> For the complete documentation index, see [llms.txt](https://hinkal-team.gitbook.io/hinkal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hinkal-team.gitbook.io/hinkal/hinkal-waas/api-reference/get-user-policy.md).

# Get User Policy

## Get effective policy for a user

> Get policies of a single user

```json
{"openapi":"3.0.3","info":{"title":"Hinkal WaaS API","version":"1.0.0"},"tags":[{"name":"Get User Policy"}],"servers":[{"url":"https://api.hinkal.io","description":"Production"}],"security":[{"XStamp":[]}],"components":{"securitySchemes":{"XStamp":{"type":"apiKey","in":"header","name":"X-Stamp","description":"Base64URL-encoded JSON: `{ \"publicKey\": \"<hex ed25519 pubkey>\", \"signature\": \"<hex ed25519 sig>\" }`.\nThe signature covers `JSON.stringify([binding, Object.entries(params)])`, where `binding`\nis `\"<METHOD> <routePath>\"` (the server's route pattern, e.g. `\"POST /waas/create-wallet\"`)\nand `params` is the request body (POST) or query params (GET). This binds the stamp to\nits own route so it cannot be replayed against a different endpoint. The one parameterized\nroute, `GET /waas/scheduled-transaction/{scheduleId}`, binds to the literal\n`\"GET /waas/scheduled-transaction/:scheduleId\"`, not the concrete ID. See the Signing\nRequests guide for runnable examples.\n"}},"schemas":{"SuccessResponse":{"type":"object","properties":{"status":{"type":"string","enum":["success"]}},"required":["status"]},"UserRole":{"type":"string","enum":["root","admin","user"]},"ErrorResponse":{"type":"object","properties":{"status":{"type":"string","enum":["error"]},"message":{"type":"string"}},"required":["status","message"]}},"responses":{"BadRequest":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"Unauthorized":{"description":"Invalid or missing X-Stamp","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"Forbidden":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"ServerError":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}},"paths":{"/waas/get-user-policy":{"get":{"operationId":"getUserPolicy","summary":"Get effective policy for a user","description":"Get policies of a single user","tags":["Get User Policy"],"parameters":[{"name":"organizationId","in":"query","required":true,"schema":{"type":"string"}},{"name":"userId","in":"query","required":true,"schema":{"type":"string"}},{"name":"nonce","in":"query","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"User policy","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/SuccessResponse"},{"type":"object","properties":{"data":{"type":"object","properties":{"role":{"$ref":"#/components/schemas/UserRole"},"allowedActions":{"type":"array","items":{"type":"string"}}}}}}]}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"500":{"$ref":"#/components/responses/ServerError"}}}}}}
```