Check authorization

OpenAPI protocol version: 1.0.0.

Source operation metadata · Source value schemas

Evaluate the policy allow predicate for the actor, action, and resource. A denied authorization is a successful response with allowed false, not an HTTP 403. Requires a loaded policy.

Paths are relative to your instance URL. JSON request bodies require Content-Type: application/json.

Deployment request headers

Header	Behavior
Authorization	Bearer API key for Cloud instances and Node servers configured with API keys. Node servers without API keys do not require this header.
Verdict-Read-Mode	Read mode: local (default) or authoritative. Cloud selects the writer for authoritative reads. Replicated Node servers require the writer for authoritative reads. Standalone Node servers do not interpret this header.
Verdict-Min-Revision	Opaque observed revision token for a minimum-revision read. Use a token from the same instance. Supported by Cloud and replicated Node deployments; standalone Node servers do not interpret it.
Verdict-Session-Id	Cloud replica-selection affinity identifier, 1 to 128 ASCII letters, digits, underscores, or hyphens. This is not an authentication credential. Node servers do not interpret it.
Connect-Timeout-Ms	For replicated Node reads, a positive numeric timeout in milliseconds caps the revision wait at 5000 ms; the default is 5000 ms. This is not a universal REST request deadline.

Request body

Example body

{
  "actor": {
    "type": "User",
    "id": "alice"
  },
  "action": "read",
  "resource": {
    "type": "Document",
    "id": "guide"
  }
}

Fields

actorIdentityrequired

An entity identity. Both type and id are strings.

Nested properties

typestringrequired

Entity type used by the policy.

idstringrequired

Entity identifier within its type.

actionstringrequired

resourceIdentityrequired

An entity identity. Both type and id are strings.

Nested properties

typestringrequired

Entity type used by the policy.

idstringrequired

Entity identifier within its type.

View JSON Schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "required": [
    "actor",
    "action",
    "resource"
  ],
  "properties": {
    "actor": {
      "type": "object",
      "required": [
        "type",
        "id"
      ],
      "properties": {
        "type": {
          "type": "string",
          "description": "Entity type used by the policy."
        },
        "id": {
          "type": "string",
          "description": "Entity identifier within its type."
        }
      },
      "title": "Identity",
      "additionalProperties": false,
      "description": "An entity identity. Both type and id are strings."
    },
    "action": {
      "type": "string"
    },
    "resource": {
      "type": "object",
      "required": [
        "type",
        "id"
      ],
      "properties": {
        "type": {
          "type": "string",
          "description": "Entity type used by the policy."
        },
        "id": {
          "type": "string",
          "description": "Entity identifier within its type."
        }
      },
      "title": "Identity",
      "additionalProperties": false,
      "description": "An entity identity. Both type and id are strings."
    }
  },
  "additionalProperties": false
}

Responses

See common status codes and error bodies. Success responses and operation-specific exceptions are listed here.

Status	Meaning
200	Successful response

Successful response header Verdict-Revision: Observed revision token on successful Cloud and replicated Node responses. Absent on standalone Node servers. Preserve the token unchanged for a minimum-revision read.

200 JSON body

allowedbooleanrequired

View JSON Schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "required": [
    "allowed"
  ],
  "properties": {
    "allowed": {
      "type": "boolean"
    }
  },
  "additionalProperties": false
}

Example response

{
  "allowed": true
}