@GetMapping('/' + OAuth20Constants.BASE_OAUTH20_URL + "/{resourceId}/" + OAuth20Constants.UMA_POLICY_URL + "/{policyId}")
    @Operation(
        summary = "Get policy for resource set",
        description = "Gets a policy for the specified resource set",
        parameters = {
            @Parameter(name = "resourceId", required = true, in = ParameterIn.PATH, description = "Resource ID"),
            @Parameter(name = "policyId", required = true, in = ParameterIn.PATH, description = "Policy ID")
        }
    )
    public ResponseEntity getPolicyForResourceSet(
        @PathVariable("resourceId")
        final long resourceId,
        @PathVariable("policyId")
        final long policyId,
        final HttpServletRequest request,
        final HttpServletResponse response) {
        try {
            val profileResult = getAuthenticatedProfile(request, response, OAuth20Constants.UMA_PROTECTION_SCOPE);
            val resourceSetResult = getUmaConfigurationContext().getUmaResourceSetRepository().getById(resourceId);
            if (resourceSetResult.isEmpty()) {
                val model = buildResponseEntityErrorModel(HttpStatus.NOT_FOUND, "Requested resource-set cannot be found");
                return new ResponseEntity(model, model, HttpStatus.BAD_REQUEST);
            }
            val resourceSet = resourceSetResult.get();
            resourceSet.validate(profileResult);

            val policyResult = resourceSet.getPolicies().stream().filter(p -> p.getId() == policyId).findFirst();
            if (policyResult.isPresent()) {
                val model = CollectionUtils.wrap("entity", policyResult.get(), "code", HttpStatus.FOUND);
                return new ResponseEntity(model, HttpStatus.OK);
            }
            val model = CollectionUtils.wrap("code", HttpStatus.NOT_FOUND);
            return new ResponseEntity(model, HttpStatus.OK);
        } catch (final Exception e) {
            LoggingUtils.error(LOGGER, e);
        }
        return new ResponseEntity("Unable to locate resource-set.", HttpStatus.BAD_REQUEST);
    }
Gets policy for resource set.

@param resourceId the resource id
@param policyId   the policy id
@param request    the request
@param response   the response
@return the policy for resource set
support/cas-server-support-oauth-uma-core/src/main/java/org/apereo/cas/uma/web/controllers/policy/UmaFindPolicyForResourceSetEndpointController.java