Skip to content
Authrim

Simulate policy evaluation.

POST
/api/admin/policies/simulate
Code sample: Shell / cURL 
curl --request POST \
  --url https://auth.example.com/api/admin/policies/simulate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "context": { "subject": { "id": "user_123", "roles": [ "viewer" ] }, "resource": { "type": "user", "id": "user_456" }, "action": "read" }, "save_history": true }'

Evaluate enabled policy rules against a supplied context as the Check API would, and optionally persist the simulation history for later review. The tenant’s settings apply (no grant while feature.enable_abac or feature.enable_custom_rules is off; no verified attributes while feature.enable_verified_attributes is off), as do the rules’ resource types and actions, and the subject’s scoped roles count only for the context’s resource and organization. While a rule cannot be evaluated as stored, nothing is granted and its id is returned. context.resource.type and context.action.name are required. Answers 503 when the settings cannot be read.

Authorizations

Section titled “Authorizations ”

Request Body required

Section titled “Request Body required ”
Media type application/json
object
context
required
object
subject
required

The subject: id, roles ({ name, scope: global | org | resource, scopeTarget such as org: or resource:: }) and verifiedAttributes ({ name, value }).

object
key
additional properties
resource
required
object
type
required
string
id
string
ownerId
string
orgId
string
key
additional properties
action
required
object
name
required
string
key
additional properties
timestamp

When the request is evaluated, in UNIX milliseconds (default now).

integer
environment
object
key
additional properties
key
additional properties
save_history
boolean
key
additional properties
Example 
{
  "context": {
    "subject": {
      "id": "user_123",
      "roles": [
        "viewer"
      ]
    },
    "resource": {
      "type": "user",
      "id": "user_456"
    },
    "action": "read"
  },
  "save_history": true
}

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Policy simulation response.

Media type application/json
object
allowed
required
boolean
reason
required
string
decided_by
string | null
details
object | null
evaluated_rules
required
integer
key
additional properties
Example 
{
  "allowed": true,
  "reason": "Matched allow rule",
  "decided_by": "policy_123",
  "details": {
    "matched_rule": "policy_123"
  },
  "evaluated_rules": 3
}

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

401

Section titled “401 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Section titled “403 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

500

Section titled “500 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

503

Section titled “503 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}