openapi: 3.1.0
info:
title: Permit.io Access Requests (EAP) Access Requests (EAP) Condition Sets API
description: '
Authorization as a service
'
version: 2.0.0
tags:
- name: Condition Sets
description: '
Condition sets are sets of objects that are dynamically defined based on conditions on the objects'' attributes.
Conditions sets allows you the flexibility of ABAC with the simplicity of RBAC.
There are currently two types of condition sets at the moment:
1) user set = the set of users that match all the specified conditions.
2) resource set = the set of resources that match all the specified conditions.
Examples:
- `us_based_employees` = {U1, ..., Un} = {all **users** who are *located in the US* and are *assigned the employee role*}
- `private_repos` = {R1, ..., Rn} = {all **resources** *of type repository* that *are private*}
We can then picture a **matrix** of assignment between *user sets* and *resource sets*.
Example:
If we check the checkbox where `us_based_employees` and `private_repos->clone` action intersect, we are setting a rule:
*all US based employees can clone private repos*.
'
paths:
/v2/schema/{proj_id}/{env_id}/condition_sets:
get:
tags:
- Condition Sets
summary: List Condition Sets
description: Lists all condition sets matching a filter.
operationId: list_condition_sets
parameters:
- description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").'
required: true
schema:
type: string
title: Proj Id
description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").'
example: my_project
name: proj_id
in: path
- description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").'
required: true
schema:
type: string
title: Env Id
description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").'
example: my_environment
name: env_id
in: path
- description: Text search for the condition sets name or key
required: false
schema:
type: string
title: Search
description: Text search for the condition sets name or key
name: search
in: query
- description: 'if provided, will return only the condition sets of the specified type. e.g: only user sets.'
required: false
schema:
allOf:
- $ref: '#/components/schemas/ConditionSetType'
description: 'if provided, will return only the condition sets of the specified type. e.g: only user sets.'
name: type
in: query
- description: Include total count in response
required: false
deprecated: true
schema:
type: boolean
title: Include Total Count
description: Include total count in response
default: false
name: include_total_count
in: query
- description: Page number of the results to fetch, starting at 1.
required: false
schema:
type: integer
minimum: 1.0
title: Page
description: Page number of the results to fetch, starting at 1.
default: 1
name: page
in: query
- description: The number of results per page (max 100).
required: false
schema:
type: integer
maximum: 100.0
minimum: 1.0
title: Per Page
description: The number of results per page (max 100).
default: 30
name: per_page
in: query
responses:
'200':
description: Successful Response
content:
application/json:
schema:
anyOf:
- $ref: '#/components/schemas/PaginatedResult_ConditionSetRead_'
- items:
$ref: '#/components/schemas/ConditionSetRead'
type: array
title: Response List Condition Sets V2 Schema Proj Id Env Id Condition Sets Get
'422':
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- HTTPBearer: []
post:
tags:
- Condition Sets
summary: Create Condition Set
description: Creates a new condition set (can be either a user set or a resource set).
operationId: create_condition_set
parameters:
- description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").'
required: true
schema:
type: string
title: Proj Id
description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").'
example: my_project
name: proj_id
in: path
- description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").'
required: true
schema:
type: string
title: Env Id
description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").'
example: my_environment
name: env_id
in: path
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/ConditionSetCreate'
required: true
responses:
'200':
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/ConditionSetRead'
'422':
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- HTTPBearer: []
/v2/schema/{proj_id}/{env_id}/condition_sets/{condition_set_id}:
get:
tags:
- Condition Sets
summary: Get Condition Set
description: Gets a single condition set, if such condition set exists.
operationId: get_condition_set
parameters:
- description: 'Either the unique id of the condition set, or the URL-friendly key of the condition set (i.e: the "slug").'
required: true
schema:
type: string
title: Condition Set Id
description: 'Either the unique id of the condition set, or the URL-friendly key of the condition set (i.e: the "slug").'
name: condition_set_id
in: path
- description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").'
required: true
schema:
type: string
title: Proj Id
description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").'
example: my_project
name: proj_id
in: path
- description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").'
required: true
schema:
type: string
title: Env Id
description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").'
example: my_environment
name: env_id
in: path
responses:
'200':
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/ConditionSetRead'
'422':
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- HTTPBearer: []
delete:
tags:
- Condition Sets
summary: Delete Condition Set
description: 'Deletes a condition set and all its related data.
This includes any permissions granted to said condition set (i.e: any matching condition set users_with_role).'
operationId: delete_condition_set
parameters:
- description: 'Either the unique id of the condition set, or the URL-friendly key of the condition set (i.e: the "slug").'
required: true
schema:
type: string
title: Condition Set Id
description: 'Either the unique id of the condition set, or the URL-friendly key of the condition set (i.e: the "slug").'
name: condition_set_id
in: path
- description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").'
required: true
schema:
type: string
title: Proj Id
description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").'
example: my_project
name: proj_id
in: path
- description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").'
required: true
schema:
type: string
title: Env Id
description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").'
example: my_environment
name: env_id
in: path
responses:
'204':
description: Successful Response
'422':
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- HTTPBearer: []
patch:
tags:
- Condition Sets
summary: Update Condition Set
description: 'Partially updates a condition set.
Fields that will be provided will be completely overwritten.'
operationId: update_condition_set
parameters:
- description: 'Either the unique id of the condition set, or the URL-friendly key of the condition set (i.e: the "slug").'
required: true
schema:
type: string
title: Condition Set Id
description: 'Either the unique id of the condition set, or the URL-friendly key of the condition set (i.e: the "slug").'
name: condition_set_id
in: path
- description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").'
required: true
schema:
type: string
title: Proj Id
description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").'
example: my_project
name: proj_id
in: path
- description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").'
required: true
schema:
type: string
title: Env Id
description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").'
example: my_environment
name: env_id
in: path
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/ConditionSetUpdate'
required: true
responses:
'200':
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/ConditionSetRead'
'422':
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- HTTPBearer: []
/v2/schema/{proj_id}/{env_id}/condition_sets/{condition_set_id}/ancestors:
get:
tags:
- Condition Sets
summary: Get Condition Set Ancestors
description: Gets all ancestors (parent, parent of parent, and so on)
operationId: get_condition_set_ancestors
parameters:
- description: 'Either the unique id of the condition set, or the URL-friendly key of the condition set (i.e: the "slug").'
required: true
schema:
type: string
title: Condition Set Id
description: 'Either the unique id of the condition set, or the URL-friendly key of the condition set (i.e: the "slug").'
name: condition_set_id
in: path
- description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").'
required: true
schema:
type: string
title: Proj Id
description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").'
example: my_project
name: proj_id
in: path
- description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").'
required: true
schema:
type: string
title: Env Id
description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").'
example: my_environment
name: env_id
in: path
- description: Page number of the results to fetch, starting at 1.
required: false
schema:
type: integer
minimum: 1.0
title: Page
description: Page number of the results to fetch, starting at 1.
default: 1
name: page
in: query
- description: The number of results per page (max 100).
required: false
schema:
type: integer
maximum: 100.0
minimum: 1.0
title: Per Page
description: The number of results per page (max 100).
default: 30
name: per_page
in: query
responses:
'200':
description: Successful Response
content:
application/json:
schema:
items:
$ref: '#/components/schemas/ConditionSetRead'
type: array
title: Response Get Condition Set Ancestors V2 Schema Proj Id Env Id Condition Sets Condition Set Id Ancestors Get
'422':
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- HTTPBearer: []
/v2/schema/{proj_id}/{env_id}/condition_sets/{condition_set_id}/descendants:
get:
tags:
- Condition Sets
summary: Get Condition Set Descendants
description: Gets all descendants (children, children of children, and so on)
operationId: get_condition_set_descendants
parameters:
- description: 'Either the unique id of the condition set, or the URL-friendly key of the condition set (i.e: the "slug").'
required: true
schema:
type: string
title: Condition Set Id
description: 'Either the unique id of the condition set, or the URL-friendly key of the condition set (i.e: the "slug").'
name: condition_set_id
in: path
- description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").'
required: true
schema:
type: string
title: Proj Id
description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").'
example: my_project
name: proj_id
in: path
- description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").'
required: true
schema:
type: string
title: Env Id
description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").'
example: my_environment
name: env_id
in: path
- description: Page number of the results to fetch, starting at 1.
required: false
schema:
type: integer
minimum: 1.0
title: Page
description: Page number of the results to fetch, starting at 1.
default: 1
name: page
in: query
- description: The number of results per page (max 100).
required: false
schema:
type: integer
maximum: 100.0
minimum: 1.0
title: Per Page
description: The number of results per page (max 100).
default: 30
name: per_page
in: query
responses:
'200':
description: Successful Response
content:
application/json:
schema:
items:
$ref: '#/components/schemas/ConditionSetRead'
type: array
title: Response Get Condition Set Descendants V2 Schema Proj Id Env Id Condition Sets Condition Set Id Descendants Get
'422':
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- HTTPBearer: []
components:
schemas:
ConditionSetType:
type: string
enum:
- userset
- resourceset
title: ConditionSetType
description: An enumeration.
PaginatedResult_ConditionSetRead_:
properties:
data:
items:
$ref: '#/components/schemas/ConditionSetRead'
type: array
title: Data
description: List of Condition Sets
total_count:
type: integer
minimum: 0.0
title: Total Count
page_count:
type: integer
minimum: 0.0
title: Page Count
default: 0
additionalProperties: false
type: object
required:
- data
- total_count
title: PaginatedResult[ConditionSetRead]
AttributeBlockRead:
properties:
type:
allOf:
- $ref: '#/components/schemas/AttributeType'
description: 'The type of the attribute, we currently support: `bool`, `number` (ints, floats), `time` (a timestamp), `string`, and `json`.'
description:
type: string
title: Description
description: optional description string explaining what data this attribute will store
id:
type: string
format: uuid
title: Id
description: Unique id of the attribute
key:
type: string
title: Key
description: action key
additionalProperties: false
type: object
required:
- type
- id
title: AttributeBlockRead
ConditionSetCreate:
properties:
key:
type: string
minLength: 1
pattern: ^[A-Za-z0-9\-_]+$
title: Key
description: A unique id by which Permit will identify the condition set. The key will be used as the generated rego rule name.
type:
allOf:
- $ref: '#/components/schemas/ConditionSetType'
description: 'the type of the set: UserSet or ResourceSet'
default: userset
autogenerated:
type: boolean
title: Autogenerated
description: whether the set was autogenerated by the system.
default: false
resource_id:
anyOf:
- type: string
- type: string
format: uuid
title: Resource Id
description: For ResourceSets, the id of the base resource.
name:
type: string
title: Name
description: 'A descriptive name for the set, i.e: ''US based employees'' or ''Users behind VPN'''
description:
type: string
title: Description
description: an optional longer description of the set
conditions:
type: object
title: Conditions
description: a boolean expression that consists of multiple conditions, with and/or logic.
default: {}
parent_id:
anyOf:
- type: string
- type: string
format: uuid
title: Parent Id
description: Parent Condition Set
additionalProperties: false
type: object
required:
- key
- name
title: ConditionSetCreate
example:
key: na_based_employees
name: US or Canada based employees
type: userset
conditions:
allOf:
- user.role:
equals: employee
- user.location:
in:
- US
- Canada
permit_backend__schemas__schema_derived_role_rule__DerivationSettings:
properties:
no_direct_roles_on_object:
type: boolean
title: No Direct Roles On Object
description: If true, the derived role or the specific rule will not apply if the resource has any direct role
default: false
additionalProperties: false
type: object
title: DerivationSettings
description: Settings for a derived role or a derived role rule
HTTPValidationError:
properties:
detail:
items:
$ref: '#/components/schemas/ValidationError'
type: array
title: Detail
type: object
title: HTTPValidationError
DerivedRoleBlockRead:
properties:
when:
allOf:
- $ref: '#/components/schemas/permit_backend__schemas__schema_derived_role_rule__DerivationSettings'
title: When
description: the settings of the derived role
default:
no_direct_roles_on_object: false
id:
type: string
format: uuid
title: Id
description: The unique id of the derived_role
users_with_role:
items:
$ref: '#/components/schemas/DerivedRoleRuleRead'
type: array
title: Users With Role
description: the rules of the derived role
default: []
additionalProperties: false
type: object
required:
- id
title: DerivedRoleBlockRead
example:
id: 970eb6a2-af5a-4173-b291-dbbc00d8b5e3
users_with_role:
- role: Admin
on_resource: organization
linked_by_relation: owner
role_id: 7a972455-b010-4649-badb-08fe265490a0
resource_id: 12359938-c5ff-42ca-af2d-3024f92bd0be
relation_id: fe1ea573-34ef-4969-a3c4-284ae998045f
ValidationError:
properties:
loc:
items:
anyOf:
- type: string
- type: integer
type: array
title: Location
msg:
type: string
title: Message
type:
type: string
title: Error Type
type: object
required:
- loc
- msg
- type
title: ValidationError
RelationBlockRead:
properties:
description:
type: string
title: Description
description: An optional longer description of what this relation represents in your system
resource_id:
type: string
format: uuid
title: Resource Id
description: Unique id of the relation
relation_name:
type: string
title: Relation Name
description: a more descriptive name for the relation
hidden_from_schema: true
resource:
type: string
title: Resource
description: The resource key
additionalProperties: false
type: object
required:
- resource_id
- resource
title: RelationBlockRead
example:
resource_id: 3cb94048-6459-49c0-a895-a8202de7390c
relation_name: parent
resource: parent-resource
AttributeType:
type: string
enum:
- bool
- number
- string
- time
- array
- json
- object
- object_array
title: AttributeType
description: supported attribute primitives
DerivedRoleRuleRead:
properties:
role_id:
type: string
format: uuid
title: Role Id
description: the role id that needs to exist on the related resource (from the relation)
resource_id:
type: string
format: uuid
title: Resource Id
description: the resource id that needs to exist on the related role (from the relation)
relation_id:
type: string
format: uuid
title: Relation Id
description: the relation id that needs to exist between the resource and the related resource
role:
type: string
title: Role
description: the role key that needs to exist on the related resource (from the relation)
on_resource:
type: string
title: On Resource
description: the resource key that needs to exist on the related role (from the relation)
linked_by_relation:
type: string
title: Linked By Relation
description: the relation key that needs to exist between the resource and the related resource
when:
allOf:
- $ref: '#/components/schemas/permit_backend__schemas__schema_derived_role_rule__DerivationSettings'
title: When
description: the settings of the derived role rule
default:
no_direct_roles_on_object: false
additionalProperties: false
type: object
required:
- role_id
- resource_id
- relation_id
- role
- on_resource
- linked_by_relation
title: DerivedRoleRuleRead
example:
role: Admin
on_resource: organization
linked_by_relation: owner
role_id: 7a972455-b010-4649-badb-08fe265490a0
resource_id: 12359938-c5ff-42ca-af2d-3024f92bd0be
relation_id: fe1ea573-34ef-4969-a3c4-284ae998045f
ConditionSetRead:
properties:
key:
type: string
title: Key
description: A unique id by which Permit will identify the condition set. The key will be used as the generated rego rule name.
type:
allOf:
- $ref: '#/components/schemas/ConditionSetType'
description: 'the type of the set: UserSet or ResourceSet'
default: userset
autogenerated:
type: boolean
title: Autogenerated
description: whether the set was autogenerated by the system.
default: false
resource_id:
anyOf:
- type: string
- type: string
format: uuid
title: Resource Id
description: For ResourceSets, the id of the base resource.
id:
type: string
format: uuid
title: Id
description: Unique id of the condition set
organization_id:
type: string
format: uuid
title: Organization Id
description: Unique id of the organization that the condition set belongs to.
project_id:
type: string
format: uuid
title: Project Id
description: Unique id of the project that the condition set belongs to.
environment_id:
type: string
format: uuid
title: Environment Id
description: Unique id of the environment that the condition set belongs to.
created_at:
type: string
format: date-time
title: Created At
description: Date and time when the condition set was created (ISO_8601 format).
updated_at:
type: string
format: date-time
title: Updated At
description: Date and time when the condition set was last updated/modified (ISO_8601 format).
resource:
$ref: '#/components/schemas/ResourceRead'
name:
type: string
title: Name
description: 'A descriptive name for the set, i.e: ''US based employees'' or ''Users behind VPN'''
description:
type: string
title: Description
description: an optional longer description of the set
conditions:
type: object
title: Conditions
description: a boolean expression that consists of multiple conditions, with and/or logic.
default: {}
parent_id:
anyOf:
- type: string
- type: string
format: uuid
title: Parent Id
description: Parent Condition Set
additionalProperties: false
type: object
required:
- key
- id
- organization_id
- project_id
- environment_id
- created_at
- updated_at
- name
title: ConditionSetRead
example:
id: 497f6eca-6276-4993-bfeb-53cbbbba6f08
organization_id: 7c60d51f-b44e-4682-87d6-449835ea4de6
project_id: 405d8375-3514-403b-8c43-83ae74cfe0e9
resource_id: e05f8571-f31e-20b2-2c45-15ae74cfb0f1
environment_id: 40ef0e48-a11f-4963-a229-e396c9f7e7c4
created_at: '2019-08-24T14:15:22Z'
updated_at: '2019-08-24T14:15:22Z'
key: na_based_employees
name: US or Canada based employees
description: All employees based in the US or Canada
type: userset
autogenerated: false
conditions:
allOf:
- user.role:
equals: employee
- user.location:
in:
- US
- Canada
ConditionSetUpdate:
properties:
name:
type: string
title: Name
description: 'A descriptive name for the set, i.e: ''US based employees'' or ''Users behind VPN'''
description:
type: string
title: Description
description: an optional longer description of the set
conditions:
type: object
title: Conditions
description: a boolean expression that consists of multiple conditions, with and/or logic.
default: {}
parent_id:
anyOf:
- type: string
- type: string
format: uuid
title: Parent Id
description: Parent Condition Set
additionalProperties: false
type: object
title: ConditionSetUpdate
example:
name: US based managers
conditions:
allOf:
- user.role:
equals: manager
- user.location:
in:
- US
ResourceRead:
properties:
key:
type: string
title: Key
description: 'A URL-friendly name of the resource (i.e: slug). You will be able to query later using this key instead of the id (UUID) of the resource.'
id:
type: string
format: uuid
title: Id
description: Unique id of the resource
organization_id:
type: string
format: uuid
title: Organization Id
description: Unique id of the organization that the resource belongs to.
project_id:
type: string
format: uuid
title: Project Id
description: Unique id of the project that the resource belongs to.
environment_id:
type: string
format: uuid
title: Environment Id
description: Unique id of the environment that the resource belongs to.
created_at:
type: string
format: date-time
title: Created At
description: Date and time when the resource was created (ISO_8601 format).
updated_at:
type: string
format: date-time
title: Updated At
description: Date and time when the resource was last updated/modified (ISO_8601 format).
name:
type: string
title: Name
description: The name of the resource
urn:
type: string
title: Urn
description: The [URN](https://en.wikipedia.org/wiki/Unif
# --- truncated at 32 KB (42 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/permit-io/refs/heads/main/openapi/permit-io-condition-sets-api-openapi.yml