Cerbos (latest)

CerbosService

Overview

Cerbos Policy Decision Point.

Operations

• postCheck
  Check whether a principal has permissions to perform the given actions on a set of resource instances.

  • Request Body schema: application/json required

    Field	Description
    requestId	Optional application-specific ID useful for correlating logs for analysis.
    actions	Array of strings non-empty unique. List of actions being performed on the set of resources.
    principal	object (v1Principal) A person or application attempting to perform the actions on the set of resources.
    resource	object (v1ResourceSet) Set of resources to check.
    includeMeta	boolean Opt to receive request processing metadata in the response.
    auxData	object (cerbosRequestV1AuxData) Structured auxiliary data useful for evaluating the request.

Responses

• 200
  A successful response.
• default
  An unexpected error response.

API Reference

• POST /api/check

Request Samples

• Payload

{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b",
 "actions": ["view:public", "comment"],
 "principal": {"id": "bugs_bunny",
 "policyVersion": "default",
 "roles": ["user"],
 "attr": {"beta_tester": true},
 "scope": "acme.corp"},
 "resource": {"kind": "album:object",
 "policyVersion": "default",
 "instances": {"XX125": {"attr": {"owner": "bugs_bunny", "public": false, "flagged": false}},
 "XX225": {"attr": {"owner": "daffy_duck", "public": true, "flagged": false}}}},
 "includeMeta": true,
 "auxData": {}}

CerbosAdminService

Overview

Cerbos administration service.

Operations

• getList audit log entries
• getList policies
• getInspect policies
• getGet policy
• delDisable policy
• postAdd or update policies
• putAdd or update policies
• postDelete policy
• postDisable policy
• putDisable policy
• postEnable policy
• putEnable policy
• getGet schema
• delDelete schema
• postAdd or update schema
• putAdd or update schema
• getList schemas
• getReload store
• delPurge store revisions

Request Samples

List policies

GET /admin/policies

• Query Parameters
  • includeDisabled: boolean, Include disabled policies
  • nameRegexp: string, Filter policies by name with regexp
  • scopeRegexp: string, Filter policies by scope with regexp
  • versionRegexp: string, Filter policies by version with regexp
  • policyId: Array of strings,

Response Sample

{"policyIds": ["string"]}

Add or Update Policies

POST /admin/policy

• Payload:

{"policies": [{"apiVersion": "string",
"disabled": true,
"description": "string",
"metadata": {"sourceFile": "string",
"annotations": {"property1": "string",
"property2": "string"},
"hash": "string",
"storeIdentifer": "string",
"storeIdentifier": "string",
"sourceAttributes": {"attributes": {"property1": null,
"property2": null}}},
"resourcePolicy": {"resource": "string",
"version": "string",
"importDerivedRoles": ["string"],
"rules": [{"actions": ["string"],
"derivedRoles": ["string"],
"roles": ["string"],
"condition": {"match": {"all": {"of": [null]},
"any": {"of": [null]},
"none": {"of": [null]},
"expr": "string"},
"script": "string"},
"effect": "EFFECT_UNSPECIFIED",
"name": "string",
"output": {"expr": "string",
"when": {"ruleActivated": "string",
"conditionNotMet": "string"}}}]},
"scope": "string",
"schemas": {"principalSchema": {"ref": "string",
"ignoreWhen": {"actions": ["string"]}},
"resourceSchema": {"ref": "string",
"ignoreWhen": {"actions": ["string"]}}},
"variables": {"import": ["string"],
"local": {"property1": "string",
"property2": "string"}},
"scopePermissions": "SCOPE_PERMISSIONS_UNSPECIFIED",
"constants": {"import": ["string"],
"local": {"property1": null,
"property2": null}}}]}