---
title: "Resolve Cedar entities for a given resource, returning the full entity hierarchy that would be used in an authorization decision."
method: POST
path: "/management/v1/permissions/cedar/resolve-entities"
tags: ["permissions-cedar"]
---

# Resolve Cedar entities for a given resource, returning the full entity hierarchy that would be used in an authorization decision.

`POST /management/v1/permissions/cedar/resolve-entities`

## Request

- Base URL: `https://localhost`
- URL: `https://localhost/management/v1/permissions/cedar/resolve-entities`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/lakekeeper/apis/lakekeeper-management-api/docs/management/v1/permissions/cedar/resolve-entities/post.ts> (a function with typed inputs; its response is checked against the schema)

Follows the `emit_authz` pattern: event context is built upfront, and ALL
fallible work runs inside a single async block whose `Result` is passed to
`emit_authz`. Every failure — catalog errors, role-lookup failures,
authorization denials — is audited.

Authorization gate: `IntrospectAuthorization` on the target resource, checked
via the upstream `require_*_action` / `load_and_authorize_*` helpers (parallel
fetches, TOCTOU-safe cache refresh, canonical error handling).

## Request body

- ResolveCedarEntitiesRequest: Request body for resolving Cedar entities.
  - `principal` union: Identifies a user or a role
    - object: Id of the user
      - `user` string, required: Id of the user
    - object: Id of the role
      - `role` string, uuid, required: Id of the role
  - `resource` union, required: Identifies the resource whose Cedar entity hierarchy should be resolved. Mirrors the shape of `CatalogActionCheckOperation` used by the batch-check endpoint — externally-tagged enum, reuses [`NamespaceIdentOrUuid`] / [`TabularIdentOrUuid`] so callers can address a resource by either UUID or by (warehouse + name), matching the rest of the management API.
    - 'server'
    - object
      - `project` object, required
        - `project-id` string, nullable: Project ID. If not specified, the ambient project from the request header is used.
    - object
      - `warehouse` object, required
        - `warehouse-id` string, uuid, required
    - object
      - `namespace` union, required: Identifier for a namespace, either a UUID or its name and warehouse ID
        - object
          - `namespace-id` string, uuid, required
          - `warehouse-id` string, uuid, required
        - object
          - `namespace` string[], required
          - `warehouse-id` string, uuid, required
    - object
      - `table` union, required: Identifier for a tabular (table, view, or generic table) — either a UUID or its name and namespace. Wire format primary names are `table-id` and `table`; `view_id` / `view` and `generic_table_id` / `generic_table` are accepted as input aliases for client ergonomics.
        - object
          - `table-id` string, uuid, required
          - `warehouse-id` string, uuid, required
        - object
          - `namespace` string[], required
          - `table` string, required: Name of the table, view, or generic table.
          - `warehouse-id` string, uuid, required
    - object
      - `view` union, required: Identifier for a tabular (table, view, or generic table) — either a UUID or its name and namespace. Wire format primary names are `table-id` and `table`; `view_id` / `view` and `generic_table_id` / `generic_table` are accepted as input aliases for client ergonomics.
        - object
          - `table-id` string, uuid, required
          - `warehouse-id` string, uuid, required
        - object
          - `namespace` string[], required
          - `table` string, required: Name of the table, view, or generic table.
          - `warehouse-id` string, uuid, required
    - object
      - `generic-table` union, required: Identifier for a tabular (table, view, or generic table) — either a UUID or its name and namespace. Wire format primary names are `table-id` and `table`; `view_id` / `view` and `generic_table_id` / `generic_table` are accepted as input aliases for client ergonomics.
        - object
          - `table-id` string, uuid, required
          - `warehouse-id` string, uuid, required
        - object
          - `namespace` string[], required
          - `table` string, required: Name of the table, view, or generic table.
          - `warehouse-id` string, uuid, required

## Response `200`

Resolved Cedar entities

- ResolveCedarEntitiesResponse: Response from resolving Cedar entities.
  - `entities` unknown[], required: Cedar entities in native JSON format. Each element represents a Cedar entity with uid, attrs, and parents.
    - unknown
  - `entity-count` integer, required: Total number of entities resolved.

## Other responses

- `4XX`

---

[API](https://skmtc.dev/lakekeeper/apis/lakekeeper-management-api.md) - [All operations](https://skmtc.dev/lakekeeper/apis/lakekeeper-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/lakekeeper/apis/lakekeeper-management-api/revisions/c5cb9a12a98c?raw)