Policy Resolution

03 May 2024
4 Minutes to read

Print
Dark
Light
PDF

Policy Resolution

Updated on 03 May 2024
4 Minutes to read

Print
Dark
Light
PDF

Article Summary

Share feedback

Thanks for sharing your feedback!

Post

/api/runtime/resolution/v3

The Policy Resolution API enables you to create your own enforcement points when need to support access to large amounts of data (SQL, search engines, big data, etc.) or enforcement need to be done by another system/platform. It is designed to answer questions like: "What access filters need to be set up for a specific user to access an asset?". The response is expected to show the logical filtering of data and/or the list of allowed data items for the user.

Notice

When accessing the Authorization APIs, the URL base/prefix, according to your PlainID PDP Location

United States Cloud PDP - `https://tenant-name.us1.plainid.io`

Canadian Cloud PDP - `https://tenant-name.ca1.plainid.io`

European Cloud PDP - `https://tenant-name.eu1.plainid.io`

Local PAA - `https://your-paa.acme.local`

For more information on which Asset Types to use with your PAA or Cloud PDP, refer to Managing Asset Types.

Body parameters

Policy Resolution

{
  "entityId": "string",
  "clientId": "string",
  "clientSecret": "string",
  "entityTypeId": "string",
  "assetList": {
    "type": [
      {
        "template": "string",
        "path": "string",
        "assetAttributes": {
          "attribute_1": [
            "string"
          ],
          "attribute_2": [
            "string"
          ]
        }
      }
    ]
  },
  "entityAttributes": [
    "string"
  ],
  "contextData": {
    "string": [
      "string"
    ]
  },
  "environment": {
    "string": [
      "string"
    ]
  },
  "remoteIp": "string",
  "timeZoneOffset": 0.0,
  "resourceTypes": {
    "name": "string",
    "attributeList": "-string"
  },
  "includeContext": false,
  "includeAccessPolicy": false,
  "includeAccessPolicyId": false,
  "includeAssetAttributes": false,
  "includeIdentity": false,
  "accessTokenFormat": "string",
  "useCache": false
}

Expand All

object

entityId

string Required

Unique identifier of the Identity

Min length1

clientId

string Required

Client ID of the Scope

Min length1

clientSecret

string Required

Client Secret ID of the Scope

Min length1

entityTypeId

string

Identity Template ID

Min length1

entityAttributes

Array

List of Identity Attributes and their values.

If not defined, Dynamic groups based on virtual attriutes will not be considered in the Access Decision.

contextData

object

Identity Context data for this request. When specifying this parameter, you are requesting information based on a specific parameter and its value.

For example, Location where the contextData equals a specific branch.

If not defined, Dynamic groups based on context data will not be considered in the Access Decision.

string

Array

Attributes and their values used in Advanced Conditions or Request Parameters used In Asset Rules.

environment

object

Environmental parameters need to be defined in policies as request. (in asset rules or conditions) and also sent in the authorization request. Only the assets that match what will be sent in the request will come back.

If not defined, parametes based on emviromental data will not be considered in the Access Decision.

string

Array

remoteIp

string

IP address to be used when validating a policy. Ensure that your IP Ranges are correct based on an IP calculator. If not defined, the IP considered in the calculation is taken from the X-Forwarded-For (Request header).

timeZoneOffset

number

To define the offset from UTC time zone. Used in Time Condition.

assetList

object

Contains a list of the Asset's unique identifier and attributes:

template

string

Asset Template ID

path

string

Asset Unique Identifier

assetAttributes

object

attribute_1

Array of string

string

attribute_2

Array of string

string

resourceTypes

Array of object

Because the full payload of the response can be very large, this parameter enables you to decrease the payload size by including a list of Asset Types and their attributes, that will return in the response.

If not specified, all resources from all resource types will be included.

object

name

string Required

attributeList

Array of string Required

string

includeContext

boolean

Show/hide the context data in the response.

Default"False"

includeAccessPolicy

boolean

Show/hide the name of the Policy in the response that has granted the specified access.

Default"False"

includeAccessPolicyId

boolean

Show/hide the external id of the Policy in the response that granted the specified access.

Default"False"

includeAssetAttributes

boolean

Show/hide the asset attribute of the assets in the response.

Default"False"

includeIdentity

boolean

Show/hide the identity attribute of the identity in the response.

Default"False"

accessTokenFormat

string

Determines the format of the response – whether JSON or JWT.

useCache

boolean

The attribute will determine if the response will consider the cache settings or override the cache and preforming full calculation.

Default"True"

combinedMultiValue

boolean

Determines the evaluation of Identity Attributes relationship in access decision.

Default"False"

assetContext

Array of object (assetContextRequestItem)

object

key

string

An auto-generated key to set the correlation between the requested object and the response object (optional). When working with a single assetContext object, use the “singleObjectResponse” value to align to the original structure response.

resourceType

string Required

path

string

action

string

assetAttributes

object

attribute_1

Array of string

string

attribute_2

Array of string

string

operationalFilters

Array of object

These operational filters should affect the Runtime behavior and results by applying additional filtering which is not directly related to Authorization logic.

object

OneOf

identitySourcesFilterByIDs

filterType

string Required

filterProperties

object

filterAction

string Required

Valid values[ "\"INCLUDE\"", "\"EXCLUDE\"" ]

objectsList

Array of string Required

string

Input your sourceID/s here. For information on where to locate the sourceID, check out Managing Attribute Sources in our documentation.

Responses

200

Policy-Resolution-200

{
  "tokenValidity": 0,
  "response": [
    {
      "access": [],
      "privileges": {
        "allowed": [
          {
            "resourceType": "Accounts",
            "actions": [
              {
                "action": "Access",
                "asset-attributes-filter": {
                  "OR": [
                    {
                      "OR": [
                        {
                          "AND": [
                            {
                              "attribute": "location",
                              "type": "STRING",
                              "operator": "EQUALS",
                              "values": [
                                "Alabama"
                              ],
                              "match": "any"
                            }
                          ]
                        }
                      ]
                    }
                  ]
                }
              }
            ]
          }
        ],
        "denied": []
      }
    }
  ]
}

Expand All

AnyOf

resolutionResponse

tokenValidity

integer

response

Array of object

object

access

Array of object

object

path

string

attributes

object

attribute_1

attribute_2

resourceType

string

actions

Array of object

object

action

string

permission

string

permissionId

string

contextData

object

attribute

Array of string

string

privileges

object

allowed

Array of object

object

resourceType

string

actions

Array of object

object

action

string

asset-attributes-filter

object

Array of object

object

Array of object

object

AND

Array of object

object

attribute

string

type

string

operator

string

values

Array of string

string

match

string

assetContextResolutionResponse

data

Array of object

object

assetContext

object (assetContextResponseItem)

AnyOf

object

key

string

object

resourceType

string

path

string

action

string

assetAttributes

object

attribute_1

Array of string

string

attribute_2

Array of string

string

output

object

accessResponse

object (resolutionResponse)

tokenValidity

integer

response

Array of object

object

access

Array of object

object

path

string

attributes

object

attribute_1

attribute_2

resourceType

string

actions

Array of object

object

action

string

permission

string

permissionId

string

contextData

object

attribute

Array of string

string

privileges

object

allowed

Array of object

object

resourceType

string

actions

Array of object

object

action

string

asset-attributes-filter

object

Array of object

object

Array of object

object

AND

Array of object

object

attribute

string

type

string

operator

string

values

Array of string

string

match

string

error

string

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

500

Internal Server Error

501

Not Implemented

Was this article helpful?

What's Next

Policy Resolution