authz

Authorization check

Evaluates an authorization decision for the caller (or, with user_id, for another account the caller may read).

The resource is a description, not a lookup. Nothing loads the row behind resource.id, so the request must carry whatever the rules match on — owner_id for the owner baseline, tenant_id for any tenant-scoped grant (including every admin-managed type: tenant, connection, email_template, terms, group_type, …). A request naming only {type, id} is judged against an empty tenant and an empty owner: it returns allow:false with reason:"resource_unspecified", which means the request under-described the resource — not that a tenancy check failed.

Example of a same-tenant read that can actually be allowed: {"action":"read","resource":{"type":"account","id":"<id>","tenant_id":"<caller tenant>","owner_id":"<id>"}}

Leaf types (graph, graph_node, graph_run, graph_skill — decided by the leaf service that owns them, ADR 0005): v3 cannot know the leaf's own answer (e.g. graph membership), so the check composes your tenant's and your account's deny rules over an ASSUMED leaf allow and returns baseline:"assumed". allow:true then means "no policy of yours would refuse this"; whether the leaf allows it is the leaf's question (for graphs, GET /graphs/{id}/access).

post/authz/check

Request

  • Base URL: https://api.instruxi.dev/api/v1/enforcer
  • URL: https://api.instruxi.dev/api/v1/enforcer/authz/check
  • Auth: one of:
    • API key in header Authorization
    • API key in header X-API-Key

Request body

actionstring
contextsobject

Contexts is a free-form payload the policy may key on (size-capped).

policy_idstring

PolicyID selects a stored policy; empty falls through to the built-in static policy (HTTP parity with the gRPC Authorize).

user_idstring

SubjectAccountID (user_id) evaluates on behalf of another account — the caller must be able to read it. Empty = evaluate as the caller.

Example request

{
  "action": "read",
  "resource": {
    "type": "document"
  }
}

Response

OK

allowboolean
baseline'assumed'

Baseline is "assumed" when the resource type is decided by a leaf service (ADR 0005): the tenant and account layers were composed over an assumed leaf allow, because v3 cannot know the leaf's own answer. Absent otherwise.

policy_idstring
reasonstring
successboolean

Example response

{
  "success": true
}

Changes

No recorded changes to this operation across all 1 revision of this API.