Example Request on Postman

Community

Open Source

Playground

Permify Docs

API References

Support

Read Schema

The fully qualified name of this abstract type.

`Any` contains an arbitrary serialized protocol buffer message along with a
URL that describes the type of the serialized message.

Protobuf library provides support to pack/unpack Any values in the form
of utility functions or additional generated methods of the Any type.

Example 1: Pack and unpack a message in C++.

    Foo foo = ...;
    Any any;
    any.PackFrom(foo);
    ...
    if (any.UnpackTo(&foo)) {
      ...
    }

Example 2: Pack and unpack a message in Java.

    Foo foo = ...;
    Any any = Any.pack(foo);
    ...
    if (any.is(Foo.class)) {
      foo = any.unpack(Foo.class);
    }
    // or ...
    if (any.isSameTypeAs(Foo.getDefaultInstance())) {
      foo = any.unpack(Foo.getDefaultInstance());
    }

 Example 3: Pack and unpack a message in Python.

    foo = Foo(...)
    any = Any()
    any.Pack(foo)
    ...
    if any.Is(Foo.DESCRIPTOR):
      any.Unpack(foo)
      ...

 Example 4: Pack and unpack a message in Go

     foo := &pb.Foo{...}
     any, err := anypb.New(foo)
     if err != nil {
       ...
     }
     ...
     foo := &pb.Foo{}
     if err := any.UnmarshalTo(foo); err != nil {
       ...
     }

The pack methods provided by protobuf library will by default use
'type.googleapis.com/full.type.name' as the type URL and the unpack
methods only use the fully qualified type name after the last '/'
in the type URL, for example "foo.bar.com/x/y.z" will yield type
name "y.z".

JSON
====
The JSON representation of an `Any` value uses the regular
representation of the deserialized, embedded message, with an
additional field `@type` which contains the type URL. Example:

    package google.profile;
    message Person {
      string first_name = 1;
      string last_name = 2;
    }

    {
      "@type": "type.googleapis.com/google.profile.Person",
      "firstName": <string>,
      "lastName": <string>
    }

If the embedded message type is well-known and has a custom JSON
representation, that representation will be embedded adding a field
`value` which holds the custom JSON in addition to the `@type`
field. Example (for message [google.protobuf.Duration][]):

    {
      "@type": "type.googleapis.com/google.protobuf.Duration",
      "value": "1.212s"
    }

A URL/resource name that uniquely identifies the type of the serialized
protocol buffer message. This string must contain at least
one "/" character. The last segment of the URL's path must represent
the fully qualified name of the type (as in
`path/google.protobuf.Duration`). The name should be in a canonical form
(e.g., leading "." is not accepted).

In practice, teams usually precompile into the binary all types that they
expect it to use in the context of Any. However, for URLs which use the
scheme `http`, `https`, or no scheme, one can optionally set up a type
server that maps type URLs to message definitions as follows:

* If no scheme is provided, `https` is assumed.
* An HTTP GET on the URL must yield a [google.protobuf.Type][]
  value in binary format, or produce an error.
* Applications are allowed to cache lookup results based on the
  URL, or have them precompiled into a binary to avoid any
  lookup. Therefore, binary compatibility needs to be preserved
  on changes to types. (Use versioned type names to manage
  breaking changes.)

Note: this functionality is not currently available in the official
protobuf release, and it is not used for type URLs beginning with
type.googleapis.com. As of May 2023, there are no widely used type server
implementations and no plans to implement one.

Schemes other than `http`, `https` (or the empty scheme) might be
used with implementation specific semantics.

Argument defines the type of argument in a Call. It can be either a ComputedAttribute or a ContextAttribute.

The AttributeDefinition message provides detailed information about a specific attribute.

The name of the attribute, which follows a specific string pattern and has a maximum byte size.

Enumerates the types of attribute.

 - ATTRIBUTE_TYPE_UNSPECIFIED: Not specified attribute type. This is the default value.
 - ATTRIBUTE_TYPE_BOOLEAN: A boolean attribute type.
 - ATTRIBUTE_TYPE_BOOLEAN_ARRAY: A boolean array attribute type.
 - ATTRIBUTE_TYPE_STRING: A string attribute type.
 - ATTRIBUTE_TYPE_STRING_ARRAY: A string array attribute type.
 - ATTRIBUTE_TYPE_INTEGER: An integer attribute type.
 - ATTRIBUTE_TYPE_INTEGER_ARRAY: An integer array attribute type.
 - ATTRIBUTE_TYPE_DOUBLE: A double attribute type.
 - ATTRIBUTE_TYPE_DOUBLE_ARRAY: A double array attribute type.

A CEL expression which has been successfully type checked.

The expr version indicates the major / minor version number of the `expr`
representation.

The most common reason for a version change will be to indicate to the CEL
runtimes that transformations have been performed on the expr during static
analysis. In some cases, this will save the runtime the work of applying
the same or similar transformations prior to evaluation.

A map from expression ids to resolved references.

The following entries are in this table:

- An Ident or Select expression is represented here if it resolves to a
  declaration. For instance, if `a.b.c` is represented by
  `select(select(id(a), b), c)`, and `a.b` resolves to a declaration,
  while `c` is a field selection, then the reference is attached to the
  nested select expression (but not to the id or or the outer select).
  In turn, if `a` resolves to a declaration and `b.c` are field selections,
  the reference is attached to the ident expression.
- Every Call expression has an entry here, identifying the function being
  called.
- Every CreateStruct expression for a message has an entry, identifying
  the message.

A map from expression ids to types.

Every expression node which has a type different than DYN has a mapping
here. If an expression has type DYN, it is omitted from this map to save
space.

Child represents a node in the permission tree.

ComputedAttribute defines a computed attribute which includes its name.

Name of the computed attribute

ComputedUserSet defines a set of computed users which includes the relation name.

Relation name

Represents a primitive literal.

Named 'Constant' here for backwards compatibility.

This is similar as the primitives supported in the well-known type
`google.protobuf.Value`, but richer so it can represent CEL's full range of
primitives.

Lists and structs are not included as constants as these aggregate types may
contain [Expr][google.api.expr.v1alpha1.Expr] elements which require evaluation and are thus not constant.

Examples of literals include: `"hello"`, `b'bytes'`, `1u`, `4.2`, `-2`,
`true`, `null`.

protobuf.Duration value.

Deprecated: duration is no longer considered a builtin cel type.

protobuf.Timestamp value.

Deprecated: timestamp is no longer considered a builtin cel type.

ContextAttribute defines a context attribute which includes its name.

Name of the context attribute

The EntityDefinition message provides detailed information about a specific entity.

Map of attribute definitions within this entity. The key is the attribute name, and the value is the AttributeDefinition.

The name of the entity, which follows a specific string pattern and has a maximum byte size.

Map of permission definitions within this entity. The key is the permission name, and the value is the PermissionDefinition.

Map of references indicating whether a string pertains to a relation, permission, or attribute.

Map of relation definitions within this entity. The key is the relation name, and the value is the RelationDefinition.

The Reference enum specifies whether a name pertains to a relation, permission, or attribute.

 - REFERENCE_UNSPECIFIED: Default, unspecified reference.
 - REFERENCE_RELATION: Indicates that the name refers to a relation.
 - REFERENCE_PERMISSION: Indicates that the name refers to a permission.
 - REFERENCE_ATTRIBUTE: Indicates that the name refers to an attribute.

An abstract representation of a common expression.

Expressions are abstractly represented as a collection of identifiers,
select statements, function calls, literals, and comprehensions. All
operators with the exception of the '.' operator are modelled as function
calls. This makes it easy to represent new operators into the existing AST.

All references within expressions must resolve to a [Decl][google.api.expr.v1alpha1.Decl] provided at
type-check for an expression to be valid. A reference may either be a bare
identifier `name` or a qualified identifier `google.api.name`. References
may either refer to a value or a function declaration.

For example, the expression `google.api.name.startsWith('expr')` references
the declaration `google.api.name` within a [Expr.Select][google.api.expr.v1alpha1.Expr.Select] expression, and
the function declaration `startsWith`.

Leaf represents a leaf node in the permission tree.

List type with typed elements, e.g. `list<example.proto.MyMessage>`.

Map type with parameterized key and value types, e.g. `map<string, int>`.

The PermissionDefinition message provides detailed information about a specific permission.

The name of the permission, which follows a specific string pattern and has a maximum byte size.

CEL primitive types.

 - PRIMITIVE_TYPE_UNSPECIFIED: Unspecified type.
 - BOOL: Boolean type.
 - INT64: Int64 type.

Proto-based integer values are widened to int64.
 - UINT64: Uint64 type.

Proto-based unsigned integer values are widened to uint64.
 - DOUBLE: Double type.

Proto-based float values are widened to double values.
 - STRING: String type.
 - BYTES: Bytes type.

The RelationDefinition message provides detailed information about a specific relation.

The name of the relation, which follows a specific string pattern and has a maximum byte size.

The RelationReference message provides a reference to a specific relation.

The name of the referenced relation, which follows a specific string pattern and has a maximum byte size.

The type of the referenced entity, which follows a specific string pattern and has a maximum byte size.

The Rewrite message represents a specific rewrite operation.
This operation could be one of the following: union, intersection, or exclusion.

A list of children that are operated upon by the rewrite operation.

Operation enum includes potential rewrite operations.
OPERATION_UNION: Represents a union operation.
OPERATION_INTERSECTION: Represents an intersection operation.
OPERATION_EXCLUSION: Represents an exclusion operation.

 - OPERATION_UNSPECIFIED: Default, unspecified operation.
 - OPERATION_UNION: Represents a union operation.
 - OPERATION_INTERSECTION: Represents an intersection operation.
 - OPERATION_EXCLUSION: Represents an exclusion operation.

The RuleDefinition message provides detailed information about a specific rule.

Map of arguments for this rule. The key is the attribute name, and the value is the AttributeType.

The name of the rule, which follows a specific string pattern and has a maximum byte size.

The SchemaDefinition message provides definitions for entities and rules,
and includes references to clarify whether a name refers to an entity or a rule.

Map of entity definitions. The key is the entity name, and the value is the corresponding EntityDefinition.

Map of references to signify whether a string refers to an entity or a rule.

Map of rule definitions. The key is the rule name, and the value is the corresponding RuleDefinition.

The Reference enum helps distinguish whether a name corresponds to an entity or a rule.

 - REFERENCE_UNSPECIFIED: Default, unspecified reference.
 - REFERENCE_ENTITY: Indicates that the name refers to an entity.
 - REFERENCE_RULE: Indicates that the name refers to a rule.

SchemaReadRequestMetadata provides additional information for the Schema Read request.
It contains schema_version to specify which version of the schema should be read.

schema_version is the string that identifies the version of the schema to be read.

Source information collected at parse time.

Monotonically increasing list of code point offsets where newlines
`\n` appear.

The line number of a given position is the index `i` where for a given
`id` the `line_offsets[i] < id_positions[id] < line_offsets[i+1]`. The
column may be derivd from `id_positions[id] - line_offsets[i]`.

The location name. All position information attached to an expression is
relative to this location.

The location could be a file, UI element, or similar. For example,
`acme/app/AnvilPolicy.cel`.

A map from the parse node id where a macro replacement was made to the
call `Expr` that resulted in a macro expansion.

For example, `has(value.field)` is a function call that is replaced by a
`test_only` field selection in the AST. Likewise, the call
`list.exists(e, e > 10)` translates to a comprehension expression. The key
in the map corresponds to the expression id of the expanded macro, and the
value is the call `Expr` that was replaced.

A map from the parse node id (e.g. `Expr.id`) to the code point offset
within the source.

The syntax version of the source, e.g. `cel1`.

TupleSet represents a set of tuples associated with a specific relation.

TupleToUserSet defines a mapping from tuple sets to computed user sets.

Well-known protobuf types treated with first-class support in CEL.

 - WELL_KNOWN_TYPE_UNSPECIFIED: Unspecified type.
 - ANY: Well-known protobuf.Any type.

Any types are a polymorphic message type. During type-checking they are
treated like `DYN` types, but at runtime they are resolved to a specific
message type specified at evaluation time.
 - TIMESTAMP: Well-known protobuf.Timestamp type, internally referenced as `timestamp`.
 - DURATION: Well-known protobuf.Duration type, internally referenced as `duration`.

Call represents a call to a rule. It includes the name of the rule and the arguments passed to it.

Arguments passed to the rule

Name of the rule

Describes a resolved reference to a declaration.

The fully qualified name of the declaration.

For references to functions, this is a list of `Overload.overload_id`
values which match according to typing rules.

If the list has more than one element, overload resolution among the
presented candidates must happen at runtime because of dynamic types. The
type checker attempts to narrow down this list as much as possible.

Empty if this is not a reference to a
[Decl.FunctionDecl][google.api.expr.v1alpha1.Decl.FunctionDecl].

Error type.

During type-checking if an expression is an error, its type is propagated
as the `ERROR` type. This permits the type-checker to discover other
errors present in the expression.

Protocol buffer message type.

The `message_type` string specifies the qualified message type name. For
example, `google.plus.Profile`.

Type param type.

The `type_param` string specifies the type parameter name, e.g. `list<E>`
would be a `list_type` whose element type was a `type_param` type
named `E`.

SchemaReadRequest is the request message for the Read method in the Schema service.
It contains tenant_id and metadata about the schema to be read.

SchemaReadResponse is the response message for the Read method in the Schema service.
It returns the requested schema.

API Documentation

Schema Service

Data Service

Permission Service

Tenancy Service

Bundle Service

Watch Service

Read Schema

Example Request on Postman

Path Parameters

Body

Response

API Documentation

Schema Service

Data Service

Permission Service

Tenancy Service

Bundle Service

Watch Service

​Example Request on Postman

Path Parameters

Body

Response

Example Request on Postman