enterprise_ai.authz
Source: sdks/python/src/enterprise_ai/authz/__init__.py. Back to the Python SDK reference index.
This page is generated by tools/docs/gen_sdk_reference.py from the SDK sources and the OpenAPI text folders. Do not edit it by hand: change the source and regenerate.
Class AuthzClient
/v1/authz/check (OpenFGA, relation checks) and /v1/policies/evaluate (OPA, explained decision).
Resource
AuthzClient.check
check(subject: str, relation: str, object: str, contextual_tuples: list[dict[str, str]] | None = None) -> Any
Check a relation. Tells whether subject holds relation on object, following inheritance. Up to 20 contextual_tuples are taken as true for this check only and never stored (an invalid one answers 422 validation_error). Open to any member of the tenant. The answer gives allowed, engine, subject, relation and object. Writes the audit event authz.check with the decision. When the engine cannot answer, the decision is a refusal, it is audited and the API answers 502 authz_backend_error.
Route: /v1/authz/check (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
subject | str | yes | Subject checked, <type>:<id>: user:alice, group:fin#member or user:*. | |
relation | str | yes | Relation name, lowercase letters, digits and underscores, for example viewer. | |
object | str | yes | Object checked, <type>:<id>, for example project:42. | |
contextual_tuples | list[dict[str, str]] | None | None | no | Up to 20 tuples {subject, relation, object} taken as true for this check only, never stored. |
Returns: Any. Decoded JSON answer of the operation "Check a relation".
Raises: the typed errors of the transport (Errors).
AuthzClient.check_batch
check_batch(checks: Iterable[dict[str, Any]]) -> Any
Check a relation. Tells whether subject holds relation on object, following inheritance. Up to 20 contextual_tuples are taken as true for this check only and never stored (an invalid one answers 422 validation_error). Open to any member of the tenant. The answer gives allowed, engine, subject, relation and object. Writes the audit event authz.check with the decision. When the engine cannot answer, the decision is a refusal, it is audited and the API answers 502 authz_backend_error.
Route: /v1/authz/check (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
checks | Iterable[dict[str, Any]] | yes | Checks to run in order, each {subject, relation, object, contextual_tuples?}. |
Returns: Any. Decoded JSON answer of the operation "Check a relation".
Raises: the typed errors of the transport (Errors).
AuthzClient.explain
explain(action: str, resource: dict[str, Any], context: dict[str, Any] | None = None, subject: dict[str, Any] | None = None) -> Any
Evaluate a policy request. Returns the decision for a Policy Contract request. The body is a Policy Contract ({schema_version, request}) or just its request object (subject, action, resource, context); it is validated against the policy-contract contract (422 validation_error).
Route: /v1/policies/evaluate (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
action | str | yes | Action to evaluate, for example tool.invoke. | |
resource | dict[str, Any] | yes | Only this resource: <type> or <type>:<id>, for example project:42. | |
context | dict[str, Any] | None | None | no | Extra input given to the policy (environment, attributes of the request). |
subject | dict[str, Any] | None | None | no | Only the tuples of this subject, such as user:alice or group:fin#member. |
Returns: Any. Decoded JSON answer of the operation "Evaluate a policy request".
Raises: the typed errors of the transport (Errors).
Functions
confirm_check
confirm_check(response: Any) -> Any
Check a relation. Tells whether subject holds relation on object, following inheritance. Up to 20 contextual_tuples are taken as true for this check only and never stored (an invalid one answers 422 validation_error). Open to any member of the tenant. The answer gives allowed, engine, subject, relation and object. Writes the audit event authz.check with the decision. When the engine cannot answer, the decision is a refusal, it is audited and the API answers 502 authz_backend_error.
Route: /v1/authz/check (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
response | Any | yes | Answer of POST /v1/authz/check to check. |
Returns: Any. Decoded JSON answer of the operation "Check a relation".
Raises: AuthzUnconfirmed, the typed errors of the transport (Errors).
confirm_decision
confirm_decision(response: Any) -> Any
Evaluate a policy request. Returns the decision for a Policy Contract request. The body is a Policy Contract ({schema_version, request}) or just its request object (subject, action, resource, context); it is validated against the policy-contract contract (422 validation_error).
Route: /v1/policies/evaluate (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
response | Any | yes | Answer of POST /v1/policies/evaluate to check. |
Returns: Any. Decoded JSON answer of the operation "Evaluate a policy request".
Raises: AuthzUnconfirmed, the typed errors of the transport (Errors).