- CerbosService - postCheck - postCheck resources - postCheck resource batch - postPlan resources - getGet server information - CerbosAdminService - getList audit log entries - getList policies - getInspect policies - getGet policy - delDisable policy - postAdd or update policies - putAdd or update policies - postDisable policy - putDisable policy - postEnable policy - putEnable policy - getGet schema - delDelete schema - postAdd or update schema - putAdd or update schema - getList schemas - getReload store ## Cerbos (latest) Download OpenAPI specification: [Download](blob:https://docs.cerbos.dev/c10dedf9-e2f5-451a-880d-9475e95deaf2) Cerbos: [info@cerbos.dev](mailto:info@cerbos.dev)URL: [https://cerbos.dev](/content/site-root.html) ## [tag/CerbosService](https://docs.cerbos.dev/cerbos/0.42.0/api/_attachments/cerbos-api#tag/CerbosService) CerbosService Cerbos Policy Decision Point ## [tag/CerbosService/operation/CerbosService_CheckResourceSet](https://docs.cerbos.dev/cerbos/0.42.0/api/_attachments/cerbos-api#tag/CerbosService/operation/CerbosService_CheckResourceSet) Check Deprecated [Deprecated: Use CheckResources API instead] Check whether a principal has permissions to perform the given actions on a set of resource instances. ##### Request Body schema: application/json required PDP Request | | | | --- | --- | | requestId | string
Optional application-specific ID useful for correlating logs for analysis. | | actions
required | Array of strings non-empty unique
List of actions being performed on the set of resources. | | principal
required | object (enginev1Principal)
A person or application attempting to perform the actions on the set of resources. | | resource
required | object (v1ResourceSet)
Set of resources to check | | includeMeta | boolean
Opt to receive request processing metadata in the response. | | auxData | object (cerbosrequestv1AuxData)
Structured auxiliary data useful for evaluating the request | ### Responses **200** A successful response. **default** An unexpected error response. post/api/check https://docs.cerbos.dev/api/check ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b", "actions": ["view:public", "comment" ], "principal": {"id": "bugs_bunny", "policyVersion": "default", "roles": ["user" ], "attr": {"beta_tester": true }, "scope": "acme.corp" }, "resource": {"kind": "album:object", "policyVersion": "default", "instances": {"XX125": {"attr": {"owner": "bugs_bunny", "public": false, "flagged": false } }, "XX225": {"attr": {"owner": "daffy_duck", "public": true, "flagged": false } } }, "scope": "^(a]w\-]*(\.w\-]*)*)*$" }, "includeMeta": true, "auxData": {"jwt": {"token": "eyJhbGciOiJFUzM4NCIsImtpZCI6IjE5TGZaYXRFZGc4M1lOYzVyMjNndU1KcXJuND0iLCJ0eXAiOiJKV1QifQ.eyJhdWQiOlsiY2VyYm9zLWp3dC10ZXN0cyJdLCJjdXN0b21BcnJheSI6WyJBIiwiQiIsIkMiXSwiY3VzdG9tSW50Ijo0MiwiY3VzdG9tTWFwIjp7IkEiOiJBQSIsIkIiOiJCQiIsIkMiOiJDQyJ9LCJjdXN0b21TdHJpbmciOiJmb29iYXIiLCJleHAiOjE5NDk5MzQwMzksImlzcyI6ImNlcmJvcy10ZXN0LXN1aXRlIn0.WN_tOScSpd_EI-P5EI1YlagxEgExSfBjAtcrgcF6lyWj1lGpR_GKx9goZEp2p_t5AVWXN_bjz_sMUmJdJa4cVd55Qm1miR-FKu6oNRHnSEWdMFmnArwPw-YDJWfylLFX", "keySetId": "my-keyset" } } }` ### Response samples - 200 - default Content type application/json Copy Expand all Collapse all `{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b", "resourceInstances": {"XX125": {"actions": {"view:*": "EFFECT_ALLOW", "comment": "EFFECT_ALLOW" } }, "XX225": {"actions": {"view:*": "EFFECT_DENY", "comment": "EFFECT_DENY" } } }, "meta": {"resourceInstances": {"XX125": {"actions": {"view:*": {"matched_policy": "album:object:default" }, "comment": {"matched_policy": "album:object:default" } }, "effective_derived_roles": ["owner" ] }, "XX225": {"actions": {"view:*": {"matched_policy": "album:object:default" }, "comment": {"matched_policy": "album:object:default" } } } } } }` ## [tag/CerbosService/operation/CerbosService_CheckResources](https://docs.cerbos.dev/cerbos/0.42.0/api/_attachments/cerbos-api#tag/CerbosService/operation/CerbosService_CheckResources) Check resources Check a principal's permissions to a batch of heterogeneous resources and actions. ##### Request Body schema: application/json required Check resources request | | | | --- | --- | | requestId | string
Optional application-specific ID useful for correlating logs for analysis. | | includeMeta | boolean
Add request processing metadata to the response. | | principal
required | object (enginev1Principal)
A person or application attempting to perform the actions on the set of resources. | | resources
required | Array of objects (CheckResourcesRequestResourceEntry) non-empty unique
List of resources and actions. | | auxData | object (cerbosrequestv1AuxData)
Structured auxiliary data useful for evaluating the request | ### Responses **200** A successful response. **default** An unexpected error response. post/api/check/resources https://docs.cerbos.dev/api/check/resources ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b", "includeMeta": true, "principal": {"id": "bugs_bunny", "policyVersion": "default", "roles": ["user" ], "attr": {"beta_tester": true }, "scope": "acme.corp" }, "resources": [{"actions": ["view", "comment" ], "resource": {"kind": "album:object", "policyVersion": "default", "id": "XX125", "attr": {"owner": "bugs_bunny", "public": false, "flagged": false } } }], "keySetId": "my-keyset" } } }` ### Response samples - 200 - default Content type application/json Copy Expand all Collapse all `{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b", "results": [{"resource": {"Id": "XX125", "kind": "album:object" }, "actions": {"view": "EFFECT_ALLOW", "comment": "EFFECT_DENY" } }], "cerbosCallId": "string" }` ## [tag/CerbosService/operation/CerbosService_CheckResourceBatch](https://docs.cerbos.dev/cerbos/0.42.0/api/_attachments/cerbos-api#tag/CerbosService/operation/CerbosService_CheckResourceBatch) Check resource batch Deprecated [Deprecated: Use CheckResources API instead] Check a principal's permissions to a batch of heterogeneous resources and actions. ##### Request Body schema: application/json required PDP Request | | | | --- | --- | | requestId | string
Optional application-specific ID useful for correlating logs for analysis. | | principal
required | object (enginev1Principal)
A person or application attempting to perform the actions on the set of resources. | | resources
required | Array of objects (CheckResourceBatchRequestBatchEntry) non-empty unique
List of resources and actions. | | auxData | object (cerbosrequestv1AuxData)
Structured auxiliary data useful for evaluating the request | ### Responses **200** A successful response. **default** An unexpected error response. post/api/check_resource_batch https://docs.cerbos.dev/api/check_resource_batch ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b", "principal": {"id": "bugs_bunny", "policyVersion": "default", "roles": ["user" ], "attr": {"beta_tester": true }, "scope": "acme.corp" }, "resources": [{"actions": ["view", "comment" ], "resource": {"kind": "album:object", "policyVersion": "default", "id": "XX125", "attr": {"owner": "bugs_bunny", "public": false, "flagged": false } } }], "keySetId": "my-keyset" } } }` ### Response samples - 200 - default Content type application/json Copy Expand all Collapse all `{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b", "results": [{"resourceId": "XX125", "actions": {"view": "EFFECT_ALLOW" } }] }` ## [tag/CerbosService/operation/CerbosService_PlanResources](https://docs.cerbos.dev/cerbos/0.42.0/api/_attachments/cerbos-api#tag/CerbosService/operation/CerbosService_PlanResources) Plan resources Produce a query plan with conditions that must be satisfied for accessing a set of instances of a resource ##### Request Body schema: application/json required PDP Resources Query Plan Request | | | | --- | --- | | requestId | string
Optional application-specific ID useful for correlating logs for analysis. | | action
required | string
Action to be applied to each resource in the list. | | principal
required | object (enginev1Principal)
A person or application attempting to perform the actions on the set of resources. | | resource
required | object (v1PlanResourcesInputResource) | | auxData | object (cerbosrequestv1AuxData)
Structured auxiliary data useful for evaluating the request | | includeMeta | boolean
Opt to receive request processing metadata in the response. | ### Responses **200** A successful response. **default** An unexpected error response. post/api/plan/resources https://docs.cerbos.dev/api/plan/resources ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b", "action": "view:public", "principal": {"id": "bugs_bunny", "policyVersion": "default", "roles": ["user" ], "attr": {"beta_tester": true }, "scope": "acme.corp" }, "resource": {"kind": "album:object", "attr": {"property1": null, "property2": null }, "policyVersion": "default", "scope": "^(a]w\-]*(\.w\-]*)*)*$" }, "keySetId": "my-keyset" } }, "includeMeta": true }` ### Response samples - 200 - default Content type application/json Copy Expand all Collapse all `{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b", "action": "view:public", "resourceKind": "album:object", "policyVersion": "default", "filter": {"kind": "KIND_UNSPECIFIED", "condition": {"value": null, "expression": {"operator": "string", "operands": [{ } ] }, "variable": "string" } }, "meta": {"filterDebug": "string", "matchedScope": "acme.corp.base" }, "validationErrors": [{"path": "string", "message": "string", "source": "SOURCE_UNSPECIFIED" }], "cerbosCallId": "string" }` ## [tag/CerbosService/operation/CerbosService_ServerInfo](https://docs.cerbos.dev/cerbos/0.42.0/api/_attachments/cerbos-api#tag/CerbosService/operation/CerbosService_ServerInfo) Get server information Get information about the server e.g. server version ### Responses **200** A successful response. **default** An unexpected error response. get/api/server_info https://docs.cerbos.dev/api/server_info ### Response samples - 200 - default Content type application/json Copy Expand all Collapse all `{"version": "string", "commit": "string", "buildDate": "string" }` ## [tag/CerbosAdminService](https://docs.cerbos.dev/cerbos/0.42.0/api/_attachments/cerbos-api#tag/CerbosAdminService) CerbosAdminService Cerbos administration service ## [tag/CerbosAdminService/operation/CerbosAdminService_ListAuditLogEntries](https://docs.cerbos.dev/cerbos/0.42.0/api/_attachments/cerbos-api#tag/CerbosAdminService/operation/CerbosAdminService_ListAuditLogEntries) List audit log entries ##### Authorizations: _BasicAuth_ ##### path Parameters | | | | --- | --- | | kind
required | string
Enum:"KIND_UNSPECIFIED""KIND_ACCESS""KIND_DECISION"
Kind of log entry | ##### query Parameters | | | | --- | --- | | tail | integer
Last N entries. | | between.start
required | string
Start date in ISO 8601 format. | | between.end
required | string
End date in ISO 8601 format. | | since | string
Entries since N hours/minutes ago | | lookup | string^[0123456789ABCDEFGHJKMNPQRSTVWXYZ]{26}$
By Call ID | ### Responses **200** A successful response.(streaming responses) **default** An unexpected error response. get/admin/auditlog/list/{kind} https://docs.cerbos.dev/admin/auditlog/list/{kind} ### Response samples - 200 - default Content type application/json Copy Expand all Collapse all `{"result": {"accessLogEntry": {"callId": "string", "timestamp": "2019-08-24T14:15:22Z", "peer": {"address": "string", "authInfo": "string", "userAgent": "string", "forwardedFor": "string" }, "metadata": {"property1": {"values": ["string" ]}, "property2": {"values": ["string" ]}},