Virtru authorization.v2.AuthorizationService API
The authorization.v2.AuthorizationService API from Virtru — 4 operation(s) for authorization.v2.authorizationservice.
OpenAPI Specification
openapi: 3.1.0
info:
title: authorization authorization.AuthorizationService authorization.v2.AuthorizationService API
security: []
tags:
- name: authorization.v2.AuthorizationService
paths:
/authorization.v2.AuthorizationService/GetDecision:
post:
tags:
- authorization.v2.AuthorizationService
summary: GetDecision
operationId: authorization.v2.AuthorizationService.GetDecision
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/authorization.v2.GetDecisionRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/authorization.v2.GetDecisionResponse'
/authorization.v2.AuthorizationService/GetDecisionMultiResource:
post:
tags:
- authorization.v2.AuthorizationService
summary: GetDecisionMultiResource
operationId: authorization.v2.AuthorizationService.GetDecisionMultiResource
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/authorization.v2.GetDecisionMultiResourceRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/authorization.v2.GetDecisionMultiResourceResponse'
/authorization.v2.AuthorizationService/GetDecisionBulk:
post:
tags:
- authorization.v2.AuthorizationService
summary: GetDecisionBulk
operationId: authorization.v2.AuthorizationService.GetDecisionBulk
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/authorization.v2.GetDecisionBulkRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/authorization.v2.GetDecisionBulkResponse'
/authorization.v2.AuthorizationService/GetEntitlements:
post:
tags:
- authorization.v2.AuthorizationService
summary: GetEntitlements
operationId: authorization.v2.AuthorizationService.GetEntitlements
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/authorization.v2.GetEntitlementsRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/authorization.v2.GetEntitlementsResponse'
components:
schemas:
policy.PublicKey:
type: object
oneOf:
- properties:
cached:
title: cached
description: public key with additional information. Current preferred version
$ref: '#/components/schemas/policy.KasPublicKeySet'
title: cached
required:
- cached
- properties:
remote:
type: string
title: remote
description: 'kas public key url - optional since can also be retrieved via public key
URI must be a valid URL (e.g., ''https://demo.com/'') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.:
```
this.matches(''^https://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$'')
```
'
title: remote
required:
- remote
title: PublicKey
additionalProperties: false
description: Deprecated
policy.Algorithm:
type: string
title: Algorithm
enum:
- ALGORITHM_UNSPECIFIED
- ALGORITHM_RSA_2048
- ALGORITHM_RSA_4096
- ALGORITHM_EC_P256
- ALGORITHM_EC_P384
- ALGORITHM_EC_P521
- ALGORITHM_HPQT_XWING
- ALGORITHM_HPQT_SECP256R1_MLKEM768
- ALGORITHM_HPQT_SECP384R1_MLKEM1024
- ALGORITHM_MLKEM_768
- ALGORITHM_MLKEM_1024
description: Supported key algorithms.
authorization.v2.Resource:
type: object
oneOf:
- properties:
attributeValues:
title: attribute_values
description: 'a set of attribute value FQNs, such as those on a TDF, containing at least 1 value
if provided, resource.attribute_values must contain at least 1 valid FQN:
```
this.fqns.size() > 0 && this.fqns.all(item, item.isUri())
```
'
$ref: '#/components/schemas/authorization.v2.Resource.AttributeValues'
title: attribute_values
required:
- attributeValues
- properties:
registeredResourceValueFqn:
type: string
title: registered_resource_value_fqn
minLength: 1
format: uri
description: fully qualified name of the registered resource value stored in platform policy
title: registered_resource_value_fqn
required:
- registeredResourceValueFqn
properties:
ephemeralId:
type: string
title: ephemeral_id
description: ephemeral id for tracking between request and response
title: Resource
additionalProperties: false
description: Either a set of attribute values (such as those on a TDF) or a registered resource value
policy.SourceType:
type: string
title: SourceType
enum:
- SOURCE_TYPE_UNSPECIFIED
- SOURCE_TYPE_INTERNAL
- SOURCE_TYPE_EXTERNAL
description: "Describes whether this kas is managed by the organization or if they imported\n the kas information from an external party. These two modes are necessary in order\n to encrypt a tdf dek with an external parties kas public key."
authorization.v2.GetDecisionResponse:
type: object
properties:
decision:
title: decision
description: decision on the resource
$ref: '#/components/schemas/authorization.v2.ResourceDecision'
title: GetDecisionResponse
additionalProperties: false
common.Metadata:
type: object
properties:
createdAt:
title: created_at
description: created_at set by server (entity who created will recorded in an audit event)
$ref: '#/components/schemas/google.protobuf.Timestamp'
updatedAt:
title: updated_at
description: updated_at set by server (entity who updated will recorded in an audit event)
$ref: '#/components/schemas/google.protobuf.Timestamp'
labels:
type: object
title: labels
additionalProperties:
type: string
title: value
description: optional short description
title: Metadata
additionalProperties: false
description: Struct to uniquely identify a resource with optional additional metadata
connect-protocol-version:
type: number
title: Connect-Protocol-Version
enum:
- 1
description: Define the version of the Connect protocol
const: 1
authorization.v2.GetEntitlementsResponse:
type: object
properties:
entitlements:
type: array
items:
$ref: '#/components/schemas/authorization.v2.EntityEntitlements'
title: entitlements
title: GetEntitlementsResponse
additionalProperties: false
google.protobuf.Any:
type: object
properties:
type:
type: string
value:
type: string
format: binary
debug:
type: object
additionalProperties: true
additionalProperties: true
description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message.
entity.Entity:
type: object
oneOf:
- properties:
claims:
title: claims
description: used by ERS claims mode
$ref: '#/components/schemas/google.protobuf.Any'
title: claims
required:
- claims
- properties:
clientId:
type: string
title: client_id
title: client_id
required:
- clientId
- properties:
emailAddress:
type: string
title: email_address
title: email_address
required:
- emailAddress
- properties:
userName:
type: string
title: user_name
title: user_name
required:
- userName
properties:
ephemeralId:
type: string
title: ephemeral_id
description: ephemeral id for tracking between request and response
category:
title: category
$ref: '#/components/schemas/entity.Entity.Category'
title: Entity
additionalProperties: false
description: PE (Person Entity) or NPE (Non-Person Entity)
authorization.v2.GetDecisionBulkRequest:
type: object
properties:
decisionRequests:
type: array
items:
$ref: '#/components/schemas/authorization.v2.GetDecisionMultiResourceRequest'
title: decision_requests
minItems: 1
title: GetDecisionBulkRequest
additionalProperties: false
description: "Is access allowed?\n 1. Multiplexing of a Decision<EntityIdentifier, Action, repeated Resource> request\n This is a more performant bulk request for complex decisioning (i.e. multiple entity chains or actions on\n multiple resources)"
policy.KasPublicKey:
type: object
properties:
pem:
type: string
title: pem
maxLength: 8192
minLength: 1
description: x509 ASN.1 content in PEM envelope, usually
kid:
type: string
title: kid
maxLength: 32
minLength: 1
description: A unique string identifier for this key
alg:
not:
enum:
- 0
title: alg
description: "A known algorithm type with any additional parameters encoded.\n To start, these may be `rsa:2048` for RSA-based wrapping and\n `ec:secp256r1` for EC-based wrapping, but more formats may be added as needed."
$ref: '#/components/schemas/policy.KasPublicKeyAlgEnum'
title: KasPublicKey
additionalProperties: false
description: "Deprecated\n A KAS public key and some associated metadata for further identifcation"
policy.KeyAccessServer:
type: object
properties:
id:
type: string
title: id
uri:
type: string
title: uri
description: 'Address of a KAS instance
URI must be a valid URL (e.g., ''https://demo.com/'') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.:
```
this.matches(''^https?://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/.*)?$'')
```
'
publicKey:
title: public_key
description: 'Deprecated: KAS can have multiple key pairs'
$ref: '#/components/schemas/policy.PublicKey'
sourceType:
title: source_type
description: 'The source of the KAS: (INTERNAL, EXTERNAL)'
$ref: '#/components/schemas/policy.SourceType'
kasKeys:
type: array
items:
$ref: '#/components/schemas/policy.SimpleKasKey'
title: kas_keys
description: Kas keys associated with this KAS
name:
type: string
title: name
description: "Optional\n Unique name of the KAS instance"
metadata:
title: metadata
description: Common metadata
$ref: '#/components/schemas/common.Metadata'
title: KeyAccessServer
additionalProperties: false
description: Key Access Server Registry
authorization.v2.EntityEntitlements.ActionsList:
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/policy.Action'
title: actions
title: ActionsList
additionalProperties: false
authorization.v2.GetDecisionMultiResourceResponse:
type: object
properties:
allPermitted:
title: all_permitted
description: convenience flag indicating global resource decisions result (permit/deny)
$ref: '#/components/schemas/google.protobuf.BoolValue'
resourceDecisions:
type: array
items:
$ref: '#/components/schemas/authorization.v2.ResourceDecision'
title: resource_decisions
description: individual resource decisions
title: GetDecisionMultiResourceResponse
additionalProperties: false
google.protobuf.Timestamp:
type: string
examples:
- 1s
- 1.000340012s
format: date-time
description: "A Timestamp represents a point in time independent of any time zone or local\n calendar, encoded as a count of seconds and fractions of seconds at\n nanosecond resolution. The count is relative to an epoch at UTC midnight on\n January 1, 1970, in the proleptic Gregorian calendar which extends the\n Gregorian calendar backwards to year one.\n\n All minutes are 60 seconds long. Leap seconds are \"smeared\" so that no leap\n second table is needed for interpretation, using a [24-hour linear\n smear](https://developers.google.com/time/smear).\n\n The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By\n restricting to that range, we ensure that we can convert to and from [RFC\n 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings.\n\n # Examples\n\n Example 1: Compute Timestamp from POSIX `time()`.\n\n Timestamp timestamp;\n timestamp.set_seconds(time(NULL));\n timestamp.set_nanos(0);\n\n Example 2: Compute Timestamp from POSIX `gettimeofday()`.\n\n struct timeval tv;\n gettimeofday(&tv, NULL);\n\n Timestamp timestamp;\n timestamp.set_seconds(tv.tv_sec);\n timestamp.set_nanos(tv.tv_usec * 1000);\n\n Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`.\n\n FILETIME ft;\n GetSystemTimeAsFileTime(&ft);\n UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;\n\n // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z\n // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.\n Timestamp timestamp;\n timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));\n timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));\n\n Example 4: Compute Timestamp from Java `System.currentTimeMillis()`.\n\n long millis = System.currentTimeMillis();\n\n Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)\n .setNanos((int) ((millis % 1000) * 1000000)).build();\n\n Example 5: Compute Timestamp from Java `Instant.now()`.\n\n Instant now = Instant.now();\n\n Timestamp timestamp =\n Timestamp.newBuilder().setSeconds(now.getEpochSecond())\n .setNanos(now.getNano()).build();\n\n Example 6: Compute Timestamp from current time in Python.\n\n timestamp = Timestamp()\n timestamp.GetCurrentTime()\n\n # JSON Mapping\n\n In JSON format, the Timestamp type is encoded as a string in the\n [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the\n format is \"{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z\"\n where {year} is always expressed using four digits while {month}, {day},\n {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional\n seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution),\n are optional. The \"Z\" suffix indicates the timezone (\"UTC\"); the timezone\n is required. A proto3 JSON serializer should always use UTC (as indicated by\n \"Z\") when printing the Timestamp type and a proto3 JSON parser should be\n able to accept both UTC and other timezones (as indicated by an offset).\n\n For example, \"2017-01-15T01:30:15.01Z\" encodes 15.01 seconds past\n 01:30 UTC on January 15, 2017.\n\n In JavaScript, one can convert a Date object to this format using the\n standard\n [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString)\n method. In Python, a standard `datetime.datetime` object can be converted\n to this format using\n [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with\n the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use\n the Joda Time's [`ISODateTimeFormat.dateTime()`](\n http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime()\n ) to obtain a formatter capable of generating timestamps in this format."
authorization.v2.GetEntitlementsRequest:
type: object
properties:
entityIdentifier:
title: entity_identifier
description: an entity must be identified for entitlement decisioning
$ref: '#/components/schemas/authorization.v2.EntityIdentifier'
withComprehensiveHierarchy:
type: boolean
title: with_comprehensive_hierarchy
description: "optional parameter to return all entitled values for attribute definitions with hierarchy rules, propagating\n down the hierarchical values instead of returning solely the value that is directly entitled"
nullable: true
title: GetEntitlementsRequest
required:
- entityIdentifier
additionalProperties: false
description: "What is permitted to the identified entity/entities (actor), broken down as permitted actions on attribute value FQNs?\n\n Note: the v1 API parameter 'scope' has been dropped, and it is recommended to use\n GetDecision if the resource is known"
policy.Action.StandardAction:
type: string
title: StandardAction
enum:
- STANDARD_ACTION_UNSPECIFIED
- STANDARD_ACTION_DECRYPT
- STANDARD_ACTION_TRANSMIT
entity.Token:
type: object
properties:
ephemeralId:
type: string
title: ephemeral_id
description: ephemeral id for tracking between request and response
jwt:
type: string
title: jwt
description: the token
title: Token
required:
- jwt
additionalProperties: false
authorization.v2.EntityEntitlements:
type: object
properties:
ephemeralId:
type: string
title: ephemeral_id
description: ephemeral id for tracking between request and response
actionsPerAttributeValueFqn:
type: object
title: actions_per_attribute_value_fqn
additionalProperties:
title: value
$ref: '#/components/schemas/authorization.v2.EntityEntitlements.ActionsList'
title: EntityEntitlements
additionalProperties: false
description: Entitlements for a given entity, mapping each attribute value FQN to any entitled actions[]
policy.KasPublicKeyAlgEnum:
type: string
title: KasPublicKeyAlgEnum
enum:
- KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED
- KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048
- KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096
- KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1
- KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1
- KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1
- KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING
- KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768
- KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024
- KAS_PUBLIC_KEY_ALG_ENUM_MLKEM_768
- KAS_PUBLIC_KEY_ALG_ENUM_MLKEM_1024
authorization.v2.GetDecisionBulkResponse:
type: object
properties:
decisionResponses:
type: array
items:
$ref: '#/components/schemas/authorization.v2.GetDecisionMultiResourceResponse'
title: decision_responses
title: GetDecisionBulkResponse
additionalProperties: false
authorization.v2.ResourceDecision:
type: object
properties:
ephemeralResourceId:
type: string
title: ephemeral_resource_id
description: ephemeral id for tracking between request and response
decision:
title: decision
description: decision result
$ref: '#/components/schemas/authorization.v2.Decision'
requiredObligations:
type: array
items:
type: string
title: required_obligations
description: "obligations (fully qualified values) the PEP is required to fulfill on the given resource\n i.e. https://<namespace>/obl/<definition name>/value/<value>"
title: ResourceDecision
additionalProperties: false
policy.SimpleKasPublicKey:
type: object
properties:
algorithm:
title: algorithm
$ref: '#/components/schemas/policy.Algorithm'
kid:
type: string
title: kid
pem:
type: string
title: pem
title: SimpleKasPublicKey
additionalProperties: false
entity.Entity.Category:
type: string
title: Category
enum:
- CATEGORY_UNSPECIFIED
- CATEGORY_SUBJECT
- CATEGORY_ENVIRONMENT
entity.EntityChain:
type: object
properties:
ephemeralId:
type: string
title: ephemeral_id
description: ephemeral id for tracking between request and response
entities:
type: array
items:
$ref: '#/components/schemas/entity.Entity'
title: entities
title: EntityChain
additionalProperties: false
description: A set of related PE and NPE
authorization.v2.Resource.AttributeValues:
type: object
properties:
fqns:
type: array
items:
type: string
title: fqns
title: AttributeValues
additionalProperties: false
policy.Action:
type: object
oneOf:
- properties:
custom:
type: string
title: custom
description: Deprecated
title: custom
required:
- custom
- properties:
standard:
title: standard
description: Deprecated
$ref: '#/components/schemas/policy.Action.StandardAction'
title: standard
required:
- standard
properties:
id:
type: string
title: id
description: Generated uuid in database
name:
type: string
title: name
namespace:
title: namespace
description: Namespace context for this action
$ref: '#/components/schemas/policy.Namespace'
metadata:
title: metadata
$ref: '#/components/schemas/common.Metadata'
title: Action
additionalProperties: false
description: An action an entity can take
policy.SimpleKasKey:
type: object
properties:
kasUri:
type: string
title: kas_uri
description: The URL of the Key Access Server
publicKey:
title: public_key
description: The public key of the Key that belongs to the KAS
$ref: '#/components/schemas/policy.SimpleKasPublicKey'
kasId:
type: string
title: kas_id
description: The ID of the Key Access Server
title: SimpleKasKey
additionalProperties: false
authorization.v2.GetDecisionRequest:
type: object
properties:
entityIdentifier:
title: entity_identifier
description: an entity must be identified for authorization decisioning
$ref: '#/components/schemas/authorization.v2.EntityIdentifier'
action:
title: action
description: name on action is required
$ref: '#/components/schemas/policy.Action'
resource:
title: resource
$ref: '#/components/schemas/authorization.v2.Resource'
fulfillableObligationFqns:
type: array
items:
type: string
description: 'if provided, fulfillable_obligation_fqns must contain only valid FQNs:
```
this.size() == 0 || this.all(item, item.isUri())
```
'
title: fulfillable_obligation_fqns
description: "obligations (fully qualified values) the requester is capable of fulfilling\n i.e. https://<namespace>/obl/<definition name>/value/<value>\nif provided, fulfillable_obligation_fqns must contain only valid FQNs:\n```\nthis.size() == 0 || this.all(item, item.isUri())\n```\n\n"
title: GetDecisionRequest
required:
- entityIdentifier
- action
- resource
additionalProperties: false
description: "Can the identified entity/entities access?\n 1. one entity reference (actor)\n 2. one action\n 3. one resource\n\n If entitled, checks obligation policy: fulfillable obligations must satisfy all triggered.\naction.name must be provided:\n```\nhas(this.action.name)\n```\n\n"
authorization.v2.GetDecisionMultiResourceRequest:
type: object
properties:
entityIdentifier:
title: entity_identifier
description: an entity must be identified for authorization decisioning
$ref: '#/components/schemas/authorization.v2.EntityIdentifier'
action:
title: action
description: name on action is required
$ref: '#/components/schemas/policy.Action'
resources:
type: array
items:
$ref: '#/components/schemas/authorization.v2.Resource'
title: resources
minItems: 1
fulfillableObligationFqns:
type: array
items:
type: string
description: 'if provided, fulfillable_obligation_fqns must contain only valid FQNs:
```
this.size() == 0 || this.all(item, item.isUri())
```
'
title: fulfillable_obligation_fqns
description: "obligations (fully qualified values) the requester is capable of fulfilling\n i.e. https://<namespace>/obl/<definition name>/value/<value>\nif provided, fulfillable_obligation_fqns must contain only valid FQNs:\n```\nthis.size() == 0 || this.all(item, item.isUri())\n```\n\n"
title: GetDecisionMultiResourceRequest
required:
- entityIdentifier
- action
additionalProperties: false
description: "Can the identified entity/entities access?\n 1. one entity reference (actor)\n 2. one action\n 3. multiple resources\n\n If entitled, checks obligation policy: fulfillable obligations must satisfy all triggered.\n\n Note: this is a more performant bulk request for multiple resource decisions\naction.name must be provided:\n```\nhas(this.action.name)\n```\n\n"
policy.KasPublicKeySet:
type: object
properties:
keys:
type: array
items:
$ref: '#/components/schemas/policy.KasPublicKey'
title: keys
title: KasPublicKeySet
additionalProperties: false
description: "Deprecated\n A list of known KAS public keys"
authorization.v2.EntityIdentifier:
type: object
oneOf:
- properties:
entityChain:
title: entity_chain
description: 'chain of one or more entities
entities must be provided and contain at least 1 entity:
```
has(this.entities) && this.entities.size() > 0
```
'
$ref: '#/components/schemas/entity.EntityChain'
title: entity_chain
required:
- entityChain
- properties:
registeredResourceValueFqn:
type: string
title: registered_resource_value_fqn
minLength: 1
format: uri
description: "fully qualified name of the registered resource value stored in platform policy, where in\n this case the resource acts as and represents a single entity for authorization/entitlement decisioning"
title: registered_resource_value_fqn
required:
- registeredResourceValueFqn
- properties:
token:
title: token
description: 'access token (JWT), which is used to create an entity chain (comprising one or more entities)
token must be provided:
```
has(this.jwt) && this.jwt.size() > 0
```
'
$ref: '#/components/schemas/entity.Token'
title: token
required:
- token
- properties:
withRequestToken:
title: with_request_token
description: 'derive the entity from the request''s authorization access token JWT, rather than passing in the body
with_request_token must be true when set:
```
this == true
```
'
$ref: '#/components/schemas/google.protobuf.BoolValue'
title: with_request_token
required:
- withRequestToken
title: EntityIdentifier
additionalProperties: false
description: "The EntityIdentifier specifies the actor in an entitlement or decision request - the PE, NPE, or PE+NPE being authorized.\n The abstraction houses the distinct entity types, PE and/or NPE combinations, or a registered resource value\n being treated as an entity in entitlement/authorization decisioning."
connect-timeout-header:
type: number
title: Connect-Timeout-Ms
description: Define the timeout, in ms
connect.error:
type: object
properties:
code:
type: string
examples:
- not_found
enum:
- canceled
- unknown
- invalid_argument
- deadline_exceeded
- not_found
- already_exists
- permission_denied
- resource_exhausted
- failed_precondition
- aborted
- out_of_ra
# --- truncated at 32 KB (34 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/virtru/refs/heads/main/openapi/virtru-authorization-v2-authorizationservice-api-openapi.yml