Oso Cloud Check API API

openapi: 3.0.3
info:
  title: Oso Cloud HTTP Centralized Authorization Data Check API API
  version: 0.1.0
  description: 'Oso Cloud exposes an HTTP API that you can use to make queries directly, without using one of the clients.For endpoints that require authentication, pass your API key as an HTTP Bearer Auth payload.For example, using curl: curl -H "Authorization: Bearer $OSO_AUTH" https://cloud.osohq.com/api/'
servers:
- url: https://api.osohq.com/api/
tags:
- name: Check API
paths:
  /authorize:
    post:
      tags:
      - Check API
      description: Determines whether or not an actor can take an action on a resource, based on a combination of authorization data and policy logic.
      operationId: post_authorize
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthorizeQuery'
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthorizeResult'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      security:
      - ApiKey: []
      x-codeSamples:
      - lang: javascript
        label: Node.js
        source: "import { Oso } from 'oso-cloud';\n\nconst apiKey = process.env.OSO_CLOUD_API_KEY;\nconst oso = new Oso(\"https://cloud.osohq.com\", apiKey);\n\n// Basic authorization check\nconst alice = { type: \"User\", id: \"alice\" };\nconst repository = { type: \"Repository\", id: \"anvils\" };\n\nconst authorized = await oso.authorize(alice, \"read\", repository);\nif (!authorized) {\n  throw new Error(\"Access denied\");\n}\n\n// With context facts for additional information\nconst issue = { type: \"Issue\", id: \"123\" };\nconst contextAuthorized = await oso.authorize(\n  alice, \n  \"read\", \n  issue, \n  [[\"has_relation\", issue, \"parent\", repository]]  // Context facts\n);\n"
      - lang: python
        label: Python
        source: "import os\nfrom oso_cloud import Oso, Value\n\noso = Oso(api_key=os.environ.get('OSO_CLOUD_API_KEY', None))\n\n# Basic authorization check\nalice = Value(\"User\", \"alice\")\nrepository = Value(\"Repository\", \"anvils\")\n\nif not oso.authorize(alice, \"read\", repository):\n    raise Exception(\"Action is not allowed\")\n\n# With context facts\nissue = Value(\"Issue\", \"123\")\nauthorized = oso.authorize(\n    alice, \n    \"read\", \n    issue, \n    context_facts=[(\"has_relation\", issue, \"parent\", repository)]\n)\n"
      - lang: go
        label: Go
        source: "package main\n\nimport (\n    \"log\"\n    \"os\"\n    oso \"github.com/osohq/go-oso-cloud/v2\"\n)\n\nfunc main() {\n    apiKey := os.Getenv(\"OSO_CLOUD_API_KEY\")\n    osoClient := oso.NewClient(\"https://cloud.osohq.com\", apiKey)\n\n// Basic authorization check\nuser := oso.NewValue(\"User\", \"alice\")\nrepository := oso.NewValue(\"Repository\", \"anvils\")\n\nallowed, err := osoClient.Authorize(user, \"read\", repository)\nif err != nil {\n    log.Fatal(err)\n}\nif !allowed {\n    return fmt.Errorf(\"access denied\")\n}\n\n// With context facts\nissue := oso.NewValue(\"Issue\", \"123\")\ncontextFacts := []oso.Fact{\n    oso.NewFact(\"has_relation\", issue, oso.String(\"parent\"), repository),\n}\nallowed, err = osoClient.AuthorizeWithContext(user, \"read\", issue, contextFacts)\n}\n"
      - lang: java
        label: Java
        source: "package com.mycompany;\n\nimport java.io.IOException;\nimport com.osohq.oso_cloud.Oso;\nimport com.osohq.oso_cloud.api.ApiException;\nimport com.osohq.oso_cloud.api.Value;\n\npublic class App {\n    public static void main(String[] args) {\n        String apiKey = System.getenv(\"OSO_CLOUD_API_KEY\");\n        Oso oso = new Oso(apiKey);\n        \n        try {\n            // Basic authorization check\n            Value alice = new Value(\"User\", \"alice\");\n            Value repository = new Value(\"Repository\", \"anvils\");\n            \n            boolean authorized = oso.authorize(alice, \"read\", repository);\n            if (!authorized) {\n                throw new RuntimeException(\"Access denied\");\n            }\n            \n            // With context facts for additional information\n            Value issue = new Value(\"Issue\", \"123\");\n            boolean contextAuthorized = oso.authorize(alice, \"read\", issue, \n                Arrays.asList(Arrays.asList(\"has_relation\", issue, \"parent\", repository)));\n        } catch (IOException | ApiException e) {\n            System.err.println(\"Error: \" + e.getMessage());\n        }\n    }\n}\n"
      - lang: ruby
        label: Ruby
        source: "require 'oso-cloud'\n\napi_key = ENV.fetch('OSO_CLOUD_API_KEY', nil)\noso = OsoCloud::Oso.new(url: \"https://cloud.osohq.com\", api_key: api_key)\n\n# Basic authorization check\nalice = OsoCloud::Value.new(type: \"User\", id: \"alice\")\nrepository = OsoCloud::Value.new(type: \"Repository\", id: \"anvils\")\n\nauthorized = oso.authorize(alice, \"read\", repository)\nraise \"Access denied\" unless authorized\n\n# With context facts\nissue = OsoCloud::Value.new(type: \"Issue\", id: \"123\")\ncontext_authorized = oso.authorize(alice, \"read\", issue, \n  context_facts: [[\"has_relation\", issue, \"parent\", repository]])\n"
      - lang: csharp
        label: C#
        source: "using OsoCloud;\n\nstring? apiKey = Environment.GetEnvironmentVariable(\"OSO_CLOUD_API_KEY\");\nvar oso = new Oso(\"https://api.osohq.com\", apiKey);\n\n// Basic authorization check\nvar alice = new Value(\"User\", \"alice\");\nvar repository = new Value(\"Repository\", \"anvils\");\n\nbool authorized = await oso.Authorize(alice, \"read\", repository);\nif (!authorized) {\n    throw new UnauthorizedAccessException(\"Access denied\");\n}\n\n// With context facts for additional information\nvar issue = new Value(\"Issue\", \"123\");\nbool contextAuthorized = await oso.Authorize(alice, \"read\", issue, \n    contextFacts: new[] { new[] { \"has_relation\", issue, \"parent\", repository } });\n"
  /authorize_resources:
    post:
      tags:
      - Check API
      description: Returns a subset of resources on which an actor can perform a particular action. Ordering and duplicates, if any exist, are preserved.
      operationId: post_authorize_resources
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthorizeResourcesQuery'
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthorizeResourcesResult'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      security:
      - ApiKey: []
  /list:
    post:
      tags:
      - Check API
      description: 'Fetches a list of resource IDs on which an actor can perform a particular action. Supports pagination: provide `page_size` to receive results in pages, with a `next_page_token` in the response for fetching subsequent pages.'
      operationId: post_list
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListQuery'
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResult'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      security:
      - ApiKey: []
      x-codeSamples:
      - lang: javascript
        label: Node.js
        source: "import { Oso } from 'oso-cloud';\n\nconst apiKey = process.env.OSO_CLOUD_API_KEY;\nconst oso = new Oso(\"https://cloud.osohq.com\", apiKey);\n\n// List all repositories the user can read\nconst alice = { type: \"User\", id: \"alice\" };\nconst repositoryIds = await oso.list(alice, \"read\", \"Repository\");\nconsole.log(\"Readable repositories:\", repositoryIds);\n\n// With context facts\nconst issueIds = await oso.list(\n  alice, \n  \"read\", \n  \"Issue\",\n  [\n    [\"has_relation\", { type: \"Issue\", id: \"123\" }, \"parent\", { type: \"Repository\", id: \"anvils\" }],\n    [\"has_relation\", { type: \"Issue\", id: \"456\" }, \"parent\", { type: \"Repository\", id: \"acme\" }]\n  ]\n);\n"
      - lang: python
        label: Python
        source: "import os\nfrom oso_cloud import Oso, Value\n\noso = Oso(api_key=os.environ.get('OSO_CLOUD_API_KEY', None))\n\n# List all repositories the user can read\nalice = Value(\"User\", \"alice\")\nrepository_ids = oso.list(alice, \"read\", \"Repository\")\nprint(f\"Readable repositories: {repository_ids}\")\n\n# With context facts\nissue_ids = oso.list(\n    alice, \n    \"read\", \n    \"Issue\",\n    context_facts=[\n        (\"has_relation\", Value(\"Issue\", \"123\"), \"parent\", Value(\"Repository\", \"anvils\")),\n        (\"has_relation\", Value(\"Issue\", \"456\"), \"parent\", Value(\"Repository\", \"acme\"))\n    ]\n)\n"
      - lang: go
        label: Go
        source: "package main\n\nimport (\n    \"log\"\n    \"os\"\n    oso \"github.com/osohq/go-oso-cloud/v2\"\n)\n\nfunc main() {\n    apiKey := os.Getenv(\"OSO_CLOUD_API_KEY\")\n    osoClient := oso.NewClient(\"https://cloud.osohq.com\", apiKey)\n\n// List all repositories the user can read\nuser := oso.NewValue(\"User\", \"alice\")\nrepositoryIds, err := osoClient.List(user, \"read\", \"Repository\", nil)\nif err != nil {\n    log.Fatal(err)\n}\nfmt.Printf(\"Readable repositories: %v\\n\", repositoryIds)\n\n// With context facts\ncontextFacts := []oso.Fact{\n    oso.NewFact(\"has_relation\", oso.NewValue(\"Issue\", \"123\"), oso.String(\"parent\"), oso.NewValue(\"Repository\", \"anvils\")),\n    oso.NewFact(\"has_relation\", oso.NewValue(\"Issue\", \"456\"), oso.String(\"parent\"), oso.NewValue(\"Repository\", \"acme\")),\n}\nissueIds, err := osoClient.ListWithContext(user, \"read\", \"Issue\", contextFacts)\n}\n"
      - lang: java
        label: Java
        source: "package com.mycompany;\n\nimport java.io.IOException;\nimport java.util.Arrays;\nimport java.util.List;\nimport com.osohq.oso_cloud.Oso;\nimport com.osohq.oso_cloud.api.ApiException;\nimport com.osohq.oso_cloud.api.Value;\n\npublic class App {\n    public static void main(String[] args) {\n        String apiKey = System.getenv(\"OSO_CLOUD_API_KEY\");\n        Oso oso = new Oso(apiKey);\n        \n        try {\n            // List all repositories the user can read\n            Value alice = new Value(\"User\", \"alice\");\n            List<String> repositoryIds = oso.list(alice, \"read\", \"Repository\");\n            System.out.println(\"Readable repositories: \" + repositoryIds);\n            \n            // With context facts\n            Value issue1 = new Value(\"Issue\", \"123\");\n            Value issue2 = new Value(\"Issue\", \"456\");\n            Value repo1 = new Value(\"Repository\", \"anvils\");\n            Value repo2 = new Value(\"Repository\", \"acme\");\n            \n            List<String> issueIds = oso.list(alice, \"read\", \"Issue\", Arrays.asList(\n                Arrays.asList(\"has_relation\", issue1, \"parent\", repo1),\n                Arrays.asList(\"has_relation\", issue2, \"parent\", repo2)\n            ));\n        } catch (IOException | ApiException e) {\n            System.err.println(\"Error: \" + e.getMessage());\n        }\n    }\n}\n"
      - lang: ruby
        label: Ruby
        source: "require 'oso-cloud'\n\napi_key = ENV.fetch('OSO_CLOUD_API_KEY', nil)\noso = OsoCloud::Oso.new(url: \"https://cloud.osohq.com\", api_key: api_key)\n\n# List all repositories the user can read\nalice = OsoCloud::Value.new(type: \"User\", id: \"alice\")\nrepository_ids = oso.list(alice, \"read\", \"Repository\")\nputs \"Readable repositories: #{repository_ids}\"\n\n# With context facts\nissue_ids = oso.list(alice, \"read\", \"Issue\", \n  context_facts: [\n    [\"has_relation\", OsoCloud::Value.new(type: \"Issue\", id: \"123\"), \"parent\", OsoCloud::Value.new(type: \"Repository\", id: \"anvils\")],\n    [\"has_relation\", OsoCloud::Value.new(type: \"Issue\", id: \"456\"), \"parent\", OsoCloud::Value.new(type: \"Repository\", id: \"acme\")]\n  ]\n)\n"
      - lang: csharp
        label: C#
        source: "using OsoCloud;\n\nstring? apiKey = Environment.GetEnvironmentVariable(\"OSO_CLOUD_API_KEY\");\nvar oso = new Oso(\"https://api.osohq.com\", apiKey);\n\n// List all repositories the user can read\nvar alice = new Value(\"User\", \"alice\");\nvar repositoryIds = await oso.List(alice, \"read\", \"Repository\");\nConsole.WriteLine($\"Readable repositories: {string.Join(\", \", repositoryIds)}\");\n\n// With context facts\nvar issueIds = await oso.List(alice, \"read\", \"Issue\", \n    contextFacts: new[] {\n        new[] { \"has_relation\", new Value(\"Issue\", \"123\"), \"parent\", new Value(\"Repository\", \"anvils\") },\n        new[] { \"has_relation\", new Value(\"Issue\", \"456\"), \"parent\", new Value(\"Repository\", \"acme\") }\n    });\n"
  /actions:
    post:
      tags:
      - Check API
      description: Fetches a list of actions which an actor can perform on a particular resource.
      operationId: post_actions
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActionsQuery'
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActionsResult'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      security:
      - ApiKey: []
      x-codeSamples:
      - lang: javascript
        label: Node.js
        source: "import { Oso } from 'oso-cloud';\n\nconst apiKey = process.env.OSO_CLOUD_API_KEY;\nconst oso = new Oso(\"https://cloud.osohq.com\", apiKey);\n\n// Get all actions user can perform on repository\nconst user = { type: \"User\", id: \"alice\" };\nconst repository = { type: \"Repository\", id: \"anvils\" };\nconst actions = await oso.actions(user, repository);\nconsole.log(\"Available actions:\", actions);\n\n// With context facts\nconst issue = { type: \"Issue\", id: \"123\" };\nconst contextActions = await oso.actions(\n  user, \n  issue, \n  [[\"has_relation\", issue, \"parent\", repository]]\n);\n"
      - lang: python
        label: Python
        source: "import os\nfrom oso_cloud import Oso, Value\n\noso = Oso(api_key=os.environ.get('OSO_CLOUD_API_KEY', None))\n\n# Get all actions user can perform on repository\nalice = Value(\"User\", \"alice\")\nrepository = Value(\"Repository\", \"anvils\")\nactions = oso.actions(alice, repository)\nprint(f\"Available actions: {actions}\")\n\n# With context facts\nissue = Value(\"Issue\", \"123\")\nactions = oso.actions(\n    alice, \n    issue, \n    context_facts=[(\"has_relation\", issue, \"parent\", repository)]\n)\n"
      - lang: go
        label: Go
        source: "package main\n\nimport (\n    \"log\"\n    \"os\"\n    oso \"github.com/osohq/go-oso-cloud/v2\"\n)\n\nfunc main() {\n    apiKey := os.Getenv(\"OSO_CLOUD_API_KEY\")\n    osoClient := oso.NewClient(\"https://cloud.osohq.com\", apiKey)\n\n// Get all actions user can perform on repository\nuser := oso.NewValue(\"User\", \"alice\")\nrepository := oso.NewValue(\"Repository\", \"anvils\")\nactions, err := osoClient.Actions(user, repository)\nif err != nil {\n    log.Fatal(err)\n}\nfmt.Printf(\"Available actions: %v\\n\", actions)\n\n// With context facts\nissue := oso.NewValue(\"Issue\", \"123\")\ncontextFacts := []oso.Fact{\n    oso.NewFact(\"has_relation\", issue, oso.String(\"parent\"), repository),\n}\nactions, err = osoClient.ActionsWithContext(user, issue, contextFacts)\n}\n"
      - lang: java
        label: Java
        source: "package com.mycompany;\n\nimport java.io.IOException;\nimport java.util.Arrays;\nimport java.util.List;\nimport com.osohq.oso_cloud.Oso;\nimport com.osohq.oso_cloud.api.ApiException;\nimport com.osohq.oso_cloud.api.Value;\n\npublic class App {\n    public static void main(String[] args) {\n        String apiKey = System.getenv(\"OSO_CLOUD_API_KEY\");\n        Oso oso = new Oso(apiKey);\n        \n        try {\n            // Get all actions user can perform on repository\n            Value user = new Value(\"User\", \"alice\");\n            Value repository = new Value(\"Repository\", \"anvils\");\n            List<String> actions = oso.actions(user, repository);\n            System.out.println(\"Available actions: \" + actions);\n            \n            // With context facts\n            Value issue = new Value(\"Issue\", \"123\");\n            List<String> contextActions = oso.actions(user, issue,\n                Arrays.asList(Arrays.asList(\"has_relation\", issue, \"parent\", repository)));\n        } catch (IOException | ApiException e) {\n            System.err.println(\"Error: \" + e.getMessage());\n        }\n    }\n}\n"
      - lang: ruby
        label: Ruby
        source: "require 'oso-cloud'\n\napi_key = ENV.fetch('OSO_CLOUD_API_KEY', nil)\noso = OsoCloud::Oso.new(url: \"https://cloud.osohq.com\", api_key: api_key)\n\n# Get all actions user can perform on repository\nuser = OsoCloud::Value.new(type: \"User\", id: \"alice\")\nrepository = OsoCloud::Value.new(type: \"Repository\", id: \"anvils\")\nactions = oso.actions(user, repository)\nputs \"Available actions: #{actions}\"\n\n# With context facts\nissue = OsoCloud::Value.new(type: \"Issue\", id: \"123\")\ncontext_actions = oso.actions(user, issue,\n  context_facts: [[\"has_relation\", issue, \"parent\", repository]])\n"
      - lang: csharp
        label: C#
        source: "using OsoCloud;\n\nstring? apiKey = Environment.GetEnvironmentVariable(\"OSO_CLOUD_API_KEY\");\nvar oso = new Oso(\"https://api.osohq.com\", apiKey);\n\n// Get all actions user can perform on repository\nvar user = new Value(\"User\", \"alice\");\nvar repository = new Value(\"Repository\", \"anvils\");\nvar actions = await oso.Actions(user, repository);\nConsole.WriteLine($\"Available actions: {string.Join(\", \", actions)}\");\n\n// With context facts\nvar issue = new Value(\"Issue\", \"123\");\nvar contextActions = await oso.Actions(user, issue,\n    contextFacts: new[] { new[] { \"has_relation\", issue, \"parent\", repository } });\n"
  /query:
    post:
      tags:
      - Check API
      description: 'Query v1: query for any predicate and any combination of concrete and wildcard arguments.


        Unlike `GET /facts`, which only lists facts you''ve added to Oso Cloud, you can use `POST /query` to list derived information about any rule in your policy.'
      operationId: post_query
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/QueryDeprecated'
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryResultDeprecated'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      deprecated: true
      security:
      - ApiKey: []
  /evaluate_query:
    post:
      tags:
      - Check API
      description: 'Query v2: query for any expression.


        Unlike `GET /facts`, which only lists facts you''ve added to Oso Cloud, you can use `POST /evaluate_query` to list derived information about any rule in your policy.'
      operationId: post_evaluate_query
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Query'
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryResult'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      security:
      - ApiKey: []
      x-codeSamples:
      - lang: javascript
        label: Node.js
        source: "import { Oso } from 'oso-cloud';\n\nconst apiKey = process.env.OSO_CLOUD_API_KEY;\nconst oso = new Oso(\"https://cloud.osohq.com\", apiKey);\n\n// Basic query building\nconst actor = { type: \"User\", id: \"alice\" };\nconst repository = { type: \"Repository\", id: \"anvils\" };\nconst query = oso.buildQuery([\"allow\", actor, \"read\", repository]);\nconst result = await query.evaluate(repository);\n\n// Add constraints with 'and'\nconst constrainedQuery = oso.buildQuery([\"allow\", actor, \"read\", repository])\n  .and([\"has_relation\", repository, \"folder\", { type: \"Folder\", id: \"docs\" }]);\n\n// Different evaluation modes\nconst exists = await query.evaluate();                           // Boolean\nconst actions = await query.evaluate(\"action\");                   // Single variable\nconst pairs = await query.evaluate([\"action\", \"repository\"]);     // Tuple variables\n"
      - lang: python
        label: Python
        source: "import os\nfrom oso_cloud import Oso, Value\n\noso = Oso(api_key=os.environ.get('OSO_CLOUD_API_KEY', None))\n\n# Basic query building\nactor = Value(\"User\", \"alice\")\nrepository = Value(\"Repository\", \"anvils\")\nquery = oso.build_query((\"allow\", actor, \"read\", repository))\nresult = query.evaluate(repository)\n\n# Add constraints with 'and_'\nconstrained_query = oso.build_query((\"allow\", actor, \"read\", repository)) \\\n    .and_((\"has_relation\", repository, \"folder\", Value(\"Folder\", \"docs\")))\n\n# Different evaluation modes\nexists = query.evaluate()                              # Boolean\nactions = query.evaluate(\"action\")                      # Single variable\npairs = query.evaluate((\"action\", \"repository\"))        # Tuple variables\n"
      - lang: go
        label: Go
        source: "package main\n\nimport (\n    \"log\"\n    \"os\"\n    oso \"github.com/osohq/go-oso-cloud/v2\"\n)\n\nfunc main() {\n    apiKey := os.Getenv(\"OSO_CLOUD_API_KEY\")\n    osoClient := oso.NewClient(\"https://cloud.osohq.com\", apiKey)\n\n// Basic query building\nactor := oso.NewValue(\"User\", \"alice\")\nrepository := oso.NewValue(\"Repository\", \"anvils\")\nquery := osoClient.BuildQuery(oso.NewQueryFact(\"allow\", actor, oso.String(\"read\"), repository))\nrepos, err := query.EvaluateValues(repository)\n\n// Add constraints with 'And'\nfolder := oso.NewValue(\"Folder\", \"docs\")\nconstrainedQuery := osoClient.BuildQuery(oso.NewQueryFact(\"allow\", actor, oso.String(\"read\"), repository)).\n    And(oso.NewQueryFact(\"has_relation\", repository, oso.String(\"folder\"), folder))\n\n// Different evaluation modes\nallowed, err := query.EvaluateExists()                                    // Boolean\nactions, err := query.EvaluateValues(oso.NewVariable(\"action\"))           // Values for variable\n}\n"
      - lang: java
        label: Java
        source: "package com.mycompany;\n\nimport java.io.IOException;\nimport com.osohq.oso_cloud.Oso;\nimport com.osohq.oso_cloud.api.ApiException;\nimport com.osohq.oso_cloud.api.Value;\n\npublic class App {\n    public static void main(String[] args) {\n        String apiKey = System.getenv(\"OSO_CLOUD_API_KEY\");\n        Oso oso = new Oso(apiKey);\n        \n        try {\n            // Basic query building\n            Value actor = new Value(\"User\", \"alice\");\n            Value repository = new Value(\"Repository\", \"anvils\");\n            var query = oso.buildQuery(\"allow\", actor, \"read\", repository);\n            var result = query.evaluate(repository);\n            \n            // Add constraints with 'and'\n            Value folder = new Value(\"Folder\", \"docs\");\n            var constrainedQuery = oso.buildQuery(\"allow\", actor, \"read\", repository)\n                .and(\"has_relation\", repository, \"folder\", folder);\n            \n            // Different evaluation modes\n            boolean exists = query.evaluate();                      // Boolean\n            var actions = query.evaluate(\"action\");                 // Single variable\n            var pairs = query.evaluate(\"action\", \"repository\");     // Tuple variables\n        } catch (IOException | ApiException e) {\n            System.err.println(\"Error: \" + e.getMessage());\n        }\n    }\n}\n"
      - lang: ruby
        label: Ruby
        source: "require 'oso-cloud'\n\napi_key = ENV.fetch('OSO_CLOUD_API_KEY', nil)\noso = OsoCloud::Oso.new(url: \"https://cloud.osohq.com\", api_key: api_key)\n\n# Basic query building\nactor = OsoCloud::Value.new(type: \"User\", id: \"alice\")\nrepository = OsoCloud::Value.new(type: \"Repository\", id: \"anvils\")\nquery = oso.build_query([\"allow\", actor, \"read\", repository])\nresult = query.evaluate(repository)\n\n# Add constraints with 'and_'\nfolder = OsoCloud::Value.new(type: \"Folder\", id: \"docs\")\nconstrained_query = oso.build_query([\"allow\", actor, \"read\", repository])\n  .and_([\"has_relation\", repository, \"folder\", folder])\n\n# Different evaluation modes\nexists = query.evaluate()                           # Boolean\nactions = query.evaluate(\"action\")                  # Single variable\npairs = query.evaluate([\"action\", \"repository\"])    # Tuple variables\n"
      - lang: csharp
        label: C#
        source: "using OsoCloud;\n\nstring? apiKey = Environment.GetEnvironmentVariable(\"OSO_CLOUD_API_KEY\");\nvar oso = new Oso(\"https://api.osohq.com\", apiKey);\n\n// Basic query building\nvar actor = new Value(\"User\", \"alice\");\nvar repository = new Value(\"Repository\", \"anvils\");\nvar query = oso.BuildQuery(\"allow\", actor, \"read\", repository);\nvar result = await query.Evaluate(repository);\n\n// Add constraints with 'And'\nvar folder = new Value(\"Folder\", \"docs\");\nvar constrainedQuery = oso.BuildQuery(\"allow\", actor, \"read\", repository)\n    .And(\"has_relation\", repository, \"folder\", folder);\n\n// Different evaluation modes\nbool exists = await query.Evaluate();                          // Boolean\nvar actions = await query.Evaluate(\"action\");                  // Single variable\nvar pairs = await query.Evaluate(new[] { \"action\", \"repository\" }); // Tuple variables\n"
components:
  schemas:
    ListResult:
      type: object
      required:
      - results
      - next_page_token
      properties:
        results:
          type: array
          items:
            type: string
        next_page_token:
          description: Optional token for fetching the next page of results. Present when more results are available.
          type: string
          nullable: true
    Constraint:
      description: Constraints on a variable. All variables must have a type, and they may also be constrained to a set of values.
      type: object
      required:
      - type
      properties:
        type:
          description: The type of the variable.
          type: string
        ids:
          description: The possible values of the variable. `None` means the variable can be any value. `Some(["foo"])` means the variable must be exactly `"foo"`. `Some(["foo", "bar"])` means the variable can be either `"foo"` or `"bar"`. The latter is how we represent `In` expressions in the new Query API.
          type: array
          items:
            type: string
          nullable: true
    ApiError:
      type: object
      required:
      - message
      properties:
        message:
          type: string
    ListQuery:
      type: object
      required:
      - action
      - actor_id
      - actor_type
      - resource_type
      - page_size
      properties:
        actor_type:
          type: string
        actor_id:
          type: string
        action:
          type: string
        resource_type:
          type: string
        context_facts:
          default: []
          type: array
          items:
            $ref: '#/components/schemas/Fact'
        page_size:
          description: Required. Page size for pagination. Must be at least 10,000. Results will be paginated and a `next_page_token` will be included in the response if more results are available. Ignored when `page_token` is provided, since the page size is determined by the original request.
          default: 10000
          type: integer
          format: uint
          minimum: 10000
        page_token:
          description: Page token for fetching subsequent pages of results. Use the `next_page_token` from a previous response. When provided, `page_size` is ignored.
          default: null
          type: string
          nullable: true
    ActionsQuery:
      type: object
      required:
      - actor_id
      - actor_type
      - resource_id
      - resource_type
      properties:
        actor_type:
          type: string
        actor_id:
          type: string
        resource_type:
          type: string
        resource_id:
          type: string
        context_facts:
          default: []
          type: array
          items:
            $ref: '#/components/schemas/Fact'
    AuthorizeResourcesResult:
      type: object
      required:
      - results
      properties:
        results:
          type: array
          items:
            $ref: '#/components/schemas/Value'
    Query:
      description: A generic query comprising 1+ predicates conjuncted together.
      type: object
      required:
      - calls
      - constraints
      - context_facts
      - predicate
      properties:
        predicate:
          description: 'Predicate name and variable names.


            INVARIANT: all variable names must exist in `constraints`. This ensures that all variables at least have a type.'
          type: array
          items:
          - type: string
          - type: array
            items:
              type: string
          maxItems: 2
          minItems: 2
        calls:
          description: 'Predicate name and variable names.


            INVARIANT: all variable names must exist in `constraints`. This ensures that all variables at least have a type.'
          type: array
          items:
            type: array
            items:
            - type: string
            - type: array
              items:
                type: string
            maxItems: 2
            minItems: 2
        constraints:
          description: Map of variable names to their type and value(s). Every variable is at least typed and may also be constrained to a set of values.
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Constraint'
        context_facts:
          type: array
          items:
            $ref: '#/components/schemas/ConcreteFact'
    TypedId:
      type: object
      required:
      - id
      - type
      properties:
        type:
          type: string
        id:
          type: string
    ActionsResult:
      type: object
      required:
      - results
      properties:
        results:
          type: array
          items:
            type: string
    QueryDeprecated:
      type: object
      required:
      - fact
      properties:
        fact:
          $ref: '#/components/schemas/Fact'
        context_facts:
          default: []
          type: array
          items:
            $ref: '#/components/schemas/Fact'
    AuthorizeQuery:
      type: object
      required:
      - action
      - actor_id
      - actor_type
      - resource_id
      - resource_type
      properties:
        actor_type:
          type: string
        actor_id:
          type: string
        action:
          type: string
        resource_type:
          type: string
        resource_id:
          type: string
        context_facts:
          default: []
          type: array
          items:
            $ref: '#/components/schemas/Fact'
    Value:
      type: object
      properties:
        type:
          type: string
          nullable: true
        id:
          type: string
          nullable: true
    AuthorizeResult:
      type: object
      required:
      - allowed
      properties:
      

# --- truncated at 32 KB (33 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/oso/refs/heads/main/openapi/oso-check-api-api-openapi.yml