--- title: "Policy Resolution" slug: "policy-resolution" updated: 2026-03-22T16:44:41Z published: 2026-03-22T16:44:41Z stale: true --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.plainid.io/llms.txt > Use this file to discover all available pages before exploring further. # Policy Resolution Post/api/runtime/resolution/v3 The Policy Resolution API enables you to create your own enforcement points when need to support access to large amounts of data (SQL, search engines, big data, etc.) or enforcement need to be done by another system/platform. It is designed to answer questions like: "What access filters need to be set up for a specific user to access an asset?". The response is expected to show the logical filtering of data and/or the list of allowed data items for the user. ### Notice When accessing the Authorization APIs, the URL base/prefix, according to your PlainID PDP Location**United States Cloud PDP** - `https://tenant-name.us1.plainid.io`**Canadian Cloud PDP** - `https://tenant-name.ca1.plainid.io`**European Cloud PDP** - `https://tenant-name.eu1.plainid.io`**Local PAA** - `https://your-paa.acme.local` For more information on which Asset Types to use with your PAA or Cloud PDP, refer to [Managing Asset Types](https://docs.plainid.io/docs/managing-asset-types). ### Important note about headers Refer to the headers below to modify your cURL sample. Check if the following headers are in the sample, if not, ensure you add it to your cURL sample before pasting into your API tool. ### Headers *Required | Header | Value | cURL Line | | --- | --- | --- | | Accept | `application/json` | `'accept: application/json'` | | Content-Type | `application/json` | `'content-type: application/json'` | ### cURL Sample Guidelines In order for the relevant parameters to appear in the cURL sample, you can input the values in the interactive API console on the right under the Try It\* or the Code Sample tabs. They will then appear in the cURL sample in the correct format to use in your API tool. *\*Try It function coming soon.* Header parametersX-Client-Idstring Client ID of the Scope The clientId is **required**, ensure that it is defined either in the header as `X-Client-Id` or in the body as `clientId`. X-Client-Secretstring Client Secret ID of the Scope. You can also authenticate with an Authorization Token (in your API tool). Note that the X-Client-Id is still required, whether in the header or the body. Refer to [Setting up an Authentication Method](https://docs.plainid.io/v1/docs/managing-scope-authentication#setting-up-an-authentication-method-in-the-scope) for more information. Body parametersPolicy Resolution ```json { "entityId": "angela_bell", "clientId": "[ClientID]", "clientSecret": "[ClientSecret]", "entityTypeId": "Application_Users", "assetList": [ { "template": "Orders", "path": "/orders", "assetAttributes": { "order_type": [ "credit_card" ], "customer_type": [ "private" ] } } ], "entityAttributes": { "region": [ "US" ] }, "contextData": { "branch_id": [ 512 ] }, "environment": { "resourceFullPath": [ "ResourceMappingString" ], "customParameterName": [ "CustomParameterValue" ] }, "additionalIdentities": [ { "entityId": "agentA", "entityTypeId": "Agents", "entityAttributes": { "agent_classification": [ "Sensitive" ] } }, { "entityId": "appA", "entityTypeId": "Applications", "entityAttributes": { "app_classification": [ "Confidential" ] } } ], "remoteIp": "1.2.2.1", "timeZoneOffset": 3.0, "resourceTypes": [ { "name": "Accounts", "attributeList": [ "type" ], "actions": [ "view" ] } ], "includeContext": false, "includeAccessPolicy": false, "includeAccessPolicyId": false, "includeAssetAttributes": false, "includeIdentity": false, "accessTokenFormat": "JSON", "useCache": false, "combinedMultiValue": false, "assetContext": [ { "key": "", "resourceType": "Account", "path": "", "action": "ACCESS", "assetAttributes": { "accountCategory": [ "Premium" ] } } ], "useOptimizedAssetContextResponse": false, "operationalFilters": [ { "filterType": "identitySourcesFilterByIDs", "filterProperties": { "filterAction": "INCLUDE", "objectsList": [ "sourceID_123", "sourceID_456" ] } }, { "filterType": "identitySourcesFilterByIDs", "filterProperties": { "filterAction": "EXCLUDE", "objectsList": [ "sourceID_789" ] } } ], "skipUnneededOrUnavailableIdentitySources": false, "includePartialIdentitySourcesIndication": false, "failOnCalculatedAttributesErrors": true } ``` Expand Allobject entityIdstring Required Unique identifier of the Identity Min length1 clientIdstring Required Client ID of the Scope The Client ID is **required**, ensure that it is defined either in the header as `X-Client-Id` or in the body as `clientId`. Min length1 clientSecretstring Client Secret ID of the Scope. You can also authenticate with an Authorization Token (in your API tool). Note that the X-Client-Id is still required, whether in the header or the body. Refer to [Setting up an Authentication Method](https://docs.plainid.io/v1/docs/managing-scope-authentication#setting-up-an-authentication-method-in-the-scope) for more information. Min length1 entityTypeIdstring Identity Template ID Min length1 entityAttributesobject List of Identity Attributes and their values. If not defined, Dynamic groups based on virtual Attributes are not considered in the Access Decision. contextDataobject Identity Context data for this request. When specifying this parameter, you are requesting information based on a specific parameter and its value. For example, Location where the contextData equals a specific branch. If not defined, Dynamic groups based on context data will not be considered in the Access Decision. string Array Attributes and their values used in Advanced Conditions or Request Parameters used In Asset Rules. environmentobject Environmental parameters need to be defined in policies as request. (in Assetrules or Conditions) and also sent in the authorization request. Only the assets that match what will be sent in the request will come back. If not defined, parametes based on emviromental data will not be considered in the Access Decision. resourceFullPath Array of string The full path to the table, which depends on the vendor type string additionalIdentities Array of object A list of additional Identities to be considered in the Access Decision. If all identities are defined in this parameter, the root-level `entityId`, `entityTypeId`, and `entityAttributes` parameters can be omitted. object entityIdstring Unique identifier of the Identity (e.g. UID) entityTypeIdstring Identity Template ID entityAttributesobject List of Identity Attributes and their values. string Array remoteIpstring IP address to be used when validating a Policy. Ensure that your IP Ranges are correct based on an [IP calculator](https://www.ipaddressguide.com/cidr). If not defined, the IP considered in the calculation is taken from the X-Forwarded-For (Request header). timeZoneOffsetnumber To define the offset from UTC time zone. Used in Time Condition. assetList Array of object Contains a list of the Asset's unique identifier and attributes object templatestring Asset Template ID pathstring Asset Unique Identifier assetAttributesobject attribute_1 Array of string string attribute_2 Array of string string resourceTypes Array of object This parameter enables you to decrease the payload size by including a list of Asset Types, their Attributes, and/or associated Actions, which also return in the response. If not specified, all resources from all Resource Types will be included. Ensure you are sending either `resourceTypes` or `allResourceTypes` in the request. Sending both will result in an error. object namestring Required The name of the Resource Type is the Asset Template ID. This can be found in the Asset Type Settings. attributeList Array of string A list of Attributes. This can be found in the Asset Type Settings. The list of Attributes are applied on each resourceType in the request, and if applicable, will be part of the response. If no Attributes are specified, Attributes are ***not*** included in the response,. Ensure that the `includeAssetAttributes` parameter is set to `true` for the `attributeList` parameter to work. If set to `false`, Attributes are not returned. string actions Array of string The name of the Action/s. This can be found in the Asset Type Settings. The list of Actions are applied on each `resourceType` in the request, and if applicable, will be part of the response. If no Actions are specified, all Actions for each `resourceType` are included in the response. string allResourceTypesobject (allResourceTypesInput) This parameter enables you to decrease the payload size by including a list of Asset Types, their Attributes, and/or associated Actions, which also return in the response. If not specified, all resources from all Resource Types will be included. Ensure you are sending either `allResourceTypes` or `resourceTypes` in the request. Sending both will result in an error. attributeList Array of string A list of Attributes. This can be found in the Asset Type Settings. The list of Attributes are applied on each `resourceType` in the request, and if applicable, will be part of the response. If no Attributes are specified, all Attributes for each resourceType are included in the response. Ensure that the `includeAssetAttributes` parameter is set to `true` for the `attributeList` parameter to work. If set to `false`, Attributes are not returned. string actions Array of string The name of the Action/s. This can be found in the Asset Type Settings. The list of Actions are applied on each `resourceType` in the request, and if applicable, will be part of the response. If no Actions are specified, all Actions for each `resourceType` are included in the response. string includeContextboolean Show/hide the context data in the response. Defaultfalse includeAccessPolicyboolean Show/hide the name of the Policy in the response that has granted the specified access. Defaultfalse includeAccessPolicyIdboolean Show/hide the external id of the Policy in the response that granted the specified access. Defaultfalse includeAssetAttributesboolean Show/hide the Asset Attribute of the Assets in the response. If using the `attributeList` in the `resourceType` or `allResourceTypes` parameters, ensure that this parameter is set to `true`.`. Defaultfalse includeIdentityboolean Show/hide the Identity Attribute of the Identity in the response. Defaultfalse accessTokenFormatstring Determines the format of the response – whether JSON or JWT. useCacheboolean The Attribute will determine if the response will consider the cache settings or override the cache and preforming full calculation. Defaulttrue combinedMultiValueboolean Determines the evaluation of Identity Attributes relationship in access decision. Defaultfalse assetContext Array of object (assetContextRequestItem) Specifies contextual asset data (e.g., resourceType, path, action) to refine authorization decisions based on asset relationships and classifications.See our article on [Working with Asset Context](https://docs.plainid.io/apidocs/working-with-assetcontext) for more information. object keystring An auto-generated key to set the correlation between the requested object and the response object (optional). When working with a single assetContext object, use the “singleObjectResponse” value to align to the original structure response. resourceTypestring Required pathstring actionstring assetAttributesobject attribute_1 Array of string string attribute_2 Array of string string useOptimizedAssetContextResponseboolean Determines the Asset Context response structure. See our article on [Working with Asset Context](https://docs.plainid.io/apidocs/working-with-assetcontext) for more information. Defaultfalse operationalFilters Array of object These operational filters should affect the Runtime behavior and results by applying additional filtering which is not directly related to Authorization logic. object #content#OneOfidentitySourcesFilterByIDsobject (identitySourcesFilterByIDs)filterTypestring Required filterPropertiesobject filterActionstring RequiredValid values[ "INCLUDE", "EXCLUDE" ] objectsList Array of string Requiredstring Input your sourceID/s here. For information on the sourceID parameter and where to locate it, check out [Managing Attribute Sources](https://docs.plainid.io/v1/docs/managing-attribute-sources) in the PlainID documentation. skipUnneededOrUnavailableIdentitySourcesboolean The Attribute will determine if the calculation will skip unneeded or unavailable Identity sources. Refer to the [Authorization API](https://docs.plainid.io/v1-api/apidocs/authorization-apis) article for more information. Defaultfalse includePartialIdentitySourcesIndicationboolean Show/hide additionalResponseInfo in the response. Defaultfalse failOnCalculatedAttributesErrorsboolean Fail request when Attribute calculation fails. Defaulttrue includeCalculatedExpressionsboolean The Attribute determines if the Resolution attribute displays the nested calculated expression. For more information, refer to [Working with Calculated Attributes](https://docs.plainid.io/v1-api/apidocs/working-with-calculated-attributes) article for more information. Defaultfalse Responses200 OK Policy-Resolution-200 ```json { "tokenValidity": 0, "response": [ { "access": [], "privileges": { "allowed": [ { "resourceType": "Accounts", "actions": [ { "action": "Access", "asset-attributes-filter": { "OR": [ { "OR": [ { "AND": [ { "attribute": "location", "type": "STRING", "operator": "EQUALS", "values": [ "Alabama" ], "match": "any" } ] } ] } ] } } ] } ], "denied": [] } } ] } ``` Expand AllAnyOfresolutionResponseobject (resolutionResponse)tokenValidityinteger response Array of object object access Array of object object pathstring attributesobject resourceTypestring actions Array of object object actionstring permissionstring permissionIdstring permissionMetadataobject (permissionMetadata) Additional response metadata. This response is only returned when the `includeAccessPolicy` is set to true, and when the `permissionMetadata` object contains one or more properties. contextDataobject attribute Array of string string privilegesobject allowed Array of object object resourceTypestring actions Array of object object actionstring asset-attributes-filterobject OR Array of object object OR Array of object object AND Array of object object attributestring typestring operatorstring values Array of string string matchstring identityobject (identityResponse) typestring typeNamestring attributesobject additionalIdentities Array of object (identityResponse) object typestring typeNamestring attributesobject additionalResponseInfoobject (additionalResponseInfoResponse) identitySourcesobject skipped Array of object (identitySourceInfo) object sourceIdstring sourceNamestring messagestring attributes Array of string string failed Array of object (identitySourceInfo) object sourceIdstring sourceNamestring messagestring attributes Array of string string assetContextResolutionResponseobject (assetContextResolutionResponse)data Array of object object assetContextobject AnyOfassetContextResponseItemobject (assetContextResponseItem) assetContextMergedResponseItemobject (assetContextMergedResponseItem)resources Array of object (assetContextResponseItem) object AnyOfobjectobjectkeystring An auto-generated key to set the correlation between the requested object and the response object (optional). When working with a single assetContext object, use the “singleObjectResponse” value to align to the original structure response. objectobjectresourceTypestring pathstring actionstring assetAttributesobject attribute_1 Array of string string attribute_2 Array of string string outputobject accessResponseobject (resolutionResponse) tokenValidityinteger response Array of object object access Array of object object pathstring attributesobject resourceTypestring actions Array of object object actionstring permissionstring permissionIdstring permissionMetadataobject (permissionMetadata) Additional response metadata. This response is only returned when the `includeAccessPolicy` is set to true, and when the `permissionMetadata` object contains one or more properties. contextDataobject attribute Array of string string privilegesobject allowed Array of object object resourceTypestring actions Array of object object actionstring asset-attributes-filterobject OR Array of object object OR Array of object object AND Array of object object attributestring typestring operatorstring values Array of string string matchstring identityobject (identityResponse) typestring typeNamestring attributesobject additionalIdentities Array of object (identityResponse) object typestring typeNamestring attributesobject additionalResponseInfoobject (additionalResponseInfoResponse) identitySourcesobject skipped Array of object (identitySourceInfo) object sourceIdstring sourceNamestring messagestring attributes Array of string string failed Array of object (identitySourceInfo) object sourceIdstring sourceNamestring messagestring attributes Array of string string errorstring 400 Bad Request 401 Unauthorized 403 Forbidden 404 Not Found 500 Internal Server Error 501 Not Implemented