Cerbos (latest)

CerbosService

Cerbos Policy Decision Point

Operations

• postCheck
• postCheck resources
• postCheck resource batch
• postPlan resources
• getGet server information

CerbosAdminService

Cerbos administration service

Operations

• getList audit log entries
• getList policies
• getInspect policies
• getGet policy
• delDisable policy
• postAdd or update policies
• putAdd or update policies
• postDisable policy
• putDisable policy
• postEnable policy
• putEnable policy
• getGet schema
• delDelete schema
• postAdd or update schema
• putAdd or update schema
• getList schemas
• getReload store

Request Samples

Check Resources

{
  "requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b",
  "includeMeta": true,
  "principal": {
    "id": "bugs_bunny",
    "policyVersion": "default",
    "roles": ["user"],
    "attr": {"beta_tester": true},
    "scope": "acme.corp"
  },
  "resources": [
    {
      "actions": ["view", "comment"],
      "resource": {
        "kind": "album:object",
        "policyVersion": "default",
        "id": "XX125",
        "attr": {
          "owner": "bugs_bunny",
          "public": false,
          "flagged": false
        }
      }
    }
  ],
  "auxData": {
    "jwt": {
      "token": "eyJhbGciOiJFUzM4NCIsImtpZCI6IjE5TGZaYXRFZGc4M1lOYzVyMjNndU1KcXJuND0iLCJ0eXAiOiJKV1QifQ...",
      "keySetId": "my-keyset"
    }
  }
}

Response Samples

Example Response

{
  "requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b",
  "results": [
    {
      "resource": {"Id": "XX125", "kind": "album:object"},
      "actions": {"view": "EFFECT_ALLOW", "comment": "EFFECT_DENY"}
    }
  ],
  "cerbosCallId": "string"
}

List Audit Log Entries

Authorizations: BasicAuth

Path Parameters

| Kind (required) | string (Enum: "KIND_UNSPECIFIED", "KIND_ACCESS", "KIND_DECISION") |

Query Parameters

| tail | integer
Last N entries. | | between.start (required) | string
Start date in ISO 8601 format. | | between.end (required) | string
End date in ISO 8601 format. | | since | string
Entries since N hours/minutes ago | | lookup | string
By Call ID |

{
  "result": {
    "accessLogEntry": {
      "callId": "string",
      "timestamp": "2019-08-24T14:15:22Z",
      "peer": {
        "address": "string",
        "authInfo": "string",
        "userAgent": "string",
        "forwardedFor": "string"
      },
      "metadata": {
        "property1": {"values": ["string"]},
        "property2": {"values": ["string"]}
      },
      "method": "string",
      "statusCode": 0,
      "oversized": true
    },
    "decisionLogEntry": {...}
  }
}

Get Schema

Authorizations: BasicAuth

Query Parameters

| id (required) | Array of strings
Unique identifier for the schema |

Response Samples

{
  "schemas": [{
    "id": "principal.json",
    "definition": {
      "type": "object",
      "properties": {}
    }
  }]
}