code: func (a *ACL) Get(args *structs.ACLSpecificRequest,
  	reply *structs.IndexedACLs) error {
  	if done, err := a.srv.forward("ACL.Get", args, args, reply); done {
  		return err
  	}
  
  	// Verify we are allowed to serve this request
  	if !a.srv.ACLsEnabled() {
  		return acl.ErrDisabled
  	}
  
  	return a.srv.blockingQuery(&args.QueryOptions,
  		&reply.QueryMeta,
  		func(ws memdb.WatchSet, state *state.Store) error {
  			index, token, err := state.ACLTokenGetBySecret(ws, args.ACL)
  			if err != nil {
  				return err
  			}
  
  			// Converting an ACLToken to an ACL will return nil and an error
  			// (which we ignore) when it is unconvertible.
  			//
  			// This also means we won't have to check expiration times since
  			// any legacy tokens never had expiration times and no non-legacy
  			// tokens can be converted.
  
  			var acl *structs.ACL
  			if token != nil {
  				acl, _ = token.Convert()
  			}
  
  			reply.Index = index
  			if acl != nil {
  				reply.ACLs = structs.ACLs{acl}
  			} else {
  				reply.ACLs = nil
  			}
  			return nil
  		})
  }
docs: // Get is used to retrieve a single ACL