AccessControlEntryArray

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/vertesiahq/json-schema/vertesiahq-access-control-entry-array-schema.json",
  "title": "AccessControlEntryArray",
  "x-generated": "2026-11-10",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/vertesiahq-access-control-entries-api-openapi.yml#/components/schemas/AccessControlEntryArray",
  "type": "array",
  "items": {
    "$ref": "#/$defs/AccessControlEntry"
  },
  "$defs": {
    "AbacScope": {
      "type": "string",
      "enum": [
        "document",
        "collection",
        "agent_run",
        "shared_content",
        "task"
      ]
    },
    "AccessControlEntry": {
      "type": "object",
      "properties": {
        "role": {
          "type": "string",
          "description": "Role name. Typed as `string` because role names now span multiple partitions: `SystemRoles` enum values for system-domain roles, and bare strings for ABAC-domain roles (e.g. `'content:reader'`, `'content:writer'`, `'content:manager'`, `'agent_runs:reader'`). Mongoose schema validates the value against the registered role catalog via `getAllRoleNames()`."
        },
        "resource_type": {
          "$ref": "#/$defs/AccessControlResourceType"
        },
        "resource": {
          "type": "string"
        },
        "principal_type": {
          "$ref": "#/$defs/AccessControlPrincipalType"
        },
        "principal": {
          "type": "string"
        },
        "account": {
          "type": "string",
          "description": "Account scope — required for principal_set/content_set ACEs."
        },
        "project": {
          "type": "string",
          "description": "Project scope — narrows a principal_set/content_set ACE to a single project."
        },
        "conditions": {
          "$ref": "#/$defs/AceConditions",
          "description": "Dynamic matching conditions for principal_set/content_set ACEs."
        },
        "tags": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "expires_at": {
          "type": "string"
        },
        "created_at": {
          "type": "string"
        },
        "updated_at": {
          "type": "string"
        },
        "id": {
          "type": "string"
        }
      },
      "required": [
        "role",
        "resource_type",
        "resource",
        "principal_type",
        "principal",
        "id"
      ],
      "additionalProperties": false
    },
    "AccessControlPrincipalType": {
      "type": "string",
      "enum": [
        "user",
        "group",
        "apikey",
        "principal_set"
      ]
    },
    "AccessControlResourceType": {
      "type": "string",
      "enum": [
        "project",
        "environment",
        "account",
        "interaction",
        "application",
        "content_set"
      ]
    },
    "AceConditions": {
      "type": "object",
      "properties": {
        "principal_props": {
          "$ref": "#/$defs/PropertyConditions",
          "description": "Property conditions matched against user/group properties at token time (PrincipalSet)."
        },
        "resource_props": {
          "$ref": "#/$defs/PropertyConditions",
          "description": "Property conditions matched against object properties at query time (ResourceSet)."
        },
        "scope": {
          "$ref": "#/$defs/AbacScope",
          "description": "Kind of object the `resource_props` matches. Used to disambiguate which partition's roles apply (e.g. content roles vs agent-run roles) and to form the JWT `content_security` key prefix (`{scope}:{verb}`). Absent → `'document'` (default; emits bare `read`/`write`/`delete` keys for backward compatibility)."
        }
      },
      "additionalProperties": false,
      "description": "Conditions attached to an ACE for dynamic matching.\n- `principal_props`: matched against user/group properties at token time (PrincipalSet).\n- `resource_props`: matched against object properties at query time (ResourceSet)."
    },
    "PropertyConditionValue": {
      "description": "A single condition value. Resolved and evaluated dynamically by token/content security code."
    },
    "PropertyConditions": {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/$defs/PropertyConditionValue"
      }
    }
  }
}