# Cerbos (latest)

## CerbosService

Cerbos Policy Decision Point

### Check Resources
Check a principal's permissions to a batch of heterogeneous resources and actions.

#### Request Body schema: application/json  required
|     |     |
| --- | --- |
| requestId | string<br>Optional application-specific ID useful for correlating logs for analysis. |
| includeMeta | boolean<br>Add request processing metadata to the response. |
| principal<br>required | object (v1Principal) <br>A person or application attempting to perform the actions on the set of resources. |
| resources<br>required | Array of objects (CheckResourcesRequestResourceEntry)  non-empty  unique <br>List of resources and actions. |
| auxData | object (cerbosRequestV1AuxData) <br>Structured auxiliary data useful for evaluating the request |
| requestContext | object (v1RequestContext) <br>Optional metadata to attach to the request. This information will be captured in the audit logs if audit logging is enabled. |

### Responses

**200**
A successful response.

**default**
An unexpected error response.

### Request samples
- Payload
Content type
application/json
```json
{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b",
"includeMeta": true,
"principal": {"id": "bugs_bunny",
"policyVersion": "default",
"roles": ["user"],
"attr": {"beta_tester": true},
"scope": "acme.corp"},
"resources": [{"actions": ["view","comment"],"resource": {"kind": "album:object","policyVersion": "default","id": "XX125","attr": {"owner": "bugs_bunny", "public": false, "flagged": false}}}],
"auxData": {},
"requestContext": {"annotations": {"app-name": "awesome-app","app-version": "1.2.3"}}}
```

### Response samples
**200**
```json
{"requestId": "c2db17b8-4f9f-4fb1-acfd-9162a02be42b","results":[{"resource":{"Id":"XX125","kind":"album:object"},"actions":{"view":"EFFECT_ALLOW","comment":"EFFECT_DENY"}}],"cerbosCallId":"string"}
```

## CerbosAdminService

Cerbos administration service

### List Policies
##### Authorizations:
_BasicAuth_

##### query Parameters
|     |     |
| --- | --- |
| includeDisabled | boolean<br>Include disabled policies |
| nameRegexp | string<br>Filter policies by name with regexp |
| scopeRegexp | string<br>Filter policies by scope with regexp |
| versionRegexp | string<br>Filter policies by version with regexp |
| policyId | Array of strings<br>For blob, disk, git stores use file name (.yaml). For mysql, postgres, sqlite3 use id (..) of the policy |

### Responses
**200**
A successful response.

**default**
An unexpected error response.

### Response samples
- 200
```json
{"policyIds": ["string"]}
```

### Inspect Policies
##### Authorizations:
_BasicAuth_

### Responses
**200**
A successful response.

**default**
An unexpected error response.

### Response samples
- 200
```json
{"results": {"property1": {"actions": ["string"],"variables": [{"name": "string","value": "string","kind": "KIND_UNSPECIFIED","source": "string","used": true}],"policyId": "string","derivedRoles": [{"name": "string","kind": "KIND_UNSPECIFIED","source": "string"}],"attributes": [{"kind": "KIND_UNSPECIFIED","name": "string"}],"constants": [{"name": "string","value": null,"kind": "KIND_UNSPECIFIED","source": "string","used": true}]},"property2": {...}}
```

### Get Policy
##### Authorizations:
_BasicAuth_

##### query Parameters
|     |     |
| --- | --- |
| id<br>required | Array of strings<br>For blob, disk, git stores use file name (.yaml). For mysql, postgres, sqlite3 use id (..) of the policy |

### Responses
**200**
A successful response.

**default**
An unexpected error response.

### Response samples
- 200
```json
{"policies": [{"apiVersion": "string","disabled": true,"description": "string","metadata": {"sourceFile": "string","annotations": {"property1": "string","property2": "string"},"hash": "string","storeIdentifer": "string","storeIdentifier": "string","sourceAttributes": {"attributes": {"property1": null,"property2": null}}},"resourcePolicy": {"resource": "string","version": "string","importDerivedRoles": ["string"],"rules": [{"actions": ["string"],"derivedRoles": ["string"],"roles": ["string"],"condition": {"match": {"all": {"of": [null]},"any": {"of": [null]},"none": {"of": [null]},"expr": "string"},"script": "string"},"effect": "EFFECT_UNSPECIFIED","name": "string","output": {"expr": "string","when": {"ruleActivated": "string","conditionNotMet": "string"}}}],"scope": "string","schemas": {"principalSchema": {"ref": "string","ignoreWhen": {"actions": ["string"]}},"resourceSchema": {"ref": "string","ignoreWhen": {"actions": ["string"]}}},"variables": {"import": ["string"],"local": {"property1": "string","property2": "string"}},"scopePermissions": "SCOPE_PERMISSIONS_UNSPECIFIED","constants": {"import": ["string"],"local": {"property1": null,"property2": null}}},"principalPolicy": {...},"derivedRoles": {...},"exportVariables": {...},"rolePolicy": {...},"exportConstants": {...},"variables": {...},"$schema": "string"}]}
```

### Disable Policy
##### Authorizations:
_BasicAuth_

##### query Parameters
|     |     |
| --- | --- |
| id<br>required | Array of strings<br>Unique identifier for the policy |

### Responses
**200**
A successful response.

**default**
An unexpected error response.

### Response samples
- 200
```json
{"disabledPolicies": 0}
```

### Add or Update Policies
##### Authorizations:
_BasicAuth_

##### Request Body schema: application/json  required
|     |     |
| --- | --- |
| policies<br>required | Array of objects (v1Policy)

### Responses
**200**
A successful response.

**default**
An unexpected error response.