io.enterpriseai.resources.AuthzClient

Source: sdks/java/enterprise-ai-java/src/main/java/io/enterpriseai/resources/AuthzClient.java. Back to the Java SDK reference index.

note

This page is generated by tools/docs/gen_sdk_reference.py from the SDK sources and the OpenAPI text folders. Do not edit it by hand: change the source and regenerate.

Class AuthzClient

Relationship based authorization (OpenFGA or builtin).

Constructor AuthzClient

AuthzClient(Transport transport)

Creates the client on the shared transport; EnterpriseAIClient builds it and exposes it through the accessor of the same name.

Name	Type	Default	Required	Description
transport	Transport		yes	Transport shared by the sub-clients of one client.

AuthzClient.check

JsonNode check(Object body)

Check a relation. Tells whether subject holds relation on object, following inheritance. Up to 20 contextual_tuples are taken as true for this check only and never stored (an invalid one answers 422 validation_error). Open to any member of the tenant. The answer gives allowed, engine, subject, relation and object. Writes the audit event authz.check with the decision. When the engine cannot answer, the decision is a refusal, it is audited and the API answers 502 authz_backend_error.

Route: /v1/authz/check (POST).

Name	Type	Default	Required	Description
body	Object		yes	Subject, relation, object and optional contextual tuples.

Returns: JsonNode. Decoded JSON answer of the operation "Check a relation".

Raises: the typed errors of the transport (Errors).

AuthzClient.check

JsonNode check(Object body, RequestOptions options)

Check a relation. Tells whether subject holds relation on object, following inheritance. Up to 20 contextual_tuples are taken as true for this check only and never stored (an invalid one answers 422 validation_error). Open to any member of the tenant. The answer gives allowed, engine, subject, relation and object. Writes the audit event authz.check with the decision. When the engine cannot answer, the decision is a refusal, it is audited and the API answers 502 authz_backend_error.

Route: /v1/authz/check (POST).

Name	Type	Default	Required	Description
body	Object		yes	Subject, relation, object and optional contextual tuples.
options	RequestOptions		yes	Per call options (idempotency key, traceparent, headers, abort signal).

Returns: JsonNode. Decoded JSON answer of the operation "Check a relation".

Raises: the typed errors of the transport (Errors).

AuthzClient.deleteTuples

JsonNode deleteTuples(Object body)

Delete authorization tuples. Deletes one tuple ({subject, relation, object}) or up to 100 ({"tuples": [...]}). Needs tenant_admin or security_officer. Tuples that do not exist are ignored; the answer gives deleted (number removed) and engine. Writes the audit event authz.delete. 502 authz_backend_error when the engine cannot answer.

Route: /v1/authz/tuples (DELETE).

Name	Type	Default	Required	Description
body	Object		yes	One tuple, or an object tuples with 1 to 100 tuples.

Returns: JsonNode. Decoded JSON answer of the operation "Delete authorization tuples".

Raises: the typed errors of the transport (Errors).

AuthzClient.listTuples

io.enterpriseai.Page<JsonNode> listTuples()

List authorization tuples. Lists the stored tuples of the tenant, ordered by object, relation and subject, at most 1000, optionally filtered by object and subject (exact match). Open to any member of the tenant. next_cursor is always null.

Route: /v1/authz/tuples (GET).

This element takes no parameter.

Returns: io.enterpriseai.Page<JsonNode>. A Page: One page of a cursor paginated collection ({"items": [...], "next_cursor": "..."|null}).

Raises: the typed errors of the transport (Errors).

AuthzClient.listTuples

io.enterpriseai.Page<JsonNode> listTuples(java.util.Map<String, ?> query)

List authorization tuples. Lists the stored tuples of the tenant, ordered by object, relation and subject, at most 1000, optionally filtered by object and subject (exact match). Open to any member of the tenant. next_cursor is always null.

Route: /v1/authz/tuples (GET).

Name	Type	Default	Required	Description
query	java.util.Map<String, ?>		yes	Query string parameters of the route.

Returns: io.enterpriseai.Page<JsonNode>. A Page: One page of a cursor paginated collection ({"items": [...], "next_cursor": "..."|null}).

Raises: the typed errors of the transport (Errors).

AuthzClient.writeTuples

JsonNode writeTuples(Object body)

Write authorization tuples. Grants one tuple ({subject, relation, object}) or up to 100 ({"tuples": [...]}) in one transaction. Needs tenant_admin or security_officer. A wildcard subject (user:*) on a relation reserved to named subjects, such as can_assume, answers 422 authz_wildcard_not_allowed. The answer (201) gives written and engine. Writes the audit event authz.write. 502 authz_backend_error when the engine cannot answer.

Route: /v1/authz/tuples (POST).

Name	Type	Default	Required	Description
body	Object		yes	One tuple, or an object tuples with 1 to 100 tuples.

Returns: JsonNode. Decoded JSON answer of the operation "Write authorization tuples".

Raises: the typed errors of the transport (Errors).

AuthzClient.writeTuples

JsonNode writeTuples(Object body, RequestOptions options)

Write authorization tuples. Grants one tuple ({subject, relation, object}) or up to 100 ({"tuples": [...]}) in one transaction. Needs tenant_admin or security_officer. A wildcard subject (user:*) on a relation reserved to named subjects, such as can_assume, answers 422 authz_wildcard_not_allowed. The answer (201) gives written and engine. Writes the audit event authz.write. 502 authz_backend_error when the engine cannot answer.

Route: /v1/authz/tuples (POST).

Name	Type	Default	Required	Description
body	Object		yes	One tuple, or an object tuples with 1 to 100 tuples.
options	RequestOptions		yes	Per call options (idempotency key, traceparent, headers, abort signal).

Returns: JsonNode. Decoded JSON answer of the operation "Write authorization tuples".

Raises: the typed errors of the transport (Errors).