> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-eu-instance.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Get Egress Policy > GetEgressPolicy returns both the typed rules (for the authoring UI) and the compiled TB policy YAML + generation (for timebanditd's poller) in one call -- one instance's policy is small enough that splitting the two reads into separate RPCs would be pure surface area, not a real cost saving for either caller. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples get /api/v1/tb-control-plane/egress-policy/{tb_instance_id} openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/tb-control-plane/egress-policy/{tb_instance_id}: get: tags: - Time Bandit Control Plane summary: Get Egress Policy description: |- GetEgressPolicy returns both the typed rules (for the authoring UI) and the compiled TB policy YAML + generation (for timebanditd's poller) in one call -- one instance's policy is small enough that splitting the two reads into separate RPCs would be pure surface area, not a real cost saving for either caller. operationId: c1.api.tbcontrolplane.v1.TBControlPlaneService.GetEgressPolicy parameters: - in: path name: tb_instance_id required: true schema: description: The tbInstanceId field. type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.tbcontrolplane.v1.TBControlPlaneServiceGetEgressPolicyResponse description: Successful response components: schemas: c1.api.tbcontrolplane.v1.TBControlPlaneServiceGetEgressPolicyResponse: description: The TBControlPlaneServiceGetEgressPolicyResponse message. properties: compiledPolicyYaml: description: |- The compiled TB policy YAML for the current generation, empty when `policy.rules` is empty. type: string policy: oneOf: - $ref: '#/components/schemas/c1.models.tbcontrolplane.v1.TBEgressPolicy' - type: 'null' title: Tb Control Plane Service Get Egress Policy Response type: object x-speakeasy-name-override: TBControlPlaneServiceGetEgressPolicyResponse c1.models.tbcontrolplane.v1.TBEgressPolicy: description: |- TBEgressPolicy is the typed policy document for one TB instance. Binds per-instance, not per-tenant-across-instances, keyed by tb_instance_id exactly as discovery reports it. properties: createdAt: format: date-time type: - string - 'null' defaultDenyReason: description: The defaultDenyReason field. type: string defaultOutcome: description: The defaultOutcome field. enum: - TB_EGRESS_OUTCOME_UNSPECIFIED - TB_EGRESS_OUTCOME_ALLOWED - TB_EGRESS_OUTCOME_DENIED type: string x-speakeasy-unknown-values: allow generation: description: |- Opaque, bumped on every successful save -- TB's change detector. Stamped as "c1-gen-". type: string rules: description: The rules field. items: $ref: '#/components/schemas/c1.models.tbcontrolplane.v1.TBEgressRule' type: - array - 'null' tbInstanceId: description: The tbInstanceId field. type: string tenantId: description: The tenantId field. type: string updatedAt: format: date-time type: - string - 'null' title: Tb Egress Policy type: object x-speakeasy-name-override: TBEgressPolicy c1.models.tbcontrolplane.v1.TBEgressRule: description: |- TBEgressRule is one typed rule. Deliberately smaller than AgentGuardrailRule: no celCondition (TB's matcher is typed, not an expression evaluator), no hook ids (TB has no hook model -- posture and review routes are the nearest analogues, unmapped here). `hard_allow` and inline `consider` are deliberately unrepresentable: no field here names either, and protojson's default unknown-field behavior already rejects a request naming either key -- DiscardUnknown is never set on the apigw decoder, so this is genuinely "rejected at decode" via the REST route, and structurally absent for any gRPC caller (no stub has an equivalent field to set). properties: credentialId: description: The credentialId field. type: string denyReason: description: The denyReason field. type: string description: description: The description field. type: string destinations: description: The destinations field. items: type: string type: - array - 'null' displayName: description: The displayName field. type: string id: description: The id field. type: string ingressScopes: description: The ingressScopes field. items: type: string type: - array - 'null' methods: description: The methods field. items: type: string type: - array - 'null' mode: description: The mode field. enum: - TB_EGRESS_MODE_UNSPECIFIED - TB_EGRESS_MODE_ENFORCE - TB_EGRESS_MODE_OBSERVE - TB_EGRESS_MODE_DISABLED type: string x-speakeasy-unknown-values: allow outcome: description: The outcome field. enum: - TB_EGRESS_OUTCOME_UNSPECIFIED - TB_EGRESS_OUTCOME_ALLOWED - TB_EGRESS_OUTCOME_DENIED type: string x-speakeasy-unknown-values: allow paths: description: The paths field. items: type: string type: - array - 'null' postureId: description: The postureId field. type: string principals: description: |- Selector, discovery-driven picker fields. Every non-empty value here must name something the latest TBDiscoverySnapshot for the target instance actually reported. items: type: string type: - array - 'null' priority: description: >- Explicit order; TB evaluates policy rows first-match, so rules compile in ascending priority order. format: int32 type: integer sourceTemplateId: description: The sourceTemplateId field. type: string systemManaged: description: The systemManaged field. type: boolean title: Tb Egress Rule type: object x-speakeasy-name-override: TBEgressRule securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````