Sign in
rbac-policies

Simulate policy evaluation for an organization

Tests what decision would be made for a given subject and context. Evaluates both system policies (from config) and organization policies (from database), matching the runtime authorization flow.

Evaluation Order

  1. Check if RBAC is disabled → return allow with rbac_enabled: false
  2. Evaluate system policies (from config file) first
  3. If a system policy matches → return that decision
  4. Evaluate organization policies (from database)
  5. If an org policy matches → return that decision
  6. No policy matched → apply configured default_effect
post/admin/v1/organizations/{org_slug}/rbac-policies/simulate

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /admin/v1/organizations/{org_slug}/rbac-policies/simulate
  • Auth: HTTP bearer

Path parameters

org_slugstring required

Organization slug

Request body

policy_idstring uuid nullable

Optional: Only test a specific policy by ID

Response

Simulation result

allowedboolean required

Whether the request would be allowed

matched_policystring nullable

Which policy determined the decision (if any)

matched_policy_source'system' | 'organization'

Source of an RBAC policy (system config vs organization database)

rbac_enabledboolean required

Whether RBAC is enabled (if false, all requests are allowed)

reasonstring nullable

Reason for the decision

Changes

No recorded changes to this operation across all 1 revision of this API.