Evaluate policies for a hypothetical request
const url = 'https://example.com/v1/policies/evaluate';const options = { method: 'POST', headers: { 'X-Tenant-ID': '2489E9AD-2EE2-8E00-8EC9-32D5F69181C0', Authorization: 'Bearer <token>', 'Content-Type': 'application/json' }, body: '{"principal":"example","groups":["example"],"resource":"example","action":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example.com/v1/policies/evaluate \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --header 'X-Tenant-ID: 2489E9AD-2EE2-8E00-8EC9-32D5F69181C0' \ --data '{ "principal": "example", "groups": [ "example" ], "resource": "example", "action": "example" }'Authorizations
Section titled “Authorizations ”Parameters
Section titled “ Parameters ”Header Parameters
Section titled “Header Parameters ”Tenant identifier. Must match the tenant associated with the credential. Returns 403 tenant_mismatch if the credential and header belong to different tenants.
Request Body required
Section titled “Request Body required ”object
User identifier (e.g. email or UUID) to test as.
Groups the principal belongs to (e.g. [“sre”, “engineering”]).
Resource in type:id format (e.g. aws_permission_set:arn:aws:sso:::permissionSet/ssoins-001/ps-admin).
Action to test (e.g. assume, read, write, admin).
Example generated
{ "principal": "example", "groups": [ "example" ], "resource": "example", "action": "example"}Responses
Section titled “ Responses ”Evaluation result
object
IDs of policies that contributed to the decision.
Human-readable explanation of the decision.
Policy notices from Cedar evaluation.
Example generated
{ "permitted": true, "matching_policy_ids": [ "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" ], "reason": "example", "notices": [ "example" ]}Invalid input
object
Machine-readable error code (e.g. “not_found”, “tenant_mismatch”).
Human-readable description of the error.
Optional additional context about the error.
object
Policy notices from determining Cedar rules, if applicable.
Example generated
{ "code": "example", "message": "example", "details": {}, "notices": [ "example" ]}Unauthenticated
object
Machine-readable error code (e.g. “not_found”, “tenant_mismatch”).
Human-readable description of the error.
Optional additional context about the error.
object
Policy notices from determining Cedar rules, if applicable.
Example generated
{ "code": "example", "message": "example", "details": {}, "notices": [ "example" ]}Forbidden
object
Machine-readable error code (e.g. “not_found”, “tenant_mismatch”).
Human-readable description of the error.
Optional additional context about the error.
object
Policy notices from determining Cedar rules, if applicable.
Example generated
{ "code": "example", "message": "example", "details": {}, "notices": [ "example" ]}