v22

latestOpenAPI 3.0.0raw.githubusercontent.com2026-07-01140308542.4 KB

PolicyEvaluations

Test Cedar policy evaluation against real entities

Stateless evaluation endpoint for testing Cedar policy evaluation against real entities before deployment. Supports evaluating a single policy, a full policy set, or raw Cedar text.

post/zones/{zone_id}/policy-evaluations

Path parameters

zone_idstring required

The zone identifier

Headers

X-API-Versionstring

API version header (date-based, e.g. 2026-02-01)

X-Client-Request-IDstring uuid

Unique request identifier specified by the originating caller and passed along by proxies.

Request body

principal_type'user' | 'application' required

principal_idstring required

Public ID of the user or application.

actionstring required

Cedar action to evaluate (e.g. any). The engine namespaces actions automatically as Keycard::Action::"<name>".

resource_idstring required

Public ID of the resource.

subject_type'user' | 'application'

subject_idstring

Public ID of the subject (required when subject_type is set).

Response

The evaluation result

decision'allow' | 'deny' required

evaluation_status'complete' | 'partial'

determining_policiesstring[]

Raw Cedar policy IDs that determined the decision, of the form "<policy_version_id>::<cedar_key>", unioned across sub-checks. See checks for the resolved, human-readable form with per-check attribution.

reasonstring

Human-readable explanation of the decision, suitable for presenting to end users.

evaluated_atstring date-time required