EvaluateResponseDto

Example

JSON

{
  "allowed": false,
  "permission": "string",
  "scope_evaluated": "node",
  "effective_node_id": "string",
  "granting_roles": [
    "string"
  ],
  "denial_reason": "string"
}

Properties

6 properties 4 required

allowed boolean Required

permission string Required

scope_evaluated enum Required

Echo of the `scope` the caller asked for. `app_wide` answers are 'matched somewhere in the Environment' — never treat them as scoped to a specific node.

Enumnodeapp_wide

effective_node_id string Optional

The hierarchy node the decision was anchored to. Always set for `scope_evaluated: "node"`; always null for `scope_evaluated: "app_wide"` because the answer covers the whole Environment, not one node.

nullable

granting_roles array of string Required

Ids of the roles whose assignments produced a node-scoped allow. Always empty for `scope_evaluated: "app_wide"`, whose answer is not tied to a node, and for a deny.

denial_reason string Optional

Why the check was refused: `NO_ROLE_ASSIGNMENT`, `PERMISSION_NOT_GRANTED`, `NODE_SCOPE_VIOLATION`, `ROLE_EXPIRED`, `IDENTITY_INACTIVE`, `IDENTITY_NOT_ENV_MEMBER`, or `ORGANIZATION_MEMBERSHIP_INACTIVE` (assignments sit on the lineage inside an organization the identity's membership in is deactivated, so none count). Null on an allow.

nullable

Was this page helpful?

Tell us how we can improve this guide.