (string) - `matchCondition`: (string) (required) (enum: or, and) - `exclusions`: {object} - `projects`: [array of] (string) - `workloads`: [array of] {object} - `projectId`: (string) (required) - `serviceId`: (string) (required) - `reason`: (string) (max length: 500) | {object} - `enabled`: (boolean) (required) - `priority`: (integer) (required) - `paths`: [array of] {object} - `path`: (string) (required) (min length: 1) - `matchMode`: (string) (required) (enum: exact, pathPrefix) - `accessMode`: (string) (required) (enum: protected, unprotected) - `securityPolicies`: {object} - `orPolicies`: {object} - `ip`: [array of] {object} - `addresses`: [array of] (string) (pattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))?$) - `action`: (string) (required) (enum: ALLOW, DENY) - `headers`: [array of] (multiple options) {object} - `regexMode`: (boolean) - `name`: (string) (required) (pattern: ^[a-zA-Z0-9_\-%$+]+$) - `value`: (string) (required) | {object} - `regexMode`: (boolean) - `name`: (string) (required) - `value`: (string) (required) - `credentials`: [array of] {object} - `username`: (string) (required) (pattern: ^[a-zA-Z](-?[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*)?$) (min length: 3) (max length: 39) - `password`: (string) (required) - `type`: (string) (required) (enum: basic-auth) - `sso`: {object} - `organizationId`: (string) (required) - `directoryGroupIds`: [array of] (string) - `allowAnyOrgUsers`: (boolean) - `validateInternalTraffic`: (boolean) - `setCookieOnRootDomain`: (boolean) - `noindexRedirect`: (boolean) - `allowInternalTrafficViaPublicDns`: (boolean) - `requiredPolicies`: {object} - `ip`: [array of] {object} - `addresses`: [array of] (string) (pattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))?$) - `action`: (string) (required) (enum: ALLOW, DENY) - `headers`: [array of] (multiple options) {object} - `regexMode`: (boolean) - `name`: (string) (required) (pattern: ^[a-zA-Z0-9_\-%$+]+$) - `value`: (string) (required) | {object} - `regexMode`: (boolean) - `name`: (string) (required) - `value`: (string) (required) - `credentials`: [array of] {object} - `username`: (string) (required) (pattern: ^[a-zA-Z](-?[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*)?$) (min length: 3) (max length: 39) - `password`: (string) (required) - `type`: (string) (required) (enum: basic-auth) - `sso`: {object} - `organizationId`: (string) (required) - `directoryGroupIds`: [array of] (string) - `allowAnyOrgUsers`: (boolean) - `validateInternalTraffic`: (boolean) - `setCookieOnRootDomain`: (boolean) - `noindexRedirect`: (boolean) - `allowInternalTrafficViaPublicDns`: (boolean) - `targets`: {object} - `teams`: {object} - `mode`: (string) (required) (enum: allManaged, selected) - `ids`: [array of] (string) - `projects`: {object} - `mode`: (string) (required) (enum: all, selected) - `items`: [array of] {object} - `teamId`: (string) (required) - `projectId`: (string) (required) - `tags`: {object} - `enabled`: (boolean) (required) - `items`: [array of] (string) - `matchCondition`: (string) (required) (enum: or, and) - `exclusions`: {object} - `teams`: [array of] (string) - `projects`: [array of] {object} - `teamId`: (string) (required) - `projectId`: (string) (required) - `inheritanceMode`: (string) (required) (enum: enforced, default) ## API reference GET /v1/security-policies/{securityPolicyId}/spec GET /v1/teams/{teamId}/security-policies/{securityPolicyId}/spec ### Example Response 200 OK: Editable configuration including authentication values. ```json { "data": { "spec": { "securityPolicies": { "orPolicies": { "headers": [ { "regexMode": false, "name": "headerName", "value": "headerValue" } ] }, "requiredPolicies": { "headers": [ { "regexMode": false, "name": "headerName", "value": "headerValue" } ] } } } } } ``` ## CLI reference $ northflank get security-policy spec Options: - `--securityPolicyId `: ID of the security policy - `--verbose `: Verbose output - `--quiet `: No console output - `-o --output `: Output formatting ### Example Response Editable configuration including authentication values. ```json { "spec": { "securityPolicies": { "orPolicies": { "headers": [ { "regexMode": false, "name": "headerName", "value": "headerValue" } ] }, "requiredPolicies": { "headers": [ { "regexMode": false, "name": "headerName", "value": "headerValue" } ] } } } } ``` ## JavaScript client reference ### Example request With an organization token, add `parameters.teamId`. [Organization API access](/docs/v1/api/use-the-api#organization-api-access). ```javascript await apiClient.get.securityPolicy.spec({ parameters: { "securityPolicyId": "internal-access" } }); ``` ### Example Response Editable configuration including authentication values. ```json { "data": { "spec": { "securityPolicies": { "orPolicies": { "headers": [ { "regexMode": false, "name": "headerName", "value": "headerValue" } ] }, "requiredPolicies": { "headers": [ { "regexMode": false, "name": "headerName", "value": "headerValue" } ] } } } }, "rawResponse": "...", "request": "...", "error": "..." } ``` ## Python client reference ### Example request [Set up the Python client](/docs/v1/api/use-the-python-client#usage). With an organization token, add `team_id`. [Organization API access](/docs/v1/api/use-the-api#organization-api-access). Python SDK 2.1.0 has no generated method for this endpoint. Use the API example for this request. Previous: [Delete security policy](/docs/v1/api/team/security-policies/delete-security-policy) Next: [List tags](/docs/v1/api/team/tags/list-tags)