The Policy Resolution API enables you to create your own enforcement points when need to support access to large amounts of data (SQL, search engines, big data, etc.) or enforcement need to be done by another system/platform. It is designed to answer questions like: "What access filters need to be set up for a specific user to access an asset?". The response is expected to show the logical filtering of data and/or the list of allowed data items for the user.
Notice
When accessing the Authorization APIs, the URL base/prefix, according to your PlainID PDP LocationFor more information on which Asset Types to use with your PAA or Cloud PDP, refer to Managing Asset Types.
cURL Sample Guidelines
In order for the relevant parameters to appear in the cURL sample, you can input the values in the interactive API console on the right under the Try It\* or the Code Sample tabs. They will then appear in the cURL sample in the correct format to use in your API tool.
\*Try It function coming soon.
Client ID of the Scope
The clientId is required, ensure that it is defined either in the header as X-Client-Id or in the body as clientId.
Client Secret ID of the Scope.
You can also authenticate with an Authorization Token (in your API tool). Note that the X-Client-Id is still required, whether in the header or the body. Refer to Setting up an Authentication Method for more information.
Unique identifier of the Identity
Client ID of the Scope
The Client ID is required, ensure that it is defined either in the header as X-Client-Id or in the body as clientId.
Client Secret ID of the Scope.
You can also authenticate with an Authorization Token (in your API tool). Note that the X-Client-Id is still required, whether in the header or the body. Refer to Setting up an Authentication Method for more information.
Identity Template ID
IP address to be used when validating a Policy. Ensure that your IP Ranges are correct based on an IP calculator. If not defined, the IP considered in the calculation is taken from the X-Forwarded-For (Request header). If not defined,the IP considered in the calculation is taken from the X-Forwarded-For (Request header).
Show/hide the Identity Attribute of the Identity in the response.
Show/hide the Asset Attribute of the assets in the response.
This parameter enables you to decrease the payload size by including a list of Asset Types and their Attributes, which also return in the response. If not specified, all resources from all resource types will be included. If using this parameter, ensure you are sending either allResourceTypes or resourceTypes in the request. Sending both will result in an error. If not specified, all identities from all Identity Types will be included in the response.
OK
{
"tokenValidity": 0,
"response": [
{
"access": [],
"privileges": {
"allowed": [
{
"resourceType": "Accounts",
"actions": [
{
"action": "Access",
"asset-attributes-filter": {
"OR": [
{
"OR": [
{
"AND": [
{
"attribute": "location",
"type": "STRING",
"operator": "EQUALS",
"values": [
"Alabama"
],
"match": "any"
}
]
}
]
}
]
}
}
]
}
],
"denied": []
}
}
]
}Additional response metadata. This response is only returned when the includeAccessPolicy is set to true, and when the permissionMetadata object contains one or more properties.
An auto-generated key to set the correlation between the requested object and the response object (optional). When working with a single assetContext object, use the “singleObjectResponse” value to align to the original structure response.
Additional response metadata. This response is only returned when the includeAccessPolicy is set to true, and when the permissionMetadata object contains one or more properties.
Bad Request
Unauthorized
Forbidden
Not Found
Internal Server Error
Not Implemented