Docs/Account/API/Policies

Policies API

Manage Cedar authorization policies for attribute-based access control (ABAC). Policies extend the built-in RBAC system with fine-grained rules based on resource attributes, user attributes, and request context.

Base URL: https://id.vyntech.com.au/api/v1 — All endpoints require authentication with policies:manage permission. Policies are scoped per tenant and evaluated via the POST /authz/check endpoint.

Returns all Cedar policies defined within the tenant.

PoliciesAuth

List all Cedar policies in the current tenant.

Status Codes

Name
200
Type
HTTP
Description
Policies list returned
Name
401
Type
HTTP
Description
Invalid or expired access token
Name
403
Type
HTTP
Description
Missing policies:manage permission

Request

GET/api/v1/policies

Response 200

Creates a new Cedar policy. The policy is validated for syntax before saving. Policies with effect: "permit" grant access; those with effect: "forbid" deny it. Forbid always wins over permit.

PolicyAuth

Create a new Cedar authorization policy.

Payload Example

{
  "name": "restrict-sensitive-data",
  "description": "Only users with clearance=high can access sensitive resources",
  "effect": "forbid",
  "cedar": "forbid(principal, action, resource) when { resource.sensitivity == "high" && !(principal.clearance == "high") };",
  "enabled": true
}

Status Codes

Name
201
Type
HTTP
Description
Policy created
Name
401
Type
HTTP
Description
Invalid or expired access token
Name
403
Type
HTTP
Description
Missing policies:manage permission
Name
409
Type
HTTP
Description
Policy name already exists
Name
422
Type
HTTP
Description
Invalid Cedar syntax

Request

POST/api/v1/policies

Response 201

Updates an existing policy. You can modify the Cedar expression, toggle enabled/disabled, or update the description. Changes take effect immediately on subsequent authz checks.

PolicyAuth

Update an existing Cedar policy.

Payload Example

{
  "name": "restrict-sensitive-data",
  "description": "Updated: requires clearance=high or role=admin",
  "cedar": "forbid(principal, action, resource) when { resource.sensitivity == "high" && !(principal.clearance == "high" || principal in Role::"admin") };",
  "enabled": true
}

Status Codes

Name
200
Type
HTTP
Description
Policy updated
Name
401
Type
HTTP
Description
Invalid or expired access token
Name
403
Type
HTTP
Description
Missing policies:manage permission
Name
404
Type
HTTP
Description
Policy not found
Name
422
Type
HTTP
Description
Invalid Cedar syntax

Request

PUT/api/v1/policies/:id

Response 200

Permanently deletes a policy. Future authz checks will no longer evaluate this policy.

PolicyAuth

Delete a Cedar policy.

Status Codes

Name
200
Type
HTTP
Description
Policy deleted
Name
401
Type
HTTP
Description
Invalid or expired access token
Name
403
Type
HTTP
Description
Missing policies:manage permission
Name
404
Type
HTTP
Description
Policy not found

Request

DELETE/api/v1/policies/:id

Response 200

What's Next

Roles & Permissions API →

Manage roles and use the authz/check endpoint with policies.

API Keys API →

Create and manage API keys for programmatic access.

Risk Engine Guide →

Configure risk thresholds and adaptive challenges.

Tenants API →

Manage tenants and their configuration.