Cerbos

Cerbos (latest)

CerbosService

Cerbos Policy Decision Point

Check Resources

Check a principal's permissions to a batch of heterogeneous resources and actions.

Request Body schema: application/json required


requestId	string Optional application-specific ID useful for correlating logs for analysis.
includeMeta	boolean Add request processing metadata to the response.
principal required	object (v1Principal) A person or application attempting to perform the actions on the set of resources.
resources required	Array of objects (CheckResourcesRequestResourceEntry) non-empty unique List of resources and actions.
auxData	object (cerbosRequestV1AuxData) Structured auxiliary data useful for evaluating the request
requestContext	object (v1RequestContext) Optional metadata to attach to the request. This information will be captured in the audit logs if audit logging is enabled.

Responses

200 A successful response.

default An unexpected error response.

Request samples

Payload Content type application/json

{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b",
"includeMeta": true,
"principal": {"id": "bugs_bunny",
"policyVersion": "default",
"roles": ["user"],
"attr": {"beta_tester": true},
"scope": "acme.corp"},
"resources": [{"actions": ["view","comment"],"resource": {"kind": "album:object","policyVersion": "default","id": "XX125","attr": {"owner": "bugs_bunny", "public": false, "flagged": false}}}],
"auxData": {},
"requestContext": {"annotations": {"app-name": "awesome-app","app-version": "1.2.3"}}}

Response samples

200

{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b","results":[{"resource":{"Id":"XX125","kind":"album:object"},"actions":{"view":"EFFECT_ALLOW","comment":"EFFECT_DENY"}}],"cerbosCallId":"string"}

CerbosAdminService

Cerbos administration service

List Policies

Authorizations:

BasicAuth

query Parameters


includeDisabled	boolean Include disabled policies
nameRegexp	string Filter policies by name with regexp
scopeRegexp	string Filter policies by scope with regexp
versionRegexp	string Filter policies by version with regexp
policyId	Array of strings For blob, disk, git stores use file name (.yaml). For mysql, postgres, sqlite3 use id (..) of the policy

Responses

200 A successful response.

default An unexpected error response.

Response samples

{"policyIds": ["string"]}

Inspect Policies

Authorizations:

BasicAuth

Responses

200 A successful response.

default An unexpected error response.

Response samples

{"results": {"property1": {"actions": ["string"],"variables": [{"name": "string","value": "string","kind": "KIND_UNSPECIFIED","source": "string","used": true}],"policyId": "string","derivedRoles": [{"name": "string","kind": "KIND_UNSPECIFIED","source": "string"}],"attributes": [{"kind": "KIND_UNSPECIFIED","name": "string"}],"constants": [{"name": "string","value": null,"kind": "KIND_UNSPECIFIED","source": "string","used": true}]},"property2": {...}}

Get Policy

Authorizations:

BasicAuth

query Parameters


id required	Array of strings For blob, disk, git stores use file name (.yaml). For mysql, postgres, sqlite3 use id (..) of the policy

Responses

200 A successful response.

default An unexpected error response.

Response samples

{"policies": [{"apiVersion": "string","disabled": true,"description": "string","metadata": {"sourceFile": "string","annotations": {"property1": "string","property2": "string"},"hash": "string","storeIdentifer": "string","storeIdentifier": "string","sourceAttributes": {"attributes": {"property1": null,"property2": null}}},"resourcePolicy": {"resource": "string","version": "string","importDerivedRoles": ["string"],"rules": [{"actions": ["string"],"derivedRoles": ["string"],"roles": ["string"],"condition": {"match": {"all": {"of": [null]},"any": {"of": [null]},"none": {"of": [null]},"expr": "string"},"script": "string"},"effect": "EFFECT_UNSPECIFIED","name": "string","output": {"expr": "string","when": {"ruleActivated": "string","conditionNotMet": "string"}}}],"scope": "string","schemas": {"principalSchema": {"ref": "string","ignoreWhen": {"actions": ["string"]}},"resourceSchema": {"ref": "string","ignoreWhen": {"actions": ["string"]}}},"variables": {"import": ["string"],"local": {"property1": "string","property2": "string"}},"scopePermissions": "SCOPE_PERMISSIONS_UNSPECIFIED","constants": {"import": ["string"],"local": {"property1": null,"property2": null}}},"principalPolicy": {...},"derivedRoles": {...},"exportVariables": {...},"rolePolicy": {...},"exportConstants": {...},"variables": {...},"$schema": "string"}]}

Disable Policy

Authorizations:

BasicAuth

query Parameters


id required	Array of strings Unique identifier for the policy

Responses

200 A successful response.

default An unexpected error response.

Response samples

{"disabledPolicies": 0}

Add or Update Policies

Authorizations:

BasicAuth

Request Body schema: application/json required


policies required	Array of objects (v1Policy)

Responses

200 A successful response.

default An unexpected error response.