Skip to main content

Responses

From the application’s perspective, once it asks for an Entitlements decision, the next thing that happens is that it receives a JSON object in response that describes the decision. A sample decision is shown below.

The most important fields are allowed (a Boolean indicating whether the request is allowed or not) and entz (a Rego set/JSON array of the list of JSON documents returned to the caller). The outcome field contains additional information about why the decision is made.

{
"allowed": true,
"entz": [
{"roles": ["DenySystemConfigModification"]},
{"roles": ["SystemPolicyEditor"]}
],
"outcome": {
"allow": true,
"decision_type": "ALLOWED",
"enforced": [
{
"allowed": true,
"entz": [],
"message": "Compliance Allow/Deny"
},
{
"allowed": true,
"entz": [{"roles": ["SystemPolicyEditor"]}],
"message": "Roles for subject"
},
{
"allowed": true,
"entz": [{"roles": ["DenySystemConfigModification"]}],
"message": "Roles for subject"
}
],
"monitored": [],
"policy_type": "rules",
"stacks": {
"e66a7ecdc6fc4d7bb0a8ae33b8f7175d": {
"enforced": [{
"allowed": true,
"entz": [],
"message": "Compliance Allow/Deny"
}],
"monitored": []
}
},
"system_type": "template.entitlements:0.1"
}
}

allowed is a Boolean indicating whether the request was allowed at all. entz is the union of all Entitlements produced by the system and any applicable stacks. entz is a set in Rego, but is returned by the requester as a JSON array.