queryPolicy: Get sub-account authorization policy

Function details

Obtain the authorization policy for a sub-account.

Request address

https://openapi-[DataCenter].easy4ip.com/openapi/queryPolicy

Request format

HTTP POST. JSON body layout: Request conventions. Sign with Signature.

Incoming parameter description

Parameter name	Parameter type	Required or not	Default value	Legal value	Parameter description
openid	String	Yes			Sub-account ID
token	String	Yes			Administrator accessToken

Sample input

{
 "system":{
 "ver":"1.0",
 "appId":"lcdxxxxxxxxx",
 "sign": "xjhCQBoJ9hRDsCjyDcHjtDNzRZ3ZJezcawsfWeiaoxU=",
 "time":1603350473,
 "nonce":"a4d59add-0f04-4b7e-9355-d1fb4e9dc22b"
 },
 "id":"d82a7fa7-655f-4bb8-ab75-72bb3dfa3a94",
 "params":{
 "token":"At_12345678901234567890123456789012",
 "openid":"5dd2fe5bc11240a9b5d4fd4474c857c5"
 }
}

Return data field description

Field name	Field type	Field description
openid	String	Sub-account ID
policy	Object	Authorization policy
policy.statement	Array	Policy statements
policy.statement[].permission	String	Permission codes (comma-separated), for example `Real`, `Ptz`, `Talk`
policy.statement[].resource	String[]	Resource identifiers, for example `dev:{deviceId}` or `cam:{deviceId}:{channelId}`

Sample output

{
 "id": "123456",
 "result": {
 "code": "0",
 "msg": "Successful operation",
 "data":{
 "openid": "5dd2fe5bc11240a9b5d4fd4474c857c5",
 "policy": {
 "statement": [
 {
 "permission": "Ptz,Talk,Config",
 "resource": [
 "dev:469631729",
 "cam:544229080:1"
 ]
 },
 {
 "permission": "Real",
 "resource": [
 "dev:470686804"
 ]
 }
 ]
 }
 }
 }
}

Error codes

This method may return the codes below. See Return codes and Capability errors for the full catalog.

Gateway and auth (SN / TK / OP)

Code	Meaning	Next step
`SN1001`	Signature error	Check `sign` per Development specification
`TK1002`	Token invalid or expired	Refresh accessToken
`OP1002`	Missing required parameter	Add required fields
`OP1003`	Invalid parameter	Match this page’s parameter table
`OP1009`	Permission denied	Check token and device bind/share grants
`OP1013`	Total call limit exceeded	Reduce call rate
`OP1014`	Daily per-interface limit exceeded	See Interface call limits
`DV1007`	Device offline	Wait until the device is online

See Return codes · OP/SN/TK for the full catalog.

Sub-accounts (SUB)

Code	Meaning	Next step
`SUB1001`–`SUB1002`	Sub-account lacks API permission	Update policy via addPolicy
`SUB1005`	Sub-account token expired	Refresh subAccountToken
`SUB1006`	No device grant for sub-account	Check `Resource` and device serial
`SUB1008`	Sub-account not bound to app	Create and bind the sub-account first

See Return codes · SUB.