> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opper.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# List control rules

> Lists the calling organization's rules. `project_uuid` narrows to rules that apply in that project (org-scope rules, rules scoped to it, and function-scope rules targeting its functions); `function_uuid` narrows further to one function; `kind` filters by rule kind. Comply allowlist rows also carry `effective_count`, the number of catalog models the rule permits once the org → project → function chain is folded. Requires the `controls:read` scope.


## OpenAPI

````yaml get /management/v1/controls/rules
openapi: 3.1.0
info:
  description: Schema-driven generative API that orchestrates LLM-powered workflows.
  title: Task API
  version: 3.0.0
servers:
  - description: Production
    url: https://api.opper.ai
  - description: Local development
    url: http://localhost:8080
security:
  - BearerAuth: []
tags:
  - description: Schema-driven function management and execution
    name: Functions
  - description: OpenAI-compatible chat completions
    name: Chat
  - description: OpenAI Responses API compatible endpoint
    name: Responses
  - description: Google-compatible interactions endpoint
    name: Interactions
  - description: Model registry and capabilities
    name: Models
  - description: Synchronous image generation
    name: Images
  - description: Text-to-speech and speech-to-text
    name: Audio
  - description: Asynchronous video generation
    name: Videos
  - description: Reusable file storage for media inputs and generated outputs
    name: Files
  - description: Async generation status and downloads
    name: Artifacts
  - description: OpenAI-compatible embeddings
    name: Embeddings
  - description: Recorded HTTP request/response generations
    name: Generations
  - description: System health and status
    name: System
  - description: Roundtable endpoint — fan out a query to multiple LLMs and combine results
    name: Roundtable
  - description: Web search, fetch, and other utility tools
    name: Tools
  - description: Caller identity, credits, and usage
    name: Account
  - description: >-
      Programmatic project and API-key management. Authenticates with an
      `op-mak-…` management token; available on the control_plane and enterprise
      plans.
    name: Management
paths:
  /management/v1/controls/rules:
    get:
      tags:
        - Management
      summary: List control rules
      description: >-
        Lists the calling organization's rules. `project_uuid` narrows to rules
        that apply in that project (org-scope rules, rules scoped to it, and
        function-scope rules targeting its functions); `function_uuid` narrows
        further to one function; `kind` filters by rule kind. Comply allowlist
        rows also carry `effective_count`, the number of catalog models the rule
        permits once the org → project → function chain is folded. Requires the
        `controls:read` scope.
      operationId: listManagementControlRules
      parameters:
        - description: Only rules that apply in this project
          in: query
          name: project_uuid
          schema:
            format: uuid
            type: string
        - description: Only rules that apply to this function (with project_uuid)
          in: query
          name: function_uuid
          schema:
            format: uuid
            type: string
        - description: Only rules of this kind
          in: query
          name: kind
          schema:
            enum:
              - guard
              - observe
              - route
              - comply
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  data:
                    items:
                      $ref: '#/components/schemas/ManagementControlRule'
                    type: array
                  meta:
                    properties:
                      total_count:
                        description: Total items in the collection.
                        type: integer
                    type: object
                type: object
          description: Successful response
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Bad request
        '401':
          description: Unauthorized - missing or invalid API key
        '403':
          content:
            application/json:
              schema:
                properties:
                  allowed_plans:
                    description: Present on the plan-gate refusal.
                    items:
                      type: string
                    type: array
                  current_plan:
                    description: Present on the plan-gate refusal.
                    type: string
                  error:
                    type: string
                  required_scope:
                    description: Present on the scope refusal.
                    type: string
                type: object
          description: >-
            Either the organization's plan does not include the Management API
            (`current_plan` / `allowed_plans` are returned), or the token lacks
            the scope this endpoint requires (`required_scope` is returned).
            Presenting a runtime `op-…` key instead of a management `op-mak-…`
            token also lands here.
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Internal server error
      security:
        - ManagementBearer: []
components:
  schemas:
    ManagementControlRule:
      properties:
        allowed_model_ids:
          items:
            type: string
          type: array
        config:
          description: >-
            The rule's configuration; its shape depends on kind. comply and
            route rules carry a type discriminator (comply: allowlist |
            retention | budget | zdr; route: cache | pool_order | absent for a
            default-model rule); guard and observe rules carry their
            configuration inline.
          type: object
        confirm_file_deletion:
          type: boolean
        created_at:
          format: date-time
          type: string
        effective_count:
          type: integer
        enabled:
          type: boolean
        id:
          type: string
        kind:
          type: string
        name:
          type: string
        parent_allowlist:
          properties:
            countries:
              items:
                type: string
              type: array
            deny_all:
              type: boolean
            exclude_providers:
              items:
                type: string
              type: array
            exclude_service_routes:
              items:
                type: string
              type: array
            handling:
              properties:
                cache_scopes:
                  items:
                    type: string
                  type: array
                caching:
                  items:
                    type: string
                  type: array
                human_review:
                  items:
                    type: string
                  type: array
                logging:
                  items:
                    type: string
                  type: array
                max_retention_days:
                  type: integer
                moderation:
                  items:
                    type: string
                  type: array
                subprocessors_read_content:
                  type: boolean
                training:
                  items:
                    type: string
                  type: array
              type: object
            maker:
              properties:
                jurisdiction:
                  items:
                    type: string
                  type: array
                name:
                  items:
                    type: string
                  type: array
              type: object
            models:
              items:
                type: string
              type: array
            provider:
              properties:
                locations:
                  properties:
                    inference:
                      properties:
                        exclude:
                          items:
                            type: string
                          type: array
                        include:
                          items:
                            type: string
                          type: array
                      type: object
                    jurisdiction:
                      properties:
                        exclude:
                          items:
                            type: string
                          type: array
                        include:
                          items:
                            type: string
                          type: array
                      type: object
                    storage:
                      properties:
                        exclude:
                          items:
                            type: string
                          type: array
                        include:
                          items:
                            type: string
                          type: array
                      type: object
                  required:
                    - inference
                    - storage
                    - jurisdiction
                  type: object
                name:
                  properties:
                    exclude:
                      items:
                        type: string
                      type: array
                    include:
                      items:
                        type: string
                      type: array
                  type: object
                route:
                  properties:
                    exclude:
                      items:
                        type: string
                      type: array
                    include:
                      items:
                        type: string
                      type: array
                  type: object
              required:
                - name
                - route
                - locations
              type: object
            providers:
              items:
                type: string
              type: array
            regions:
              items:
                type: string
              type: array
            service_routes:
              items:
                type: string
              type: array
          required:
            - providers
            - regions
            - countries
            - models
            - provider
            - maker
            - handling
          type: object
        schema_version:
          type: integer
        scope:
          properties:
            function_uuids:
              items:
                type: string
              type: array
            project_uuids:
              items:
                type: string
              type: array
            type:
              type: string
          required:
            - type
          type: object
        updated_at:
          format: date-time
          type: string
      required:
        - id
        - kind
        - enabled
        - scope
        - schema_version
        - config
        - created_at
        - updated_at
      type: object
    ErrorResponse:
      properties:
        error:
          properties:
            code:
              type: string
            details:
              description: Any value
            message:
              type: string
          required:
            - code
            - message
          type: object
        meta:
          type: object
      required:
        - error
      type: object
  securitySchemes:
    BearerAuth:
      bearerFormat: API Key
      description: API key authentication. Pass your API key as a Bearer token.
      scheme: bearer
      type: http
    ManagementBearer:
      bearerFormat: Management API Key
      description: >-
        Management API authentication. Pass an `op-mak-…` management token as a
        Bearer token. Runtime `op-…` API keys are rejected with 403 — they
        belong on the data-plane endpoints. Mint a management key from the
        platform UI under Settings → API keys.
      scheme: bearer
      type: http

````