Cerbos
- CerbosService
- postCheck
- postCheck resources
- postCheck resource batch
- postPlan resources
- getGet server information
- CerbosAdminService
- getList audit log entries
- getList policies
- getInspect policies
- getGet policy
- delDisable policy
- postAdd or update policies
- putAdd or update policies
- postDelete policy
- postDisable policy
- putDisable policy
- postEnable policy
- putEnable policy
- getGet schema
- delDelete schema
- postAdd or update schema
- putAdd or update schema
- getList schemas
- getReload store
- delPurge store revisions
Cerbos (latest)
Download OpenAPI specification: Download
Cerbos: info@cerbos.dev URL: https://cerbos.dev
CerbosService CerbosService
Cerbos Policy Decision Point
Check Deprecated
[Deprecated: Use CheckResources API instead] Check whether a principal has permissions to perform the given actions on a set of resource instances.
Request Body schema: application/json required
PDP Request
| requestId | string Optional application-specific ID useful for correlating logs for analysis. |
| actions required |
Array of strings non-empty unique List of actions being performed on the set of resources. |
| principal required |
object (v1Principal) A person or application attempting to perform the actions on the set of resources. |
| resource required |
object (v1ResourceSet) Set of resources to check |
| includeMeta | boolean Opt to receive request processing metadata in the response. |
| auxData | object (cerbosRequestV1AuxData) Structured auxiliary data useful for evaluating the request |
Responses
200
A successful response.
default
An unexpected error response.
post/api/check
Request samples
- Payload
Content type
application/json
`{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b",
"actions": ["view:public",
"comment"],
"principal": {"id": "bugs_bunny",
"policyVersion": "default",
"roles": ["user"],
"attr": {"beta_tester": true},
"scope": "acme.corp"},
"resource": {"kind": "album:object",
"policyVersion": "default",
"instances": {"XX125": {"attr": {"owner": "bugs_bunny",
"public": false,
"flagged": false}},
"XX225": {"attr": {"owner": "daffy_duck",
"public": true,
"flagged": false}}}}},
"scope": "^(^$|.|0(.\w)*)$"},
"includeMeta": true,
"auxData": { }}
Response samples
- 200
- default
Content type
application/json
`{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b",
"resourceInstances": {"XX125": {"actions": {"view:*": "EFFECT_ALLOW",
"comment": "EFFECT_ALLOW"}},
"XX225": {"actions": {"view:*": "EFFECT_DENY",
"comment": "EFFECT_DENY"}}},
"meta": {"resourceInstances": {"XX125": {"actions": {"view:*": {"matched_policy": "album:object:default"},
"comment": {"matched_policy": "album:object:default"}},
"effective_derived_roles": ["owner"]},
"XX225": {"actions": {"view:*": {"matched_policy": "album:object:default"},
"comment": {"matched_policy": "album:object:default"}}}}}}}
Check resources
Check a principal's permissions to a batch of heterogeneous resources and actions.
Request Body schema: application/json required
Check resources request
| requestId | string Optional application-specific ID useful for correlating logs for analysis. |
| includeMeta | boolean Add request processing metadata to the response. |
| principal required |
object (v1Principal) A person or application attempting to perform the actions on the set of resources. |
| resources required |
Array of objects (CheckResourcesRequestResourceEntry) non-empty unique List of resources and actions. |
| auxData | object (cerbosRequestV1AuxData) Structured auxiliary data useful for evaluating the request |
| requestContext | object (v1RequestContext) Optional metadata to attach to the request. This information will be captured in the audit logs if audit logging is enabled. |
Responses
200
A successful response.
default
An unexpected error response.
post/api/check/resources
Request samples
- Payload
Content type
application/json
`{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b",
"includeMeta": true,
"principal": {"id": "bugs_bunny",
"policyVersion": "default",
"roles": ["user"],
"attr": {"beta_tester": true},
"scope": "acme.corp"},
"resources": [{"actions": ["view",
"comment"],
"resource": {"kind": "album:object",
"policyVersion": "default",
"id": "XX125",
"attr": {"owner": "bugs_bunny",
"public": false,
"flagged": false}}}],
"auxData": {},
"requestContext": {"annotations": {"app-name": "awesome-app",
"app-version": "1.2.3"}}}
Response samples
- 200
- default
Content type
application/json
`{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b",
"results": [{"resource": {"Id": "XX125",
"kind": "album:object"},
"actions": {"view": "EFFECT_ALLOW",
"comment": "EFFECT_DENY"}}],
"cerbosCallId": "string"}
Get server information
Get information about the server e.g. server version
Responses
200
A successful response.
default
An unexpected error response.
get/api/server_info
Response samples
- 200
- default
Content type
application/json
`{"version": "string",
"commit": "string",
"buildDate": "string"}`
CerbosAdminService
Cerbos administration service
List audit log entries
Authorizations:
BasicAuth
path Parameters
| kind required |
string Enum:"KIND_UNSPECIFIED""KIND_ACCESS""KIND_DECISION" Kind of log entry |
query Parameters
| tail | integer Last N entries. |
| between.start required |
string Start date in ISO 8601 format. |
| between.end required |
string End date in ISO 8601 format. |
| since | string Entries since N hours/minutes ago |
| lookup | string^[0123456789ABCDEFGHJKMNPQRSTVWXYZ]{26}$ By Call ID |
Responses
200
A successful response.(streaming responses)
default
An unexpected error response.
get/admin/auditlog/list/{kind}
Response samples
- 200
- default
Content type
application/json
`{"result": {"accessLogEntry": {"callId": "string",
"timestamp": "2019-08-24T14:15:22Z",
"peer": {"address": "string",
"authInfo": "string",
"userAgent": "string",
"forwardedFor": "string"},
"metadata": {"property1": {"values": ["string"]},
"property2": {"values": ["string"]}},
"method": "string",
"statusCode": 0,
"oversized": true,
"policySource": {"blob": {"bucketUrl": "string",
"prefix": "string"},
"database": {"driver": "DRIVER_UNSPECIFIED"},
"disk": {"directory": "string"},
"git": {"repositoryUrl": "string",
"branch": "string",
"subdirectory": "string",
"hash": "string"},
"hub": {"label": "string",
"deploymentId": "string",
"playgroundId": "string",
"localBundle": {"path": "string",
"bundleId": "string"},
"embeddedBundle": {"ruleId": "string",
"scopes": ["string"]},
"remoteBundle": {"deploymentId": "string",
"bundleId": "string"}},
"embeddedPdp": {"url": "string",
"commitHash": "string",
"builtAt": "2019-08-24T14:15:22Z"}},
"decisionLogEntry": {"callId": "string",
"timestamp": "2019-08-24T14:15:22Z",
"peer": {"address": "string",
"authInfo": "string",
"userAgent": "string",
"forwardedFor": "string"},
"inputs": [{"requestId": "string",
"resource": {"kind": "album:photo",
"policyVersion": "default",
"id": "XX125",
"attr": {"owner": "bugs_bunny"},
"scope": "acme.corp"},
"principal": {"id": "bugs_bunny",
"policyVersion": "default",
"roles": ["user"],
"attr": {"beta_tester": true},
"scope": "acme.corp"},
"actions": ["string"],
"auxData": {"jwt": {"property1": null,
"property2": null}}}],
"outputs": [{"requestId": "string",
"resourceId": "string",
"actions": {"property1": {"effect": "EFFECT_UNSPECIFIED",
"policy": "string",
"scope": "string"},
"property2": {"effect": "EFFECT_UNSPECIFIED",
"policy": "string",
"scope": "string"}},
"effectiveDerivedRoles": ["string"],
"validationErrors": [{"path": "string",
"message": "string",
"source": "SOURCE_UNSPECIFIED"}],
"outputs": [{"src": "resource.expense.v1/acme#rule-001",
"val": "some_string",
"action": "view"}]}],
"error": "string",
"checkResources": {"inputs": [{"requestId": "string",
"resource": {"kind": "album:photo",
"policyVersion": "default",
"id": "XX125",
"attr": {"owner": "bugs_bunny"},
"scope": "acme.corp"},
"principal": {"id": "bugs_bunny",
"policyVersion": "default",
"roles": ["user"],
"attr": {"beta_tester": true},
"scope": "acme.corp"},
"actions": ["string"],
"auxData": {"jwt": {"property1": null,
"property2": null}}}],
"outputs": [{"requestId": "string",
"resourceId": "string",
"actions": {"property1": {"effect": "EFFECT_UNSPECIFIED",
"policy": "string",
"scope": "string"},
"property2": {"effect": "EFFECT_UNSPECIFIED",
"policy": "string",
"scope": "string"}},
"effectiveDerivedRoles": ["string"],
"validationErrors": [{"path": "string",
"message": "string",
"source": "SOURCE_UNSPECIFIED"}],
"outputs": [{"src": "resource.expense.v1/acme#rule-001",
"val": "some_string",
"action": "view"}]}],
"error": "string"}},
"auditTrail": {"effectivePolicies": {"property1": {"attributes": {"property1": null,
"property2": null}},
"property2": {"attributes": {"property1": null,
"property2": null}}}},
"oversized": true,
"policySource": {"blob": {"bucketUrl": "string",
"prefix": "string"},
"database": {"driver": "DRIVER_UNSPECIFIED"},
"disk": {"directory": "string"},
"git": {"repositoryUrl": "string",
"branch": "string",
"subdirectory": "string",
"hash": "string"},
"hub": {"label": "string",
"deploymentId": "string",
"playgroundId": "string",
"localBundle": {"path": "string",
"bundleId": "string"},
"embeddedBundle": {"ruleId": "string",
"scopes": ["string"]},
"remoteBundle": {"deploymentId": "string",
"bundleId": "string"}},
"embeddedPdp": {"url": "string",
"commitHash": "string",
"builtAt": "2019-08-24T14:15:22Z"}},
"requestContext": {"annotations": {"app-name": "awesome-app",
"app-version": "1.2.3"}}}
List policies
Authorizations:
BasicAuth
Responses
200
A successful response.
default
An unexpected error response.
get/admin/policies
Response samples
- 200
- default
Content type
application/json
`{"policyIds": ["string"]}
Inspect policies
Authorizations:
BasicAuth
Responses
200
A successful response.
default
An unexpected error response.
get/admin/policies/inspect
Response samples
- 200
- default
Content type
application/json
`{"results": {"property1": {"actions": ["string"],
"variables": [{"name": "string",
"value": "string",
"kind": "KIND_UNSPECIFIED",
"source": "string",
"used": true}],
"policyId": "string",
"derivedRoles": [{"name": "string",
"kind": "KIND_UNSPECIFIED",
"source": "string"}],
"attributes": [{"kind": "KIND_UNSPECIFIED",
"name": "string"}],
"constants": [{"name": "string",
"value": null,
"kind": "KIND_UNSPECIFIED",
"source": "string",
"used": true}]},
"property2": {"actions": ["string"],
"variables": [{"name": "string",
"value": "string",
"kind": "KIND_UNSPECIFIED",
"source": "string",
"used": true}],
"policyId": "string",
"derivedRoles": [{"name": "string",
"kind": "KIND_UNSPECIFIED",
"source": "string"}],
"attributes": [{"kind": "KIND_UNSPECIFIED",
"name": "string"}],
"constants": [{"name": "string",
"value": null,
"kind": "KIND_UNSPECIFIED",
"source": "string",
"used": true}]}}}
Get policy
Authorizations:
BasicAuth
Responses
200
A successful response.
default
An unexpected error response.
g 248
Response samples
- 200
- default
Content type
application/json
`{"policies": [{"apiVersion": "string",
"disabled": true,
"description": "string",
"metadata": {"sourceFile": "string",
"annotations": {"property1": "string",
"property2": "string"},
"hash": "string",
"storeIdentifer": "string",
"storeIdentifier": "string",
"sourceAttributes": {"attributes": {"property1": null,
"property2": null}}},
"resourcePolicy": {"resource": "string",
"version": "string",
"importDerivedRoles": ["string"],
"rules": [{"actions": ["string"],
"derivedRoles": ["string"],
"roles": ["string"],
"condition": {"match": {"all": {"of": [null]},
"any": {"of": [null]},
"none": {"of": [null]},
"expr": "string"},
"script": "string"},
"effect": "EFFECT_UNSPECIFIED",
"name": "string",
"output": {"expr": "string",
"when": {"ruleActivated": "string",
"conditionNotMet": "string"}}}],
"scope": "string",
"schemas": {"principalSchema": {"ref": "string",
"ignoreWhen": {"actions": ["string"]}},
"resourceSchema": {"ref": "string",
"ignoreWhen": {"actions": ["string"]}}},
"variables": {"import": ["string"],
"local": {"property1": "string",
"property2": "string"}},
"scopePermissions": "SCOPE_PERMISSIONS_UNSPECIFIED",
"constants": {"import": ["string"],
"local": {"property1": null,
"property2": null}}},
"principalPolicy": {"principal": "string",
"version": "string",
"rules": [{"resource": "string",
"actions": [{"action": "string",
"condition": {"match": {"all": null,
"any": null,
"none": null,
"expr": null},
"script": "string"},
"effect": "EFFECT_UNSPECIFIED",
"name": "string",
"output": {"expr": "string",
"when": {"ruleActivated": null,
"conditionNotMet": null}}}]]}]},
"scope": "string",
"variables": {"import": ["string"],
"local": {"property1": "string",
"property2": "string"}},
"scopePermissions": "SCOPE_PERMISSIONS_UNSPECIFIED",
"constants": {"import": ["string"],
"local": {"property1": null,
"property2": null}}},
"derivedRoles": {"name": "string",
"definitions": [{"name": "string",
"parentRoles": ["string"]}]}],
"exportVariables": {"name": "string",
"definitions": {"property1": "string",
"property2": "string"}},
"rolePolicy": {"role": "string",
"version": "string",
"parentRoles": ["string"],
"scope": "string",
"rules": [{"resource": "string",
"allowActions": ["string"],
"condition": {"match": {"all": {"of": [null]},
"any": {"of": [null]},
"none": {"of": [null]},
"expr": "string"},
"script": "string"}}}]},
"exportConstants": {"name": "string",
"definitions": {"property1": null,
"property2": null}}}}]}
Delete policy
Authorizations:
BasicAuth
Responses
200
A successful response.
default
An unexpected error response.
post/admin/policy/delete
Response samples
- 200
- default
Content type
application/json
{"deletedPolicies": 0}
Disable policy
Authorizations:
BasicAuth
Responses
200
A successful response.
default
An unexpected error response.
post/admin/policy/disable
Response samples
- 200
- default
Content type
application/json
{"disabledPolicies": 0}
Enable policy
Authorizations:
BasicAuth
Responses
200
A successful response.
default
An unexpected error response.
post/admin/policy/enable
Response samples
- 200
- default
Content type
application/json
{"enabledPolicies": 0}
Get schema
Authorizations:
BasicAuth
Responses
200
A successful response.
default
An unexpected error response.
get/admin/schema
Response samples
- 200
- default
Content type
application/json
`{"schemas": [{"id": "principal.json",
"definition": {"type": "object",
"properties": {}}}]}"
List schemas
Authorizations:
BasicAuth
Responses
200
A successful response.
default
An unexpected error response.
get/admin/schemas
Response samples
- 200
- default
Content type
application/json
{"schemaIds": ["string"]}
Reload store
Authorizations:
BasicAuth
Responses
200
A successful response.
default
An unexpected error response.
get/admin/store/reload
Response samples
- 200
- default
Content type
application/json
{}
Purge store revisions
Authorizations:
BasicAuth
Responses
200
A successful response.
default
An unexpected error response.
delete/admin/store/revisions
Response samples
- 200
- default
Content type
application/json
{"affectedRows": 0}