One trustee's effective rights over one node: the subject, the node, the assurance the answer holds, the lineage path and each right's state. Needs authz:admin; answers 404 while the operator has the AuthZEN search surface disabled and 403 outside its permitted network

GET

/v1/auth/effective-rights

curl --request GET \
  --url 'https://example.com/v1/auth/effective-rights?subject_type=user&subject_id=2489E9AD-2EE2-8E00-8EC9-32D5F69181C0&kind=agent&id=2489E9AD-2EE2-8E00-8EC9-32D5F69181C0' \
  --header 'Authorization: Bearer <token>'

• this engine

Projects one trustee’s rights over one node: the subject (a user or token id, never an email), the node, the assurance the answer holds, the node’s container lineage, and each trustee right’s decision state. A subject the store does not know and one with no membership here answer alike, so the read is not an existence oracle for other tenants.

Authorizations

• bearerAuth
• browserSession

Parameters

Header Parameters

X-Olivares-Tenant

string format: uuid

Target tenant id; required when the principal can act in more than one tenant.

Query Parameters

subject_type

required

string

Allowed values: user token

The subject to project: a user or an API token (never an email — an id, so the 404 is not an account oracle).

subject_id

required

string format: uuid

The subject’s identifier (UUIDv7).

kind

required

string

Allowed values: agent session resource

The node’s kind.

id

required

string format: uuid

The node’s identifier (UUIDv7).

Responses

200

OK

Media type application/json

object

assurance

required

The authenticator assurance level the subject was evaluated at.

integer

node

required

object

id

required

string

kind

required

string

path

required

The node’s container lineage, outermost first.

Array<object>

object

kind

required

string

ref

required

string

workspace

Set only on an agent group that lives in a different workspace than the node.

string

rights

required

Array<object>

object

name

required

string

state

required

The right’s decision state as the engine reports it.

string

subject

required

object

id

required

string

kind

required

string

Example ^generated

{
  "assurance": 1,
  "node": {
    "id": "example",
    "kind": "example"
  },
  "path": [
    {
      "kind": "example",
      "ref": "example",
      "workspace": "example"
    }
  ],
  "rights": [
    {
      "name": "example",
      "state": "example"
    }
  ],
  "subject": {
    "id": "example",
    "kind": "example"
  }
}

400

Bad request

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

401

Unauthenticated

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

403

Forbidden

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

404

Not found

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

409

Conflict / setup required

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

429

Rate limited

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}