> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stableyard.fi/llms.txt
> Use this file to discover all available pages before exploring further.

# List Vault policies

> List the active and historical policy versions of a UPA's Vault.

Returns active and historical policy versions for the account Vault. Page with `limit` (up to 100, default 20) and `cursor`.


## OpenAPI

````yaml openapi.json GET /v2/accounts/{accountId}/vault/policies
openapi: 3.1.0
info:
  title: Stableyard Partner API
  version: 2.0.0-staging
  x-stableyard-api-version: '2026-09-09'
  x-stableyard-supported-api-versions:
    - '2026-09-09'
  summary: Backend API for UPAs, Payments, activity, and optional financial products.
  description: >

    Use this API from a trusted partner backend with an app ID and app secret.


    ## Recommended integration


    1. Call `GET /v2/partners/config` to verify credentials and discover enabled
    capabilities.

    2. Create a UPA only when your product needs a persistent Stableyard
    account.

    3. Create a receive or send Payment with `POST /v2/payments`.

    4. Redirect a payer to the returned `paymentUrl` or pass the Payment
    credentials to an official Stableyard interface SDK.

    5. Process signed webhooks and fetch the Payment by ID for reconciliation.


    Checkout execution and account-bound browser endpoints are intentionally
    documented in the separate Interfaces & SDKs reference. Console endpoints
    are dashboard implementation details and are not part of the partner
    integration contract.
  x-stableyard-documentation-surface: partner
servers:
  - url: https://prod-api.stableyard.fi
    description: Production
  - url: https://staging-api-v2.stableyard.fi
    description: Staging
  - url: http://localhost:3001
    description: Local
security: []
tags:
  - name: Authentication
    x-displayName: API authentication
    description: Verify your app ID and app secret before calling UPA APIs.
  - name: Accounts
    x-displayName: UPA Accounts
    description: Create Universal Payment Accounts and manage account settings.
  - name: Deposit Addresses
    description: Create reusable receive addresses and verify inbound deposits.
  - name: Identity & KYC
    description: >-
      Verify the UPA email and run provider-neutral identity verification.
      Managed vaults and fiat payment rails use this same verified UPA identity.
  - name: Vaults
    description: >-
      Create Safe/Zodiac controlled stablecoin vaults and manage policy updates
      for accounts.
  - name: Payments
    description: >-
      Create escrow-first payments, issue partner-authenticated send
      instructions or executions, power public checkout, and reconcile
      collection through final account settlement.
  - name: Balances & Transactions
    description: >-
      Read Stableyard-posted financial activity. Balances are ledger projections
      of activity Stableyard processed; they are not live balances of externally
      controlled wallets.
paths:
  /v2/accounts/{accountId}/vault/policies:
    get:
      tags:
        - Vaults
      summary: List vault policies
      description: Lists active and historical policy versions for the account vault.
      operationId: listVaultPolicies
      parameters:
        - name: accountId
          in: path
          required: true
          schema:
            type: string
            example: acct_123
          description: Canonical account id returned by the Accounts API.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 20
          description: Maximum Vault records to return.
        - name: cursor
          in: query
          required: false
          schema:
            type: string
          description: Opaque cursor returned as nextCursor by the previous page.
        - name: Stableyard-Version
          in: header
          required: false
          schema:
            type: string
            enum:
              - '2026-09-09'
          description: >-
            Optional contract-version assertion. Omit it to use the app
            environment's pinned version. A different supported version is
            accepted only after that environment is explicitly migrated.
      responses:
        '200':
          description: Vault policies
          headers:
            Stableyard-Version:
              description: >-
                Effective date-based Stableyard API contract version for this
                response.
              schema:
                type: string
                enum:
                  - '2026-09-09'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VaultPolicyListResponse'
              examples:
                example:
                  summary: List vault policies 200 response
                  value:
                    data:
                      - id: vault_policy_123
                        vaultId: vault_123
                        version: 1
                        policySchemaVersion: 1
                        status: draft
                        ownershipMode: external
                        allowedTokens:
                          - symbol: USDC
                            chainId: 42161
                            tokenAddress: '0xaf88d065e77c8cC2239327C5EDb3A432268e5831'
                            decimals: 6
                        spendLimits:
                          spendLimitAtomic: '500000000'
                          currency: USD
                          decimals: 6
                          period: fixed_30_day
                          periodSeconds: 2592000
                          enforcement: zodiac_allowance_plus_inflight_database_reservations
                        yieldRules:
                          provider: none
                          mode: disabled
                        authorization: {}
                        resourceVersion: 1
                        createdAt: '2026-08-28T10:00:00.000Z'
                        updatedAt: '2026-08-28T10:00:00.000Z'
                    nextCursor: cursor_123
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '424':
          $ref: '#/components/responses/FailedDependency'
        '429':
          $ref: '#/components/responses/TooManyRequests'
      security:
        - partnerBasicAuth: []
components:
  schemas:
    VaultPolicyListResponse:
      type: object
      additionalProperties: false
      required:
        - data
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/VaultPolicyResource'
        nextCursor:
          type: string
    VaultPolicyResource:
      type: object
      additionalProperties: false
      required:
        - id
        - vaultId
        - version
        - policySchemaVersion
        - status
        - ownershipMode
        - allowedTokens
        - spendLimits
        - yieldRules
        - resourceVersion
        - createdAt
        - updatedAt
      properties:
        id:
          type: string
          example: vault_policy_123
        vaultId:
          type: string
          example: vault_123
        version:
          type: integer
          minimum: 1
        policySchemaVersion:
          type: integer
          minimum: 1
        status:
          type: string
          enum:
            - draft
            - pending_authorization
            - authorized
            - installing
            - active
            - superseded
            - revoked
            - failed
        ownershipMode:
          type: string
          enum:
            - external
            - stableyard
        allowedTokens:
          type: array
          items:
            type: object
            additionalProperties: false
            required:
              - symbol
              - chainId
              - tokenAddress
              - decimals
            properties:
              symbol:
                type: string
                enum:
                  - USDC
                  - USDT
              chainId:
                type: integer
                example: 42161
              tokenAddress:
                type: string
                example: '0xaf88d065e77c8cC2239327C5EDb3A432268e5831'
              decimals:
                type: integer
                const: 6
        spendLimits:
          type: object
          additionalProperties: false
          required:
            - spendLimitAtomic
            - currency
            - decimals
            - period
            - periodSeconds
            - enforcement
          properties:
            spendLimitAtomic:
              type: string
              pattern: ^[1-9][0-9]*$
              example: '500000000'
            currency:
              type: string
              const: USD
            decimals:
              type: integer
              const: 6
            period:
              type: string
              const: fixed_30_day
            periodSeconds:
              type: integer
              const: 2592000
            enforcement:
              type: string
              const: zodiac_allowance_plus_inflight_database_reservations
        yieldRules:
          type: object
          additionalProperties: false
          required:
            - provider
            - mode
          properties:
            provider:
              type: string
              enum:
                - none
                - aave
                - morpho
            mode:
              type: string
              enum:
                - disabled
                - auto_supply_and_redeem_before_payment
        authorization:
          type: object
          additionalProperties: true
          description: Present on single-policy responses while authorization is pending.
        nextAction:
          oneOf:
            - $ref: '#/components/schemas/VaultAction'
              title: Vault action required
            - title: No Vault action required
              type: 'null'
        reason:
          type:
            - string
            - 'null'
        resourceVersion:
          type: integer
          minimum: 1
        failureCode:
          type:
            - string
            - 'null'
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time
    ErrorResponse:
      type: object
      additionalProperties: false
      required:
        - error
      properties:
        error:
          type: object
          additionalProperties: false
          required:
            - code
            - message
          properties:
            code:
              type: string
              minLength: 1
              maxLength: 128
              example: bad_request
            message:
              type: string
              minLength: 1
              maxLength: 1000
              example: The request is invalid
            details: {}
    VaultAction:
      type: object
      additionalProperties: false
      required:
        - id
        - vaultId
        - type
        - status
        - resourceVersion
        - createdAt
        - updatedAt
      properties:
        id:
          type: string
          example: vault_action_123
        vaultId:
          type: string
          example: vault_123
        policyId:
          type:
            - string
            - 'null'
          example: vault_policy_123
        type:
          type: string
          enum:
            - sign_policy
            - approve_managed_policy
            - install_policy
            - auto_supply_yield
            - redeem_yield
            - execute_payment
        status:
          type: string
          enum:
            - pending
            - queued
            - processing
            - completed
            - failed
            - cancelled
        nextAction:
          type:
            - object
            - 'null'
          additionalProperties: true
          description: >-
            Public wallet, signature, email approval, or wait instruction. Treat
            the action type as the discriminator and never modify transaction
            calldata. `execute_safe_transaction` includes a `completion` request
            descriptor for submitting the mined transaction hash.
        resourceVersion:
          type: integer
          minimum: 1
        failureCode:
          type:
            - string
            - 'null'
        expiresAt:
          type:
            - string
            - 'null'
          format: date-time
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time
  responses:
    BadRequest:
      description: Bad request
      headers:
        Stableyard-Version:
          description: >-
            Effective date-based Stableyard API contract version for this
            response.
          schema:
            type: string
            enum:
              - '2026-09-09'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            example:
              summary: BadRequest response
              value:
                error:
                  code: bad_request
                  message: The request is invalid
                  details: example
    Unauthorized:
      description: Unauthorized
      headers:
        Stableyard-Version:
          description: >-
            Effective date-based Stableyard API contract version for this
            response.
          schema:
            type: string
            enum:
              - '2026-09-09'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            example:
              summary: Unauthorized response
              value:
                error:
                  code: bad_request
                  message: The request is invalid
                  details: example
    Forbidden:
      description: The app secret does not include the required scope
      headers:
        Stableyard-Version:
          description: >-
            Effective date-based Stableyard API contract version for this
            response.
          schema:
            type: string
            enum:
              - '2026-09-09'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            example:
              summary: Forbidden response
              value:
                error:
                  code: bad_request
                  message: The request is invalid
                  details: example
    NotFound:
      description: Not found
      headers:
        Stableyard-Version:
          description: >-
            Effective date-based Stableyard API contract version for this
            response.
          schema:
            type: string
            enum:
              - '2026-09-09'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            example:
              summary: NotFound response
              value:
                error:
                  code: bad_request
                  message: The request is invalid
                  details: example
    Conflict:
      description: Conflict
      headers:
        Stableyard-Version:
          description: >-
            Effective date-based Stableyard API contract version for this
            response.
          schema:
            type: string
            enum:
              - '2026-09-09'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            example:
              summary: Conflict response
              value:
                error:
                  code: bad_request
                  message: The request is invalid
                  details: example
    FailedDependency:
      description: Required chain, network, or provider configuration is missing
      headers:
        Stableyard-Version:
          description: >-
            Effective date-based Stableyard API contract version for this
            response.
          schema:
            type: string
            enum:
              - '2026-09-09'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            example:
              summary: FailedDependency response
              value:
                error:
                  code: bad_request
                  message: The request is invalid
                  details: example
    TooManyRequests:
      description: >-
        Rate limit, payment-option limit, selection cooldown, or temporary abuse
        block
      headers:
        Stableyard-Version:
          description: >-
            Effective date-based Stableyard API contract version for this
            response.
          schema:
            type: string
            enum:
              - '2026-09-09'
        Retry-After:
          description: Seconds until the caller should retry.
          schema:
            type: integer
            minimum: 1
        RateLimit-Limit:
          description: Quota for the most constrained policy.
          schema:
            type: integer
            minimum: 1
        RateLimit-Remaining:
          description: Requests remaining in that policy window.
          schema:
            type: integer
            minimum: 0
        RateLimit-Reset:
          description: Seconds until that policy window resets.
          schema:
            type: integer
            minimum: 0
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            example:
              summary: TooManyRequests response
              value:
                error:
                  code: bad_request
                  message: The request is invalid
                  details: example
  securitySchemes:
    partnerBasicAuth:
      type: http
      scheme: basic
      description: >-
        HTTP Basic auth. Username is the Stableyard app ID. Password is the app
        secret. The optional Stableyard-Version request header must match the
        environment pin.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.