Sign in
PolicyEvaluations

Test Cedar policy evaluation against real entities

Stateless evaluation endpoint for testing Cedar policy evaluation against real entities before deployment. Supports evaluating a single policy, a full policy set, or raw Cedar text.

post/zones/{zone_id}/policy-evaluations

Path parameters

zone_idstring required

The zone identifier

Headers

X-API-Versionstring

API version header (date-based, e.g. 2026-02-01)

X-Client-Request-IDstring uuid

Unique request identifier specified by the originating caller and passed along by proxies.

Request body

principal_type'user' | 'application' required
principal_idstring required

Public ID of the user or application.

actionstring required

Cedar action to evaluate (e.g. any). The engine namespaces actions automatically as Keycard::Action::"<name>".

resource_idstring required

Public ID of the resource.

subject_type'user' | 'application'
subject_idstring

Public ID of the subject (required when subject_type is set).

authority_type'delegation' | 'impersonation' nullable

Discriminator for the subject authority model. Determines how the subject relationship is expressed in the Cedar context:

  • "delegation" — sets context.on_behalf = true on the actor check. The actor is acting on behalf of the subject.
  • "impersonation" — sets context.impersonate = true on the actor check. The actor is impersonating the subject. When null and a subject is present, defaults to "delegation" for backward compatibility.

Response

The evaluation result

decision'allow' | 'deny' required
evaluation_status'complete' | 'partial'
determining_policiesstring[]

Raw Cedar policy IDs that determined the decision, of the form "<policy_version_id>::<cedar_key>", unioned across sub-checks. See checks for the resolved, human-readable form with per-check attribution.

reasonstring

Human-readable explanation of the decision, suitable for presenting to end users.

evaluated_atstring date-time required

Changes

Changed in 5 of the 23 revisions of this API.8

  • d65d51379d932See the full diff
    • ○

      added the new optional request property

      new-optional-request-property

    • ○

      added the optional property //// to the response with the status

      response-optional-property-added

  • 2f5033ed44912See the full diff
    • ○

      added the optional property to the response with the status

      response-optional-property-added

    • ○

      added the optional property to the response with the status

      response-optional-property-added

  • 1a0dd4d857ee2See the full diff
    • ○

      added the new optional request property ///

      new-optional-request-property

    • ○

      added the new optional request property ///

      new-optional-request-property

  • fcab5a5e6cd01See the full diff
    • ○

      added the new optional request property /

      new-optional-request-property

  • aee6e66de0d31See the full diff
    • ○

      endpoint added

      endpoint-added