Evaluates an example request against a CANDIDATE source and returns the three-valued decision chain: a matched permit GRANTS within scope, a matched forbid RESTRICTS, neither abstains (the RBAC decision stands).

POST

/v1/m/governance/pdp/explain

curl --request POST \
  --url https://example.com/v1/m/governance/pdp/explain \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "engine": "example", "request": { "permission": "example", "principal": { "id": "example", "kind": "example" }, "resource": { "extra": { "additionalProperty": "example" }, "id": "example", "kind": "example", "sensitivity": "example" }, "tenant": "example" }, "source": "example" }'

• this engine

Evaluates an example request against a CANDIDATE source and returns the three-valued decision chain: a matched permit GRANTS within scope, a matched forbid RESTRICTS, neither abstains (the RBAC decision stands).

Authorizations

• bearerAuth

Parameters

Header Parameters

X-Olivares-Tenant

string format: uuid

Target tenant id; required when the principal can act in more than one tenant.

Request Body ^required

Media type application/json

object

engine

required

Case-insensitive after trimming: cedar or opa.

string

request

Any of:

object

object

permission

Any of:

string

Whitespace is trimmed before evaluation.

string

null

null

principal

Any of:

object

object

id

Any of:

string

Optional credential identifier for the example principal.

string

null

null

kind

Any of:

string

After trimming, user remains user; every other value is evaluated as token.

string

null

null

null

null

resource

Any of:

object

object

extra

Any of:

object

object

key

additional properties

Any of:

string

string

null

null

null

null

id

Any of:

string

Example resource identifier.

string

null

null

kind

Any of:

string

Example resource kind.

string

null

null

sensitivity

Any of:

string

Example sensitivity attribute.

string

null

null

null

null

tenant

Any of:

string

A valid non-zero tenant overrides the authenticated tenant; invalid input falls back to it.

string

null

null

null

null

source

Any of:

string

Cedar must compile; OPA candidates are not evaluated in-process.

string

null

null

Example ^generated

{
  "engine": "example",
  "request": {
    "permission": "example",
    "principal": {
      "id": "example",
      "kind": "example"
    },
    "resource": {
      "extra": {
        "additionalProperty": "example"
      },
      "id": "example",
      "kind": "example",
      "sensitivity": "example"
    },
    "tenant": "example"
  },
  "source": "example"
}

Responses

200

OK

Media type application/json

object

Example ^generated

{}

400

Bad request

Media type application/json

object

Example ^generated

{}

401

Unauthenticated

Media type application/json

object

Example ^generated

{}

403

Forbidden

Media type application/json

object

Example ^generated

{}

404

Not found

Media type application/json

object

Example ^generated

{}

409

Conflict / setup required

Media type application/json

object

Example ^generated

{}

429

Rate limited

Media type application/json

object

Example ^generated

{}