# Fetch all policy groups with their policies

> 🔒 **Private label — [contact sales](mailto:sales@boyahq.com).** Requires a private-label entitlement on your API client.

Returns all policy groups, each with their associated policy types (CHANNELS, SUBCATEGORY, VENDORS, TIME, RECEIPTS, TAGS, etc.) including both business-specific policies and default rules.

Endpoint: GET /business-policies/policy-group-policies
Version: 2.0.0
Security: oauth2ClientCredentials

## Header parameters:

  - `business_id` (string, required)
    Business identifier for the request

## Response 200 fields (application/json):

  - `_id` (string)
    Policy group MongoDB ObjectId

  - `description` (string)
    Description of what this policy group governs

  - `subject` (string)
    Subject area of the policy group (e.g. Employee Spend, Expense Review)

  - `policies` (array)
    Policy types within this group, each with their business policies and rules

  - `policies._id` (string)
    Policy type MongoDB ObjectId

  - `policies.status` (string)
    Policy status
    Enum: "ACTIVE", "DISABLED"

  - `policies.description` (string)
    Human-readable description of the policy type

  - `policies.policy_code` (string)
    Policy code (e.g. CHANNELS, SUBCATEGORY, VENDORS)

  - `policies.business_policies` (array)
    Business-specific policies under this type

  - `policies.business_policies._id` (string)
    Business policy MongoDB ObjectId

  - `policies.business_policies.status` (string)
    Policy status
    Enum: "ACTIVE", "DISABLED", "DELETED"

  - `policies.business_policies.policy` (object)
    Parent policy group — either a MongoDB ObjectId string or an expanded PolicyRefV1Dto object

  - `policies.business_policies.policy._id` (string)
    Policy group MongoDB ObjectId

  - `policies.business_policies.policy.status` (string)
    Policy status
    Enum: "ACTIVE", "DISABLED", "DELETED"

  - `policies.business_policies.policy.description` (string)
    Human-readable description of the policy type

  - `policies.business_policies.policy.policy_code` (string)
    Policy code identifier (e.g. SUBCATEGORY, CHANNELS, VENDORS)

  - `policies.business_policies.business` (string)
    Business MongoDB ObjectId this policy belongs to

  - `policies.business_policies.policy_type` (string)
    Policy scope (e.g. business, budget)

  - `policies.business_policies.policy_code` (string)
    Policy code inherited from the parent policy group

  - `policies.business_policies.employees` (array)
    Employee IDs this policy is scoped to

  - `policies.business_policies.teams` (array)
    Team IDs this policy is scoped to

  - `policies.business_policies.budgets` (array)
    Budget IDs this policy is scoped to

  - `policies.business_policies.priority` (number)
    Priority order among policies of the same type (lower = higher priority)

  - `policies.business_policies.workflow` (object)
    Approval workflow attached to this policy — null when no approval is required

  - `policies.business_policies.rules` (array)
    Rules defining the conditions and actions of this policy

  - `policies.business_policies.rules.conditions` (array)
    Conditions that must be met for this rule to apply

  - `policies.business_policies.rules.conditions.field` (string)
    Field the condition applies to (e.g. amount, channel, subcategory)

  - `policies.business_policies.rules.conditions.operator` (string)
    Comparison operator (e.g. greater_than, equal, less_than)

  - `policies.business_policies.rules.conditions.value` (object)
    Value to compare against

  - `policies.business_policies.rules.conditions.value_id` (string)
    MongoDB ObjectId of the referenced value (e.g. subcategory ID)

  - `policies.business_policies.rules.action` (string)
    Action to take when conditions are met (e.g. allow, block, request_approval, require_receipt)

  - `policies.business_policies.rules.period_unit` (string)
    Time unit for the spending period. TRANSACTION = per-payment limit; HOUR/DAY/WEEK/MONTH/YEAR = cumulative window
    Enum: "TRANSACTION", "HOUR", "DAY", "WEEK", "MONTH", "YEAR"

  - `policies.business_policies.rules.period` (number)
    Number of period units for the spending limit window. Use 0 when period_unit is TRANSACTION
    Example: 0

  - `policies.business_policies.rules.kick_off_date` (string)
    ISO 8601 date when the rule becomes active

  - `policies.business_policies.rules.target` (string)
    Who this rule targets (e.g. everyone)

  - `policies.business_policies.rules.target_employees` (array)
    Specific employee IDs this rule targets

  - `policies.business_policies.rules.exempt_employees` (array)
    Employee IDs exempt from this rule

  - `policies.business_policies.rules.target_teams` (array)
    Team IDs this rule targets

  - `policies.business_policies.rules.exempt_teams` (array)
    Team IDs exempt from this rule

  - `policies.business_policies.rules.target_sub_categories` (array)
    Subcategories this rule targets

  - `policies.business_policies.rules.exempt_sub_categories` (array)
    Subcategories exempt from this rule

  - `policies.business_policies.rules.target_channels` (array)
    Payment channels this rule targets (e.g. mpesa, bills, tills)

  - `policies.business_policies.rules.target_roles` (array)
    Employee roles this rule targets

  - `policies.business_policies.rules.require_tax_compliant_receipt` (boolean)
    Whether a tax-compliant receipt is required

  - `policies.business_policies.rules.funding_source_strategy` (string)
    Funding source strategy (e.g. business_wallet, initiator_wallet)

  - `policies.business_policies.rules.exempt_wallet_types` (array)
    Wallet types exempt from this rule

  - `policies.business_policies.name` (string)
    Human-readable name for this business policy

  - `policies.business_policies.description` (string)
    Optional description for this business policy

  - `policies.business_policies.createdAt` (string)
    ISO 8601 creation timestamp

  - `policies.business_policies.updatedAt` (string)
    ISO 8601 last-updated timestamp

  - `policies.rules` (array)
    Default rules for this policy type

  - `createdAt` (string)
    ISO 8601 creation timestamp

  - `updatedAt` (string)
    ISO 8601 last-updated timestamp