Docs/Account/API/Policies

Policies API

Manage Cedar authorization policies for attribute-based access control (ABAC). Policies extend the built-in RBAC system with fine-grained rules based on resource attributes, user attributes, and request context.

Base URL: https://id.vyntech.com.au/api/v1 — All endpoints require authentication with policies:manage permission. Policies are scoped per tenant and evaluated via the POST /authz/check endpoint.

List Policies

Returns all Cedar policies defined within the tenant.

GET/api/v1/policies🔒 Auth

List all Cedar policies in the current tenant.

curl https://id.vyntech.com.au/api/v1/policies \ -H "Authorization: Bearer eyJhbGciOiJFZERTQSIs..."

Create Policy

Creates a new Cedar policy. The policy is validated for syntax before saving. Policies with effect: "permit" grant access; those with effect: "forbid" deny it. Forbid always wins over permit.

POST/api/v1/policies🔒 Auth

Create a new Cedar authorization policy.

curl -X POST https://id.vyntech.com.au/api/v1/policies \ -H "Authorization: Bearer eyJhbGciOiJFZERTQSIs..." \ -H "Content-Type: application/json" \ -d '{ "name": "restrict-sensitive-data", "description": "Only users with clearance=high can access sensitive resources", "effect": "forbid", "cedar": "forbid(principal, action, resource) when { resource.sensitivity == \"high\" && !(principal.clearance == \"high\") };", "enabled": true }'

Request Body

{
  "name": "restrict-sensitive-data",
  "description": "Only users with clearance=high can access sensitive resources",
  "effect": "forbid",
  "cedar": "forbid(principal, action, resource) when { resource.sensitivity == "high" && !(principal.clearance == "high") };",
  "enabled": true
}

Update Policy

Updates an existing policy. You can modify the Cedar expression, toggle enabled/disabled, or update the description. Changes take effect immediately on subsequent authz checks.

PUT/api/v1/policies/:id🔒 Auth

Update an existing Cedar policy.

curl -X PUT https://id.vyntech.com.au/api/v1/policies/pol_01H8ZBCD7C9D1E3F \ -H "Authorization: Bearer eyJhbGciOiJFZERTQSIs..." \ -H "Content-Type: application/json" \ -d '{ "name": "restrict-sensitive-data", "description": "Updated: requires clearance=high or role=admin", "cedar": "forbid(principal, action, resource) when { resource.sensitivity == \"high\" && !(principal.clearance == \"high\" || principal in Role::\"admin\") };", "enabled": true }'

Request Body

{
  "name": "restrict-sensitive-data",
  "description": "Updated: requires clearance=high or role=admin",
  "cedar": "forbid(principal, action, resource) when { resource.sensitivity == "high" && !(principal.clearance == "high" || principal in Role::"admin") };",
  "enabled": true
}

Delete Policy

Permanently deletes a policy. Future authz checks will no longer evaluate this policy.

DELETE/api/v1/policies/:id🔒 Auth

Delete a Cedar policy.

curl -X DELETE https://id.vyntech.com.au/api/v1/policies/pol_01H8ZBCD7C9D1E3F \ -H "Authorization: Bearer eyJhbGciOiJFZERTQSIs..."

What's Next

Roles & Permissions API →

Manage roles and use the authz/check endpoint with policies.

API Keys API →

Create and manage API keys for programmatic access.

Risk Engine Guide →

Configure risk thresholds and adaptive challenges.

Tenants API →

Manage tenants and their configuration.