---
title: "Access Policies API | Gazebo Docs"
description: "Inspect and update the services and HTTP methods a Gazebo agent is permitted to use."
url: "https://gazebohq.com/docs/api/access-policies"
---

An access policy controls which connected services may release credentials to an agent and which declared HTTP methods permit that release.

Gazebo evaluates this policy before returning a credential. It does not observe or enforce the agent's later request to the service. The service's API key scopes, OAuth scopes, or IAM permissions remain the authority for what the credential can actually do.

These endpoints require an [account API token](/docs/api/authentication).

## Inspect an agent's access

```
GET /api/v1/agents/{agent_id}/access
```

```bash
curl https://app.gazebohq.com/api/v1/agents/AGENT_ID/access \
  -H "Authorization: Bearer YOUR_ACCOUNT_API_TOKEN"
```

The response includes every service currently connected to the account:

```json
[
  {
    "service": "stripe",
    "enabled": true,
    "methods": ["GET"]
  },
  {
    "service": "github",
    "enabled": false,
    "methods": ["GET", "POST", "PUT", "PATCH", "DELETE"]
  }
]
```

## Update service access

```
PUT /api/v1/agents/{agent_id}/access/{service}
```

```bash
curl https://app.gazebohq.com/api/v1/agents/AGENT_ID/access/stripe \
  -X PUT \
  -H "Authorization: Bearer YOUR_ACCOUNT_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"enabled":true,"methods":["GET"]}'
```

| Field | Type | Required | Description |
|---|---|---|---|
| `enabled` | boolean | yes | Whether the agent may retrieve this service's credentials |
| `methods` | array | no | Declared request methods that permit credential release: `GET`, `POST`, `PUT`, `PATCH`, `DELETE`; defaults to all methods |

Changes take effect on the agent's next credential request.

The agent supplies its intended method when requesting a credential. For example, a `GET`-only policy denies a credential request declared as `POST`. Once a permitted request returns the credential, Gazebo cannot guarantee that the agent uses it only for that method. Match this policy with narrowly scoped credentials at the provider.

The response is:

```json
{ "ok": true }
```