Interface: AuthzDryRunRequest

@kortexya/reasoninglayer / Authz / AuthzDryRunRequest

Interface: AuthzDryRunRequest

Defined in: src/types/authz.ts:59

One access to dry-run against a candidate authorization context.

Remarks

Body of POST /api/v1/authz/dry-run. Unlike most of the API, this endpoint’s wire contract is camelCase (sortAncestors, termFeatures) — the normalizer emits those keys verbatim.

The context is the gateway-resolved authorization context in its exact wire shape (the same JSON the gateway base64url-encodes into the X-Authorization-Context header). Unknown fields reject (fail-closed), so it is passed through untouched.

Example

const request: AuthzDryRunRequest = {
  action: 'read',
  sort: 'patient_record',
  context: { roles: ['clinician'], grants: [] },
  termFeatures: { department: 'cardiology' },
};

Properties

action

action: AuthzAction

Defined in: src/types/authz.ts:61

The action dimension of the access being dry-run.

context

context: Record<string, JsonValue>

Defined in: src/types/authz.ts:66

The gateway-resolved authorization context, in its exact wire shape. Unknown fields reject (fail-closed).

sort

sort: string

Defined in: src/types/authz.ts:68

The sort being accessed.

sortAncestors?

optional sortAncestors: string[] | null

Defined in: src/types/authz.ts:74

Ancestor sort names, nearest-first, for descendant grants and row-rule inheritance. Omit to have the engine resolve them from the tenant’s sort lattice (an unknown sort name resolves to no ancestors).

termFeatures?

optional termFeatures: Record<string, JsonValue>

Defined in: src/types/authz.ts:81

Term features for row-level evaluation. Omit (or pass null values) for a sort-level decision with no row dimension. A null or object-valued feature is treated as absent — absent features never satisfy an allow nor fire a deny (fail-closed).