Working with Deny Reason

About Deny Reason

The includeDenyReason is an optional runtime request parameter in the Permit Deny API. When sent in the request, the response provides visibility into the different deny reasons that might occur when receiving a denied response from the PDP.

This capability can be used for troubleshooting and provides better support for onboarding new Applications or a new set of Policies.

Additionally, integrated Applications can use Deny-Reason codes in their responses to clarify to users why they were not granted access.

Example:
If a user does not meet the conditions set in the Policy (e.g. working hours), they cannot access the relevant information granted by the Policy.

Response structure

Deny-Reason codes within the response are returned for every Asset Action permutation. A basic response returns all the Deny-Reason code/s relevant to the request.

Example:
Basic Response Structure (includeDetails set to false, includeDenyReason set to true)

{
  "result": "DENY",
  "reason": ["PID003","PID004"]
}

A breakdown for every code per Asset Action permutation is returned in a detailed response.

Example:
Detailed Response Structure (includeDetails set to true, includeDenyReason set to true)

{
    "result": "DENY",
    "reason": [
        "PID003",
        "PID004"
    ],
    "response": [
        {
            "allowed": [],
            "denied": [
                {
                    "path": "/accounts/transfer",
                    "Action": "Approve",
                    "template": "Accounts",
                    "reason": "PID003"
                },
                {
                    "path": "/accounts/transfer",
                    "Action": "Edit",
                    "template": "Accounts",
                    "reason": "PID004"
                }
            ],
            "not_applicable": []
        }
    ]
}

PlainID PDP Deny Reason Codes

Deny Reason returns in a form of code to make the integration with consuming Applications easier.

For each Asset Action permutation sent in the Authorization request, an appropriate error code is returned.
It is important to ensure that the Asset Type setup is correct, all relevant Actions are available, and the values match the Authorization request sent.
Note: Action value is case sensitive.

The following table provides information for each Deny Code scenario: