- CerbosService
  - postCheck
  - postCheck resources
  - postCheck resource batch
  - postPlan resources
  - getGet server information
- CerbosAdminService
  - getList audit log entries
  - getList policies
  - getInspect policies
  - getGet policy
  - delDisable policy
  - postAdd or update policies
  - putAdd or update policies
  - postDelete policy
  - postDisable policy
  - putDisable policy
  - postEnable policy
  - putEnable policy
  - getGet schema
  - delDelete schema
  - postAdd or update schema
  - putAdd or update schema
  - getList schemas
  - getReload store
  - delPurge store revisions

## Cerbos (latest)

Download OpenAPI specification: [Download](blob:https://docs.cerbos.dev/d9bb93d8-386b-4807-b784-6201ec31c36f)

Cerbos: [info@cerbos.dev](mailto:info@cerbos.dev) URL: [https://cerbos.dev](/content/site-root.html)

## CerbosService CerbosService

Cerbos Policy Decision Point

## Check  Deprecated

[Deprecated: Use CheckResources API instead] Check whether a principal has permissions to perform the given actions on a set of resource instances.

##### Request Body schema: application/json  required

PDP Request

|     |     |
| --- | --- |
| requestId | string<br>Optional application-specific ID useful for correlating logs for analysis. |
| actions<br>required | Array of strings non-empty  unique <br>List of actions being performed on the set of resources. |
| principal<br>required | object (v1Principal) <br>A person or application attempting to perform the actions on the set of resources. |
| resource<br>required | object (v1ResourceSet) <br>Set of resources to check |
| includeMeta | boolean<br>Opt to receive request processing metadata in the response. |
| auxData | object (cerbosRequestV1AuxData) <br>Structured auxiliary data useful for evaluating the request |

### Responses

**200**

A successful response.

**default**

An unexpected error response.

post/api/check

### Request samples

- Payload

Content type

application/json

`{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b",

"actions": ["view:public",

"comment"],

"principal": {"id": "bugs_bunny",

"policyVersion": "default",

"roles": ["user"],

"attr": {"beta_tester": true},

"scope": "acme.corp"},

"resource": {"kind": "album:object",

"policyVersion": "default",

"instances": {"XX125": {"attr": {"owner": "bugs_bunny",

"public": false,

"flagged": false}},

"XX225": {"attr": {"owner": "daffy_duck",

"public": true,

"flagged": false}}}}},

"scope": "^(^$|\.|0(\.\w)*)$"},

"includeMeta": true,

"auxData": { }}

### Response samples

- 200
- default

Content type

application/json

`{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b",

"resourceInstances": {"XX125": {"actions": {"view:*": "EFFECT_ALLOW",

"comment": "EFFECT_ALLOW"}},

"XX225": {"actions": {"view:*": "EFFECT_DENY",

"comment": "EFFECT_DENY"}}},

"meta": {"resourceInstances": {"XX125": {"actions": {"view:*": {"matched_policy": "album:object:default"},

"comment": {"matched_policy": "album:object:default"}},

"effective_derived_roles": ["owner"]},

"XX225": {"actions": {"view:*": {"matched_policy": "album:object:default"},

"comment": {"matched_policy": "album:object:default"}}}}}}}

## Check resources

Check a principal's permissions to a batch of heterogeneous resources and actions.

##### Request Body schema: application/json  required

Check resources request

|     |     |
| --- | --- |
| requestId | string<br>Optional application-specific ID useful for correlating logs for analysis. |
| includeMeta | boolean<br>Add request processing metadata to the response. |
| principal<br>required | object (v1Principal) <br>A person or application attempting to perform the actions on the set of resources. |
| resources<br>required | Array of objects (CheckResourcesRequestResourceEntry)  non-empty  unique <br>List of resources and actions. |
| auxData | object (cerbosRequestV1AuxData) <br>Structured auxiliary data useful for evaluating the request |
| requestContext | object (v1RequestContext) <br>Optional metadata to attach to the request. This information will be captured in the audit logs if audit logging is enabled. |

### Responses

**200**

A successful response.

**default**

An unexpected error response.

post/api/check/resources

### Request samples

- Payload

Content type

application/json

`{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b",

"includeMeta": true,

"principal": {"id": "bugs_bunny",

"policyVersion": "default",

"roles": ["user"],

"attr": {"beta_tester": true},

"scope": "acme.corp"},

"resources": [{"actions": ["view",

"comment"],

"resource": {"kind": "album:object",

"policyVersion": "default",

"id": "XX125",

"attr": {"owner": "bugs_bunny",

"public": false,

"flagged": false}}}],

"auxData": {},

"requestContext": {"annotations": {"app-name": "awesome-app",

"app-version": "1.2.3"}}}

### Response samples

- 200
- default

Content type

application/json

`{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b",

"results": [{"resource": {"Id": "XX125",

"kind": "album:object"},

"actions": {"view": "EFFECT_ALLOW",

"comment": "EFFECT_DENY"}}],

"cerbosCallId": "string"}

## Get server information

Get information about the server e.g. server version

### Responses

**200**

A successful response.

**default**

An unexpected error response.

get/api/server_info

### Response samples

- 200
- default

Content type

application/json

`{"version": "string",

"commit": "string",

"buildDate": "string"}`

## CerbosAdminService

Cerbos administration service

## List audit log entries

##### Authorizations:

_BasicAuth_

##### path Parameters

|     |     |
| --- | --- |
| kind<br>required | string<br>Enum:"KIND_UNSPECIFIED""KIND_ACCESS""KIND_DECISION"<br>Kind of log entry |

##### query Parameters

|     |     |
| --- | --- |
| tail | integer <int64> <br>Last N entries. |
| between.start<br>required | string <date-time> <br>Start date in ISO 8601 format. |
| between.end<br>required | string <date-time> <br>End date in ISO 8601 format. |
| since | string<br>Entries since N hours/minutes ago |
| lookup | string^[0123456789ABCDEFGHJKMNPQRSTVWXYZ]{26}$<br>By Call ID |

### Responses

**200**

A successful response.(streaming responses)

**default**

An unexpected error response.

get/admin/auditlog/list/{kind}

### Response samples

- 200
- default

Content type

application/json

`{"result": {"accessLogEntry": {"callId": "string",

"timestamp": "2019-08-24T14:15:22Z",

"peer": {"address": "string",

"authInfo": "string",

"userAgent": "string",

"forwardedFor": "string"},

"metadata": {"property1": {"values": ["string"]},

"property2": {"values": ["string"]}},

"method": "string",

"statusCode": 0,

"oversized": true,

"policySource": {"blob": {"bucketUrl": "string",

"prefix": "string"},

"database": {"driver": "DRIVER_UNSPECIFIED"},

"disk": {"directory": "string"},

"git": {"repositoryUrl": "string",

"branch": "string",

"subdirectory": "string",

"hash": "string"},

"hub": {"label": "string",

"deploymentId": "string",

"playgroundId": "string",

"localBundle": {"path": "string",

"bundleId": "string"},

"embeddedBundle": {"ruleId": "string",

"scopes": ["string"]},

"remoteBundle": {"deploymentId": "string",

"bundleId": "string"}},

"embeddedPdp": {"url": "string",

"commitHash": "string",

"builtAt": "2019-08-24T14:15:22Z"}},

"decisionLogEntry": {"callId": "string",

"timestamp": "2019-08-24T14:15:22Z",

"peer": {"address": "string",

"authInfo": "string",

"userAgent": "string",

"forwardedFor": "string"},

"inputs": [{"requestId": "string",

"resource": {"kind": "album:photo",

"policyVersion": "default",

"id": "XX125",

"attr": {"owner": "bugs_bunny"},

"scope": "acme.corp"},

"principal": {"id": "bugs_bunny",

"policyVersion": "default",

"roles": ["user"],

"attr": {"beta_tester": true},

"scope": "acme.corp"},

"actions": ["string"],

"auxData": {"jwt": {"property1": null,

"property2": null}}}],

"outputs": [{"requestId": "string",

"resourceId": "string",

"actions": {"property1": {"effect": "EFFECT_UNSPECIFIED",

"policy": "string",

"scope": "string"},

"property2": {"effect": "EFFECT_UNSPECIFIED",

"policy": "string",

"scope": "string"}},

"effectiveDerivedRoles": ["string"],

"validationErrors": [{"path": "string",

"message": "string",

"source": "SOURCE_UNSPECIFIED"}],

"outputs": [{"src": "resource.expense.v1/acme#rule-001",

"val": "some_string",

"action": "view"}]}],

"error": "string",

"checkResources": {"inputs": [{"requestId": "string",

"resource": {"kind": "album:photo",

"policyVersion": "default",

"id": "XX125",

"attr": {"owner": "bugs_bunny"},

"scope": "acme.corp"},

"principal": {"id": "bugs_bunny",

"policyVersion": "default",

"roles": ["user"],

"attr": {"beta_tester": true},

"scope": "acme.corp"},

"actions": ["string"],

"auxData": {"jwt": {"property1": null,

"property2": null}}}],

"outputs": [{"requestId": "string",

"resourceId": "string",

"actions": {"property1": {"effect": "EFFECT_UNSPECIFIED",

"policy": "string",

"scope": "string"},

"property2": {"effect": "EFFECT_UNSPECIFIED",

"policy": "string",

"scope": "string"}},

"effectiveDerivedRoles": ["string"],

"validationErrors": [{"path": "string",

"message": "string",

"source": "SOURCE_UNSPECIFIED"}],

"outputs": [{"src": "resource.expense.v1/acme#rule-001",

"val": "some_string",

"action": "view"}]}],

"error": "string"}},

"auditTrail": {"effectivePolicies": {"property1": {"attributes": {"property1": null,

"property2": null}},

"property2": {"attributes": {"property1": null,

"property2": null}}}},

"oversized": true,

"policySource": {"blob": {"bucketUrl": "string",

"prefix": "string"},

"database": {"driver": "DRIVER_UNSPECIFIED"},

"disk": {"directory": "string"},

"git": {"repositoryUrl": "string",

"branch": "string",

"subdirectory": "string",

"hash": "string"},

"hub": {"label": "string",

"deploymentId": "string",

"playgroundId": "string",

"localBundle": {"path": "string",

"bundleId": "string"},

"embeddedBundle": {"ruleId": "string",

"scopes": ["string"]},

"remoteBundle": {"deploymentId": "string",

"bundleId": "string"}},

"embeddedPdp": {"url": "string",

"commitHash": "string",

"builtAt": "2019-08-24T14:15:22Z"}},

"requestContext": {"annotations": {"app-name": "awesome-app",

"app-version": "1.2.3"}}}

## List policies

##### Authorizations:

_BasicAuth_

### Responses

**200**

A successful response.

**default**

An unexpected error response.

get/admin/policies

### Response samples

- 200
- default

Content type

application/json

`{"policyIds": ["string"]}

## Inspect policies

##### Authorizations:

_BasicAuth_

### Responses

**200**

A successful response.

**default**

An unexpected error response.

get/admin/policies/inspect

### Response samples

- 200
- default

Content type

application/json

`{"results": {"property1": {"actions": ["string"],

"variables": [{"name": "string",

"value": "string",

"kind": "KIND_UNSPECIFIED",

"source": "string",

"used": true}],

"policyId": "string",

"derivedRoles": [{"name": "string",

"kind": "KIND_UNSPECIFIED",

"source": "string"}],

"attributes": [{"kind": "KIND_UNSPECIFIED",

"name": "string"}],

"constants": [{"name": "string",

"value": null,

"kind": "KIND_UNSPECIFIED",

"source": "string",

"used": true}]},

"property2": {"actions": ["string"],

"variables": [{"name": "string",

"value": "string",

"kind": "KIND_UNSPECIFIED",

"source": "string",

"used": true}],

"policyId": "string",

"derivedRoles": [{"name": "string",

"kind": "KIND_UNSPECIFIED",

"source": "string"}],

"attributes": [{"kind": "KIND_UNSPECIFIED",

"name": "string"}],

"constants": [{"name": "string",

"value": null,

"kind": "KIND_UNSPECIFIED",

"source": "string",

"used": true}]}}}

## Get policy

##### Authorizations:

_BasicAuth_

### Responses

**200**

A successful response.

**default**

An unexpected error response.

g 248

### Response samples

- 200
- default

Content type

application/json

`{"policies": [{"apiVersion": "string",

"disabled": true,

"description": "string",

"metadata": {"sourceFile": "string",

"annotations": {"property1": "string",

"property2": "string"},

"hash": "string",

"storeIdentifer": "string",

"storeIdentifier": "string",

"sourceAttributes": {"attributes": {"property1": null,

"property2": null}}},

"resourcePolicy": {"resource": "string",

"version": "string",

"importDerivedRoles": ["string"],

"rules": [{"actions": ["string"],

"derivedRoles": ["string"],

"roles": ["string"],

"condition": {"match": {"all": {"of": [null]},

"any": {"of": [null]},

"none": {"of": [null]},

"expr": "string"},

"script": "string"},

"effect": "EFFECT_UNSPECIFIED",

"name": "string",

"output": {"expr": "string",

"when": {"ruleActivated": "string",

"conditionNotMet": "string"}}}],

"scope": "string",

"schemas": {"principalSchema": {"ref": "string",

"ignoreWhen": {"actions": ["string"]}},

"resourceSchema": {"ref": "string",

"ignoreWhen": {"actions": ["string"]}}},

"variables": {"import": ["string"],

"local": {"property1": "string",

"property2": "string"}},

"scopePermissions": "SCOPE_PERMISSIONS_UNSPECIFIED",

"constants": {"import": ["string"],

"local": {"property1": null,

"property2": null}}},

"principalPolicy": {"principal": "string",

"version": "string",

"rules": [{"resource": "string",

"actions": [{"action": "string",

"condition": {"match": {"all": null,

"any": null,

"none": null,

"expr": null},

"script": "string"},

"effect": "EFFECT_UNSPECIFIED",

"name": "string",

"output": {"expr": "string",

"when": {"ruleActivated": null,

"conditionNotMet": null}}}]]}]},

"scope": "string",

"variables": {"import": ["string"],

"local": {"property1": "string",

"property2": "string"}},

"scopePermissions": "SCOPE_PERMISSIONS_UNSPECIFIED",

"constants": {"import": ["string"],

"local": {"property1": null,

"property2": null}}},

"derivedRoles": {"name": "string",

"definitions": [{"name": "string",

"parentRoles": ["string"]}]}],

"exportVariables": {"name": "string",

"definitions": {"property1": "string",

"property2": "string"}},

"rolePolicy": {"role": "string",

"version": "string",

"parentRoles": ["string"],

"scope": "string",

"rules": [{"resource": "string",

"allowActions": ["string"],

"condition": {"match": {"all": {"of": [null]},

"any": {"of": [null]},

"none": {"of": [null]},

"expr": "string"},

"script": "string"}}}]},

"exportConstants": {"name": "string",

"definitions": {"property1": null,

"property2": null}}}}]}

## Delete policy

##### Authorizations:

_BasicAuth_

### Responses

**200**

A successful response.

**default**

An unexpected error response.

post/admin/policy/delete

### Response samples

- 200
- default

Content type

application/json

`{"deletedPolicies": 0}`

## Disable policy

##### Authorizations:

_BasicAuth_

### Responses

**200**

A successful response.

**default**

An unexpected error response.

post/admin/policy/disable

### Response samples

- 200
- default

Content type

application/json

`{"disabledPolicies": 0}`

## Enable policy

##### Authorizations:

_BasicAuth_

### Responses

**200**

A successful response.

**default**

An unexpected error response.

post/admin/policy/enable

### Response samples

- 200
- default

Content type

application/json

`{"enabledPolicies": 0}`

## Get schema

##### Authorizations:

_BasicAuth_

### Responses

**200**

A successful response.

**default**

An unexpected error response.

get/admin/schema

### Response samples

- 200
- default

Content type

application/json

`{"schemas": [{"id": "principal.json",

"definition": {"type": "object",

"properties": {}}}]}"

## List schemas

##### Authorizations:

_BasicAuth_

### Responses

**200**

A successful response.

**default**

An unexpected error response.

get/admin/schemas

### Response samples

- 200
- default

Content type

application/json

`{"schemaIds": ["string"]}`

## Reload store

##### Authorizations:

_BasicAuth_

### Responses

**200**

A successful response.

**default**

An unexpected error response.

get/admin/store/reload

### Response samples

- 200
- default

Content type

application/json

`{}`

## Purge store revisions

##### Authorizations:

_BasicAuth_

### Responses

**200**

A successful response.

**default**

An unexpected error response.

delete/admin/store/revisions

### Response samples

- 200
- default

Content type

application/json

`{"affectedRows": 0}`