Get a Legal space’s policy gate config

Embed

<a href="https://forumulate.com/reference/forumulate-api-policygateadmin-getspace"><img src="https://forumulate.com/reference/_api/public/orgs/046a9bc0-d530-43ae-9bae-af7945008cda/spaces/8042f004-e3d9-445f-b7a4-b6c1f86836e6/pages/6fa13938-c161-45e5-8320-4570ea5406d7/social-card.svg?v=3e7ae33eec8b" alt="Get a Legal space’s policy gate config" width="600" height="315"></a>

GEThttps://forumulate.com/api/orgs/{orgId}/spaces/{spaceId}/policy-gate/config

The space override as stored, the org default it inherits from, and the resolved result (space → org → default, field by field). Also the published policies with each one’s resolved behaviour, and the hosted page address.

Requires token scope: read — see "Token scopes" under Authentication.

Parameters

orgIdstringpathrequired

The organization: its uuid, or its slug. One you are not a member of is a 404.

spaceIdstringpathrequired

The space: its uuid, or its slug within the organization. An id further down the path that belongs to a DIFFERENT space is a 404, not a cross-space read.

forumulate-versionstringheader

API version negotiation. Send forumulate-version: 2027-03-01 on every request from a new integration; it is optional only so that integrations written before versioning keep working. Each version includes everything before it:

Code samples

cURL

curl -X GET "https://forumulate.com/api/orgs/{orgId}/spaces/{spaceId}/policy-gate/config" \
  -H "Authorization: Bearer $FORUMULATE_API_KEY" \
  -H "forumulate-version: <value>"

TypeScript

Python

PHP

Ruby

Java

Responses

200 Success.

Example

{
  "org": {
    "defaults": {
      "decline": "allow",
      "dismissible": true,
      "events": [
        "sign_in"
      ],
      "graceDays": 0,
      "presentation": "checkbox",
      "reaccept": "grace_days",
      "required": true,
      "requireScroll": true,
      "showSummary": true
    },
    "embed": {
      "allowedOrigins": [
        "string"
      ],
      "requireTicket": true,
      "tokenTtlSeconds": 0
    },
    "enabled": true,
    "page": {
      "returnUrls": [
        "string"
      ]
    },
    "policies": {},
    "reader": {
      "prompt": "off"
    },
    "ui": {
      "grouping": "combined",
      "inheritTheme": true,
      "labels": {},
      "layout": "center",
      "locale": "string",
      "mobileFullscreen": true,
      "reader": "modal",
      "vars": {
        "accent": "string",
        "accent-contrast": "string",
        "backdrop": "string",
        "background": "string",
        "border": "string",
        "focus": "string",
        "font": "string",
        "max-width": "string",
        "muted": "string",
        "radius": "string",
        "shadow": "string",
        "surface": "string",
        "text": "string"
      }
    }
  },
  "pageUrl": "string",
  "policies": [
    {
      "key": "string",
      "title": "string"
    }
  ],
  "resolved": {
    "embed": {
      "allowedOrigins": [
        "string"
      ],
      "requireTicket": true,
      "tokenTtlSeconds": 0
    },
    "enabled": true,
    "enabledSource": "call",
    "page": {
      "returnUrls": [
        "string"
      ]
    },
    "reader": {
      "prompt": "off"
    },
    "ui": {
      "grouping": "combined",
      "inheritTheme": true,
      "labels": {},
      "layout": "center",
      "locale": "string",
      "mobileFullscreen": true,
      "reader": "modal",
      "vars": {
        "accent": {},
        "accent-contrast": {},
        "backdrop": {},
        "background": {},
        "border": {},
        "focus": {},
        "font": {},
        "max-width": {},
        "muted": {},
        "radius": {},
        "shadow": {},
        "surface": {},
        "text": {}
      }
    }
  },
  "stored": {
    "defaults": {
      "decline": "allow",
      "dismissible": true,
      "events": [
        "sign_in"
      ],
      "graceDays": 0,
      "presentation": "checkbox",
      "reaccept": "grace_days",
      "required": true,
      "requireScroll": true,
      "showSummary": true
    },
    "embed": {
      "allowedOrigins": [
        "string"
      ],
      "requireTicket": true,
      "tokenTtlSeconds": 0
    },
    "enabled": true,
    "page": {
      "returnUrls": [
        "string"
      ]
    },
    "policies": {},
    "reader": {
      "prompt": "off"
    },
    "ui": {
      "grouping": "combined",
      "inheritTheme": true,
      "labels": {},
      "layout": "center",
      "locale": "string",
      "mobileFullscreen": true,
      "reader": "modal",
      "vars": {
        "accent": "string",
        "accent-contrast": "string",
        "backdrop": "string",
        "background": "string",
        "border": "string",
        "focus": "string",
        "font": "string",
        "max-width": "string",
        "muted": "string",
        "radius": "string",
        "shadow": "string",
        "surface": "string",
        "text": "string"
      }
    }
  }
}

Schema

orgobjectrequired

Show child parameters

defaultsobject

Show child parameters

declinestring

allow | block

dismissibleboolean

eventsstring[]

graceDaysnumber

presentationstring

reacceptstring

grace_days | never | next_sign_in

requiredboolean

requireScrollboolean

showSummaryboolean

embedobject

Show child parameters

allowedOriginsstring[]

requireTicketboolean

tokenTtlSecondsnumber

enabledboolean

pageobject

Show child parameters

returnUrlsstring[]

policiesobject

readerobject

Show child parameters

promptstring

off | widget

uiobject

Show child parameters

groupingstring

combined | sequence

inheritThemeboolean

labelsobject

layoutstring

center | fullscreen | sheet

localestring

mobileFullscreenboolean

readerstring

modal | new_tab

varsobject

pageUrlstringrequired

policiesobject[]required

Show child parameters

keystringrequired

titlestringrequired

resolvedobjectrequired

Show child parameters

embedobjectrequired

Show child parameters

allowedOriginsstring[]required

requireTicketbooleanrequired

tokenTtlSecondsnumberrequired

enabledbooleanrequired

enabledSourcestringrequired

call | default | org | policy | space

pageobjectrequired

Show child parameters

returnUrlsstring[]required

readerobjectrequired

Show child parameters

promptstringrequired

off | widget

uiobjectrequired

Show child parameters

groupingstringrequired

combined | sequence

inheritThemebooleanrequired

labelsobjectrequired

layoutstringrequired

center | fullscreen | sheet

localestringrequired

mobileFullscreenbooleanrequired

readerstringrequired

modal | new_tab

varsobjectrequired

storedobjectrequired

Show child parameters

defaultsobject

Show child parameters

declinestring

allow | block

dismissibleboolean

eventsstring[]

graceDaysnumber

presentationstring

reacceptstring

grace_days | never | next_sign_in

requiredboolean

requireScrollboolean

showSummaryboolean

embedobject

Show child parameters

allowedOriginsstring[]

requireTicketboolean

tokenTtlSecondsnumber

enabledboolean

pageobject

Show child parameters

returnUrlsstring[]

policiesobject

readerobject

Show child parameters

promptstring

off | widget

uiobject

Show child parameters

groupingstring

combined | sequence

inheritThemeboolean

labelsobject

layoutstring

center | fullscreen | sheet

localestring

mobileFullscreenboolean

readerstring

modal | new_tab

varsobject

400 The request could not be understood — a malformed header, path or query value (request.malformed). A value that was understood but is not acceptable is a 422 validation.failed.

Example

{
  "error": {
    "code": "string",
    "message": "string",
    "details": {},
    "docs": "string",
    "reason": "string",
    "slugs": [
      "string"
    ],
    "conflict": {
      "etag": "string",
      "ops": [
        {}
      ]
    }
  },
  "requestId": "string"
}

Schema

errorobjectrequired

Show child parameters

codestringrequired

Stable, machine-readable error code, e.g. rbac.forbidden.

messagestringrequired

Human-readable explanation.

detailsobject

Field-level validation problems, keyed by field path (422 only).

docsstring

Where the vocabulary or format this error is about is published — an absolute URL, or an API route such as GET /space-types/{type}/presets. Present on errors over a controlled list, so the answer to "what am I allowed to send?" is in the error itself.

reasonstring

Why a credential was refused, as one stable word, where one status has several causes — e.g. an external_jwt redeem answers iat_too_old, iat_in_future, bad_signature, bad_issuer, bad_audience, expired and more. Branch on this, not on message.

slugsstring[]

The exact slugs that collided, on a slug-conflict 409 — space.slug_taken, page.slug_taken, collection.slug_taken, site.slug_taken or badge.slug_taken.

conflictobject

On a 409 from a content entry field write (PATCH …/entries/{entryId}/fields) whose If-Match was stale.

Show child parameters

etagstringrequired

The entry's current fields etag.

opsarrayrequired

The field operations since your If-Match that touch a path your own operations touch. Empty: none did — retry the batch unchanged under etag. null: the history no longer reaches your tag — re-read the entry first.

requestIdstring

The id of this request — the same value as the x-request-id and x-forumulate-request-id response headers. Quote it in a bug report: it is the only thing that finds your exact request in our logs. It is in the body because that is the part that survives — an SDK that throws the parsed body, a serverless log that keeps the body and drops the headers, a ticket with the JSON pasted in.

401 No credential, or one that is expired or revoked (auth.required). Send a Bearer token or the session cookie.

Same as 400 · GET /orgs/{orgId}/spaces/{spaceId}/policy-gate/config

403 Authenticated, and not allowed — always rbac.forbidden, whether what is missing is the capability, the token scope, or a resource the token is pinned away from. The message names the capability and, for a scope refusal, the scopes that would grant it. A refusal because of the PLAN is a 402 with quota.exceeded, not this.

Same as 400 · GET /orgs/{orgId}/spaces/{spaceId}/policy-gate/config

404 No such thing — one of the ids in the path does not resolve, or resolves to something this caller may not see (*.not_found).

Same as 400 · GET /orgs/{orgId}/spaces/{spaceId}/policy-gate/config

429 Rate limited — see the RateLimit-* headers.

Same as 400 · GET /orgs/{orgId}/spaces/{spaceId}/policy-gate/config

default Error — the stable { error: { code, message } } envelope.

Same as 400 · GET /orgs/{orgId}/spaces/{spaceId}/policy-gate/config

The Forumulate teamUpdated Nov 15, 2026

Was this page helpful?