> ## Documentation Index
> Fetch the complete documentation index at: https://novita.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Get API Key Model Access Policy

Retrieve the current model access policy of a single API key. If the key has never been configured, the default policy (`mode=all_enabled`) is returned.

<Info>
  `allowedModels` / `excludedModels` may be returned as `null` or an empty array; callers should treat both as an empty array.
</Info>

## Permissions

| Role          | Access                                                                                               |
| :------------ | :--------------------------------------------------------------------------------------------------- |
| Owner / Admin | Can query the full policy of any API key in the team.                                                |
| Developer     | Can query only keys they own, and the response omits the `allowedModels` / `excludedModels` details. |

The target API key must belong to the caller's team.

## Request Headers

<ParamField header="Authorization" type="string" required={true}>
  Bearer authentication format, for example: Bearer \{\{API Key}}.
</ParamField>

## Path Parameters

<ParamField path="stringId" type="string" required={true}>
  The stringId of the target API key.
</ParamField>

## Response Parameters

<ResponseField name="stringId" type="string" required={true}>
  The stringId of the API key.
</ResponseField>

<ResponseField name="policy" type="object" required={true}>
  The model access policy object.

  <Expandable title="properties" defaultOpen={true}>
    <ResponseField name="schemaVersion" type="int32" required={true}>
      Policy schema version. Currently `1`.
    </ResponseField>

    <ResponseField name="productScope" type="string" required={true}>
      Product scope the policy applies to. Currently only `model_api`.
    </ResponseField>

    <ResponseField name="mode" type="string" required={true}>
      Access mode. Possible values: `all_enabled` (can access all enabled models), `selected` (can access only the specified models).
    </ResponseField>

    <ResponseField name="allowedModels" type="object[]" required={false}>
      Accessible models. Meaningful only when `mode=selected`; empty when `mode=all_enabled`. Not returned in detail for Developer queries.

      <Expandable title="properties">
        <ResponseField name="type" type="string" required={true}>
          Model type. Possible values: `llm`, `multimodal`.
        </ResponseField>

        <ResponseField name="id" type="string" required={true}>
          Model identifier, for example `deepseek/deepseek-v3`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="excludedModels" type="object[]" required={false}>
      Excluded models. Meaningful only when `mode=all_enabled`; empty when `mode=selected`. Same structure as `allowedModels`. Not returned in detail for Developer queries.
    </ResponseField>

    <ResponseField name="source" type="object" required={false}>
      Policy source, returned by the server and ignored on write.

      <Expandable title="properties">
        <ResponseField name="type" type="string" required={true}>
          Source type. Possible values: `default` (never configured, default policy returned), `private_policy` (policy embedded on this key).
        </ResponseField>

        <ResponseField name="policyId" type="string" required={false}>
          Associated policy ID, returned only when applicable.
        </ResponseField>
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="policyStatus" type="string" required={true}>
  Policy status. `active` means the policy is effective; `no_available_models` means no accessible model remains (for example, all selected models are offline).
</ResponseField>

<ResponseField name="allowedModelCount" type="int32" required={true}>
  Number of accessible models.
</ResponseField>

<ResponseField name="excludedModelCount" type="int32" required={true}>
  Number of excluded models.
</ResponseField>

<ResponseField name="updatedAt" type="int64" required={true}>
  Last update time, as a Unix timestamp in seconds. `0` for the default policy.
</ResponseField>

<ResponseField name="updatedBy" type="string" required={true}>
  Identifier of the user who last updated the policy. Empty string for the default policy.
</ResponseField>

<RequestExample>
  ```bash theme={"system"}
  curl --request GET \
    --url https://api.novita.ai/openapi/v2/user/key/<stringId>/model-access-policy \
    --header 'Authorization: Bearer <API_KEY>'
  ```
</RequestExample>

<ResponseExample>
  ```json 200 (selected) theme={"system"}
  {
    "stringId": "key_xxx",
    "policy": {
      "schemaVersion": 1,
      "productScope": "model_api",
      "mode": "selected",
      "allowedModels": [
        {
          "type": "llm",
          "id": "deepseek/deepseek-v3"
        }
      ],
      "excludedModels": [],
      "source": {
        "type": "private_policy"
      }
    },
    "policyStatus": "active",
    "allowedModelCount": 1,
    "excludedModelCount": 0,
    "updatedAt": 1783764000,
    "updatedBy": "user_uuid_xxx"
  }
  ```

  ```json 200 (default) theme={"system"}
  {
    "stringId": "key_xxx",
    "policy": {
      "schemaVersion": 1,
      "productScope": "model_api",
      "mode": "all_enabled",
      "allowedModels": [],
      "excludedModels": [],
      "source": {
        "type": "default"
      }
    },
    "policyStatus": "active",
    "allowedModelCount": 0,
    "excludedModelCount": 0,
    "updatedAt": 0,
    "updatedBy": ""
  }
  ```
</ResponseExample>