Cerbos

CerbosService
- postCheck
- postCheck resources
- postCheck resource batch
- postPlan resources
- getGet server information
CerbosAdminService
- getList audit log entries
- getList policies
- getInspect policies
- getGet policy
- delDisable policy
- postAdd or update policies
- putAdd or update policies
- postDisable policy
- putDisable policy
- postEnable policy
- putEnable policy
- getGet schema
- delDelete schema
- postAdd or update schema
- putAdd or update schema
- getList schemas
- getReload store

Cerbos (latest)

Download OpenAPI specification: Download

Cerbos: info@cerbos.dev URL: https://cerbos.dev

CerbosService Cerbos Policy Decision Point

Check Deprecated

[Deprecated: Use CheckResources API instead] Check whether a principal has permissions to perform the given actions on a set of resource instances.

Request Body schema: application/json required

PDP Request


requestId	string Optional application-specific ID useful for correlating logs for analysis.
actions required	Array of strings non-empty unique List of actions being performed on the set of resources.
principal required	object (enginev1Principal) A person or application attempting to perform the actions on the set of resources.
resource required	object (v1ResourceSet) Set of resources to check
includeMeta	boolean Opt to receive request processing metadata in the response.
auxData	object (cerbosrequestv1AuxData) Structured auxiliary data useful for evaluating the request

Responses

200 A successful response.

default An unexpected error response.

post/api/check

https://docs.cerbos.dev/api/check

Request samples

Payload

Content type

application/json

{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b",

"actions": ["view:public",

"comment"

],

"principal": {"id": "bugs_bunny",

"policyVersion": "default",

"roles": ["user"

],

"attr": {"beta_tester": true

},

"scope": "acme.corp"

},

"resource": {"kind": "album:object",

"policyVersion": "default",

"instances": {"XX125": {"attr": {"owner": "bugs_bunny",

"public": false,

"flagged": false

}

},

"XX225": {"attr": {"owner": "daffy_duck",

"public": true,

"flagged": false

}

}

},

"scope": "^(a]w\-]*(\.w\-]*)*)*$"

},

"includeMeta": true,

"auxData": {"jwt": {"token": "eyJhbGciOiJFUzM4NCIsImtpZCI6IjE5TGZaYXRFZGc4M1lOYzVyMjNndU1KcXJuND0iLCJ0eXAiOiJKV1QifQ.eyJhdWQiOlsiY2VyYm9zLWp3dC10ZXN0cyJdLCJjdXN0b21BcnJheSI6WyJBIiwiQiIsIkMiXSwiY3VzdG9tSW50Ijo0MiwiY3VzdG9tTWFwIjp7IkEiOiJBQSIsIkIiOiJCQiIsIkMiOiJDQyJ9LCJjdXN0b21TdHJpbmciOiJmb29iYXIiLCJleHAiOjE5NDk5MzQwMzksImlzcyI6ImNlcmJvcy10ZXN0LXN1aXRlIn0.WN_tOScSpd_EI-P5EI1YlagxEgExSfBjAtcrgcF6lyWj1lGpR_GKx9goZEp2p_t5AVWXN_bjz_sMUmJdJa4cVd55Qm1miR-FKu6oNRHnSEWdMFmnArwPw-YDJWfylLFX",

"keySetId": "my-keyset"

}

}

Response samples

200
default

Content type

application/json

{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b",

"resourceInstances": {"XX125": {"actions": {"view:*": "EFFECT_ALLOW",

"comment": "EFFECT_ALLOW"

}

},

"XX225": {"actions": {"view:*": "EFFECT_DENY",

"comment": "EFFECT_DENY"

}

}

},

"meta": {"resourceInstances": {"XX125": {"actions": {"view:*": {"matched_policy": "album:object:default"

},

"comment": {"matched_policy": "album:object:default"

}

},

"effective_derived_roles": ["owner"

]

},

"XX225": {"actions": {"view:*": {"matched_policy": "album:object:default"

},

"comment": {"matched_policy": "album:object:default"

}

}

}

}

}

}`

### Response samples

- 200
- default

Content type

application/json

```json
{"version": "string",

"commit": "string",

"buildDate": "string"

}`

## CerbosAdminService Cerbos administration service

## List audit log entries

##### Authorizations:

_BasicAuth_

##### path Parameters

|     |     |
| --- | --- |
| kind<br>required | string<br>Enum:"KIND_UNSPECIFIED""KIND_ACCESS""KIND_DECISION"<br>Kind of log entry |

##### query Parameters

|     |     |
| --- | --- |
| tail | integer <int64> <br>Last N entries. |
| between.start<br>required | string <date-time> <br>Start date in ISO 8601 format. |
| between.end<br>required | string <date-time> <br>End date in ISO 8601 format. |
| since | string<br>Entries since N hours/minutes ago |
| lookup | string^[0123456789ABCDEFGHJKMNPQRSTVWXYZ]{26}$<br>By Call ID |

### Responses

**200** A successful response.(streaming responses)

**default** An unexpected error response.

get/admin/auditlog/list/{kind}

https://docs.cerbos.dev/admin/auditlog/list/{kind}

### Response samples

- 200
- default

Content type

application/json

```json
{"result": {"accessLogEntry": {"callId": "string",

"timestamp": "2019-08-24T14:15:22Z",

"peer": {"address": "string",

"authInfo": "string",

"userAgent": "string",

"forwardedFor": "string"

},

"metadata": {"property1": {"values": ["string"

]}

,

"property2": {"values": ["string"

]}

},

"method": "string",

"statusCode": 0

},

"decisionLogEntry": {"callId": "string",

"timestamp": "2019-08-24T14:15:22Z",

"peer": {"address": "string",

"authInfo": "string",

"userAgent": "string",

"forwardedFor": "string"

},

"inputs": [{"requestId": "string",

"resource": {"kind": "album:photo",

"policyVersion": "default",

"id": "XX125",

"attr": {"owner": "bugs_bunny"

},

"scope": "acme.corp"

},

"principal": {"id": "bugs_bunny",

"policyVersion": "default",

"roles": ["user"

],

"attr": {"beta_tester": true

},

"scope": "acme.corp"

},

"actions": ["string"

],

"auxData": {"jwt": {"property1": null,

"property2": null

}

}

}],

"outputs": [{"requestId": "string",

"resourceId": "string",

"actions": {"property1": {"effect": "EFFECT_UNSPECIFIED",

"policy": "string",

"scope": "string"

},

"property2": {"effect": "EFFECT_UNSPECIFIED",

"policy": "string",

"scope": "string"

}

},

"effectiveDerivedRoles": ["string"

],

"validationErrors": [{"path": "string",

"message": "string",

"source": "SOURCE_UNSPECIFIED"

}],

"outputs": [{"src": "resource.expense.v1/acme#rule-001",

"val": "some_string"

}]

}],

"error": "string",

"checkResources": {"inputs": [{"requestId": "string",

"resource": {"kind": "album:photo",

"policyVersion": "default",

"id": "XX125",

"attr": {"owner": "bugs_bunny"

},

"scope": "acme.corp"

},

"principal": {"id": "bugs_bunny",

"policyVersion": "default",

"roles": ["user"

],

"attr": {"beta_tester": true

},

"scope": "acme.corp"

},

"actions": ["string"

],

"auxData": {"jwt": {"property1": null,

"property2": null

}

}

}],

"outputs": [{"requestId": "string",

"resourceId": "string",

"actions": {"property1": {"effect": "EFFECT_UNSPECIFIED",

"policy": "string",

"scope": "string"

},

"property2": {"effect": "EFFECT_UNSPECIFIED",

"policy": "string",

"scope": "string"

}},

"effectiveDerivedRoles": ["string"],

"validationErrors": [{"path": "string",

"message": "string",

"source": "SOURCE_UNSPECIFIED"}],

"outputs": [{"src": "resource.expense.v1/acme#rule-001",

"val": "some_string"}]

},

"error": "string"

},

"planResources": {"input": {"requestId": "string",

"action": "string",

"principal": {"id": "bugs_bunny",

"policyVersion": "default",

"roles": ["user"

],

"attr": {"beta_tester": true},

"scope": "acme.corp"

},

"resource": {"kind": "album:object",

"attr": {"property1": null,

"property2": null},

"policyVersion": "default",

"scope": "^(a]w\-]*(\.w\-]*)*)*$"

},

"auxData": {"jwt": {"property1": null,

"property2": null}},

"includeMeta": true},

"output": {"requestId": "string",

"action": "string",

"kind": "string",

"policyVersion": "string",

"scope": "string",

"filter": {"kind": "KIND_UNSPECIFIED",

"condition": {"value": null,

"expression": {"operator": "string",

"operands": [{}]},

"variable": "string"}},

"filterDebug": "string",

"validationErrors": [{"path": "string",

"message": "string",

"source": "SOURCE_UNSPECIFIED"}]},

"error": "string"},

"metadata": {"property1": {"values": ["string"]},"property2": {"values": ["string"]}},

"auditTrail": {"effectivePolicies": {"property1": {"attributes": {"property1": null,"property2": null}},"property2": {"attributes": {"property1": null,"property2": null}}}}}}.

## List policies

### Authorizations:

_BasicAuth_

### Responses

**200** A successful response.

**default** An unexpected error response.

get/admin/policies

https://docs.cerbos.dev/admin/policies

### Response samples

- 200
- default

Content type

application/json

```json
{"policyIds": ["string"]

}`