> ## Documentation Index > Fetch the complete documentation index at: https://developers.portao3.com.br/llms.txt > Use this file to discover all available pages before exploring further. # List an organization's business policies > Lists the organization's business policies, in evaluation order. Business policies decide what happens to the organization's payments and reviewed transactions: each one has `conditions` and the `actions` taken when they match — approve, deny, or open an approval request. Within a `context`, active policies are tried by ascending `order` and the first match decides. Archived policies are left out unless you ask for them with `status=ARCHIVED`. Filter by `context`, `status`, `autoAction` and `moveBalance`, search names and descriptions with `query`, and page with `limit` + `next`. A blank parameter counts as not sent, and an unknown one is ignored. Each approver in `actions.approvals` carries the user's or group's current `name`; it is left out when the approver can no longer be found. Any member of the organization can list its policies. ## OpenAPI ````yaml /api-reference/ruleengine.openapi.json get /realms/{realmId}/organizations/{organizationId}/business-policies openapi: 3.0.3 info: title: Ruleengine version: 1.0.0 description: >- Portão 3 ruleengine API. Every endpoint requires a bearer token in the Authorization header (Authorization: Bearer ) unless its page states otherwise; see the Authentication guide. That requirement is not repeated per endpoint. Generated by tools/openapi from code (routes + security) and the hand-written spec (request/response bodies). Confidence tiers: generated:typed=26 copied:manual=0 unknown=0. servers: - url: https://api.ruleengine.v2.portao3.com.br/ description: production - url: https://api.ruleengine.dev.3pers.com.br/ description: development security: [] tags: - name: Business Policies - name: Policy Requests paths: /realms/{realmId}/organizations/{organizationId}/business-policies: get: tags: - Business Policies summary: List an organization's business policies description: Lists the organization's business policies, in evaluation order. operationId: getRealmsByRealmIdOrganizationsByOrganizationIdBusinessPolicies parameters: - name: realmId in: path required: true description: |- ID of your realm. Format: `UUID` schema: type: string format: uuid example: f495ff0c-ab54-4f99-8e92-ca8682e4de9b - name: organizationId in: path required: true description: |- ID of the organization whose policies you want to list. Format: `UUID` schema: type: string format: uuid example: c4bd3f21-dfbd-44e8-8055-68ba15bed410 - name: context in: query required: false description: Only policies of this context. schema: type: string enum: - PAYMENT - SPEND_REVIEW - TRAVEL example: PAYMENT - name: status in: query required: false description: >- Only policies in this status. Omitted, the list holds `ACTIVE` and `DISABLED` policies; send `ARCHIVED` to list the archived ones. schema: type: string enum: - ACTIVE - DISABLED - ARCHIVED example: ACTIVE - name: query in: query required: false description: >- Only policies whose name or description contains this text (case-insensitive). schema: type: string minLength: 1 maxLength: 120 example: financeiro - name: autoAction in: query required: false description: >- Only policies with this `actions.autoAction`. `NONE` lists the policies that open an approval request. schema: type: string enum: - APPROVE - DENY - NONE example: NONE - name: moveBalance in: query required: false description: >- `true`: only policies that fund the payment from another wallet (`actions.moveBalance.addBalance`). `false`: only those that don't, including policies without `moveBalance`. schema: type: string enum: - 'true' - 'false' example: 'true' - name: sort in: query required: false description: >- Field to sort by. Defaults to `order`, the evaluation order, so the list reads in the order policies are tried. schema: type: string enum: - order - name - createdAt example: order - name: direction in: query required: false description: Sort direction. Defaults to `asc`. schema: type: string enum: - asc - desc example: asc - name: next in: query required: false description: >- Cursor returned as `next` by the previous page. Omit for the first page. schema: type: string example: NjcyMGYzYTFjOWU3N2IwMDEyYTRkNmY5 - name: limit in: query required: false description: Page size. Defaults to 20. schema: type: integer minimum: 1 maximum: 100 example: 20 responses: '200': description: Successful response content: application/json: schema: type: object properties: next: type: string nullable: true description: >- Cursor for the next page — send it as `next`. `null` on the last page. example: NjcyMGYzYTFjOWU3N2IwMDEyYTRkNmY5 items: type: array items: type: object properties: id: type: string description: ID of the business policy. example: 3f1c9a52-7d4e-4b8a-9c21-5e6f0a8b2d47 format: uuid realmId: type: string description: ID of the realm the policy belongs to. example: f495ff0c-ab54-4f99-8e92-ca8682e4de9b format: uuid organizationId: type: string description: ID of the organization the policy belongs to. example: c4bd3f21-dfbd-44e8-8055-68ba15bed410 format: uuid context: type: string enum: - PAYMENT - SPEND_REVIEW - TRAVEL description: >- What the policy governs. `PAYMENT`: a Pix payment, a boleto payment or a wallet transfer request, before it is paid. `SPEND_REVIEW`: the review of a transaction that already happened. `TRAVEL`: no travel flow evaluates policies yet. example: PAYMENT name: type: string description: Name of the policy, shown to approvers. example: Payments over R$ 5,000 description: type: string description: >- What the policy does, in plain words. Absent when none was written. example: >- Pagamentos acima de R$ 5.000,00 precisam da aprovação do time financeiro. order: type: number description: >- Evaluation order: active policies of the same `context` are tried from the lowest `order` up — the oldest first on a tie — and the first match decides. example: 10 status: type: string enum: - ACTIVE - DISABLED - ARCHIVED description: >- `ACTIVE`: evaluated. `DISABLED`: kept, never evaluated. `ARCHIVED`: archived for good — never evaluated, can no longer be changed. example: ACTIVE conditions: type: object properties: logic: type: string enum: - AND - OR description: >- How the results of `groups` combine: `AND` — every group must match; `OR` — one is enough. example: AND groups: type: array items: type: object properties: logic: type: string enum: - AND - OR description: >- How the group's `items` combine: `AND` — every item must match; `OR` — one is enough. example: AND dependsOn: type: array items: type: string description: >- Data loaded before the group is evaluated, for items that read it through `dynamicFieldValue`. Absent on most groups. items: type: array items: type: object properties: operator: type: string description: >- How `field` is compared with `value` — see the condition catalog for the operators each field accepts. example: GREATER_THAN field: type: string description: >- Dot path of the value tested, from the condition catalog of the policy's `context` (`TRAVEL` has none). example: amount maskType: type: string description: >- `CPF_CNPJ` or `PHONE`: both sides of the comparison are masked before it runs (an unformatted CPF/CNPJ, or a phone number's middle digits). Absent when nothing is masked. dynamicFieldValue: type: string description: >- Dot path of a value loaded at evaluation time, compared instead of `value`. Absent on most conditions. value: description: >- What `field` is compared with, typed as the catalog says — an amount in centavos, a `YYYY-MM-DD` date, an array for `INCLUDES`, criteria text for `LLM_EVALUATE`. Absent for the operators that take no value. example: 500000 required: - operator - field description: One condition. description: The group's conditions. required: - logic - items description: A group of conditions. description: >- The condition groups. Empty when the policy matches everything — an organization-wide default. required: - logic - groups description: When the policy matches. actions: type: object properties: hierarchy: type: boolean description: >- `true`: the `approvals` decide one at a time, in the order listed. `false`: all of them are asked at once. example: false autoAction: type: string enum: - APPROVE - DENY - NONE description: >- What happens when the policy matches. `APPROVE`: allowed right away. `DENY`: refused right away. `NONE`: an approval request is opened and `approvals` decide it. example: NONE moveBalance: type: object properties: addBalance: type: boolean description: >- `true`: when the policy approves — right away or through its approvers — the amount is first moved from the funding wallet (`fromAccountId` + `fromWalletId`) into the wallet the payment comes from (on a `SPEND_REVIEW` policy, the wallet of the reviewed transaction). Nothing moves for an incoming wallet transfer request, which credits the wallet itself, nor when the funding wallet is that wallet and the money would land in the same balance. example: true fromAccountId: type: string description: >- ID of the account that holds the funding wallet. Present when `addBalance` is `true`. example: 66f2a1c7b4d3e80012c9a0b4 fromWalletId: type: string description: >- ID of the funding wallet. Present when `addBalance` is `true`. example: 6710b8e4c9e77b0012a4d6f3 required: - addBalance description: >- Funding from another wallet of the organization once the payment is approved — money moves only when `addBalance` is `true`. Absent when not configured. approvals: type: array items: type: object properties: type: type: string enum: - USER - GROUP description: >- `USER`: one member of the organization. `GROUP`: a user group of the organization — the first member who decides, decides for the group. example: GROUP id: type: string description: ID of the user or of the group. example: 8b0e4c2a-1f6d-4e3b-a9c7-2d5f8e1b6c30 name: type: string description: >- Current name of the user or group. Absent when the approver can no longer be found. Read-only: remove it before sending the policy back on an update. example: Financeiro required: - id - type description: >- One approver of the policy, with the user's or group's current name. description: >- Who approves when `autoAction` is `NONE` — every entry must approve, and one refusal denies the request. Absent or empty for `APPROVE` and `DENY`. required: - autoAction - hierarchy description: What the policy does when it matches. createdAt: type: string description: When the policy was created. example: '2026-10-14T13:45:12.000Z' format: date-time updatedAt: type: string description: When the policy was last changed. example: '2026-11-03T18:02:40.000Z' format: date-time required: - actions - conditions - context - createdAt - id - name - order - organizationId - realmId - status - updatedAt description: A business policy of the organization. description: The policies of this page, in the requested order. required: - next - items description: A page of the organization's business policies. '403': description: >- `BUSINESS_POLICY_FORBIDDEN` — You are not a member of the organization. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - BUSINESS_POLICY_FORBIDDEN description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - RULE_ENGINE description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: BUSINESS_POLICY_FORBIDDEN origin: RULE_ENGINE message: You do not have permission to manage business policies '422': description: >- `BAD_REQUEST` — A path or query parameter is invalid; `fields` lists each one. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - BAD_REQUEST description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - RULE_ENGINE description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. fields: type: array description: >- One entry per invalid request field (validation errors only). items: type: object properties: field: type: string description: >- Path of the invalid field, e.g. `label` or `values[0].value`. example: label message: type: string description: Why the field was rejected. example: label is required code: type: string description: >- `_` — e.g. `LABEL_REQUIRED`, `TYPE_ONE_OF`, `VALUES_VALUE_TYPE_ERROR`. example: LABEL_REQUIRED values: type: array items: type: string description: >- The accepted values, when the field is an enumeration. required: - field - message - code required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: BAD_REQUEST origin: RULE_ENGINE message: >- Bad Request: Your request is invalid or incomplete. Please make sure you are requesting with the right fields. fields: - field: context message: >- Invalid option: expected one of "PAYMENT"|"SPEND_REVIEW"|"TRAVEL" code: CONTEXT_ONE_OF ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.