openapi: 3.0.3 info: title: Oso Cloud HTTP Centralized Authorization Data Check API API version: 0.1.0 description: 'Oso Cloud exposes an HTTP API that you can use to make queries directly, without using one of the clients.For endpoints that require authentication, pass your API key as an HTTP Bearer Auth payload.For example, using curl: curl -H "Authorization: Bearer $OSO_AUTH" https://cloud.osohq.com/api/' servers: - url: https://api.osohq.com/api/ tags: - name: Check API paths: /authorize: post: tags: - Check API description: Determines whether or not an actor can take an action on a resource, based on a combination of authorization data and policy logic. operationId: post_authorize requestBody: content: application/json: schema: $ref: '#/components/schemas/AuthorizeQuery' required: true responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/AuthorizeResult' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ApiError' security: - ApiKey: [] x-codeSamples: - lang: javascript label: Node.js source: "import { Oso } from 'oso-cloud';\n\nconst apiKey = process.env.OSO_CLOUD_API_KEY;\nconst oso = new Oso(\"https://cloud.osohq.com\", apiKey);\n\n// Basic authorization check\nconst alice = { type: \"User\", id: \"alice\" };\nconst repository = { type: \"Repository\", id: \"anvils\" };\n\nconst authorized = await oso.authorize(alice, \"read\", repository);\nif (!authorized) {\n throw new Error(\"Access denied\");\n}\n\n// With context facts for additional information\nconst issue = { type: \"Issue\", id: \"123\" };\nconst contextAuthorized = await oso.authorize(\n alice, \n \"read\", \n issue, \n [[\"has_relation\", issue, \"parent\", repository]] // Context facts\n);\n" - lang: python label: Python source: "import os\nfrom oso_cloud import Oso, Value\n\noso = Oso(api_key=os.environ.get('OSO_CLOUD_API_KEY', None))\n\n# Basic authorization check\nalice = Value(\"User\", \"alice\")\nrepository = Value(\"Repository\", \"anvils\")\n\nif not oso.authorize(alice, \"read\", repository):\n raise Exception(\"Action is not allowed\")\n\n# With context facts\nissue = Value(\"Issue\", \"123\")\nauthorized = oso.authorize(\n alice, \n \"read\", \n issue, \n context_facts=[(\"has_relation\", issue, \"parent\", repository)]\n)\n" - lang: go label: Go source: "package main\n\nimport (\n \"log\"\n \"os\"\n oso \"github.com/osohq/go-oso-cloud/v2\"\n)\n\nfunc main() {\n apiKey := os.Getenv(\"OSO_CLOUD_API_KEY\")\n osoClient := oso.NewClient(\"https://cloud.osohq.com\", apiKey)\n\n// Basic authorization check\nuser := oso.NewValue(\"User\", \"alice\")\nrepository := oso.NewValue(\"Repository\", \"anvils\")\n\nallowed, err := osoClient.Authorize(user, \"read\", repository)\nif err != nil {\n log.Fatal(err)\n}\nif !allowed {\n return fmt.Errorf(\"access denied\")\n}\n\n// With context facts\nissue := oso.NewValue(\"Issue\", \"123\")\ncontextFacts := []oso.Fact{\n oso.NewFact(\"has_relation\", issue, oso.String(\"parent\"), repository),\n}\nallowed, err = osoClient.AuthorizeWithContext(user, \"read\", issue, contextFacts)\n}\n" - lang: java label: Java source: "package com.mycompany;\n\nimport java.io.IOException;\nimport com.osohq.oso_cloud.Oso;\nimport com.osohq.oso_cloud.api.ApiException;\nimport com.osohq.oso_cloud.api.Value;\n\npublic class App {\n public static void main(String[] args) {\n String apiKey = System.getenv(\"OSO_CLOUD_API_KEY\");\n Oso oso = new Oso(apiKey);\n \n try {\n // Basic authorization check\n Value alice = new Value(\"User\", \"alice\");\n Value repository = new Value(\"Repository\", \"anvils\");\n \n boolean authorized = oso.authorize(alice, \"read\", repository);\n if (!authorized) {\n throw new RuntimeException(\"Access denied\");\n }\n \n // With context facts for additional information\n Value issue = new Value(\"Issue\", \"123\");\n boolean contextAuthorized = oso.authorize(alice, \"read\", issue, \n Arrays.asList(Arrays.asList(\"has_relation\", issue, \"parent\", repository)));\n } catch (IOException | ApiException e) {\n System.err.println(\"Error: \" + e.getMessage());\n }\n }\n}\n" - lang: ruby label: Ruby source: "require 'oso-cloud'\n\napi_key = ENV.fetch('OSO_CLOUD_API_KEY', nil)\noso = OsoCloud::Oso.new(url: \"https://cloud.osohq.com\", api_key: api_key)\n\n# Basic authorization check\nalice = OsoCloud::Value.new(type: \"User\", id: \"alice\")\nrepository = OsoCloud::Value.new(type: \"Repository\", id: \"anvils\")\n\nauthorized = oso.authorize(alice, \"read\", repository)\nraise \"Access denied\" unless authorized\n\n# With context facts\nissue = OsoCloud::Value.new(type: \"Issue\", id: \"123\")\ncontext_authorized = oso.authorize(alice, \"read\", issue, \n context_facts: [[\"has_relation\", issue, \"parent\", repository]])\n" - lang: csharp label: C# source: "using OsoCloud;\n\nstring? apiKey = Environment.GetEnvironmentVariable(\"OSO_CLOUD_API_KEY\");\nvar oso = new Oso(\"https://api.osohq.com\", apiKey);\n\n// Basic authorization check\nvar alice = new Value(\"User\", \"alice\");\nvar repository = new Value(\"Repository\", \"anvils\");\n\nbool authorized = await oso.Authorize(alice, \"read\", repository);\nif (!authorized) {\n throw new UnauthorizedAccessException(\"Access denied\");\n}\n\n// With context facts for additional information\nvar issue = new Value(\"Issue\", \"123\");\nbool contextAuthorized = await oso.Authorize(alice, \"read\", issue, \n contextFacts: new[] { new[] { \"has_relation\", issue, \"parent\", repository } });\n" /authorize_resources: post: tags: - Check API description: Returns a subset of resources on which an actor can perform a particular action. Ordering and duplicates, if any exist, are preserved. operationId: post_authorize_resources requestBody: content: application/json: schema: $ref: '#/components/schemas/AuthorizeResourcesQuery' required: true responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/AuthorizeResourcesResult' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ApiError' security: - ApiKey: [] /list: post: tags: - Check API description: 'Fetches a list of resource IDs on which an actor can perform a particular action. Supports pagination: provide `page_size` to receive results in pages, with a `next_page_token` in the response for fetching subsequent pages.' operationId: post_list requestBody: content: application/json: schema: $ref: '#/components/schemas/ListQuery' required: true responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/ListResult' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ApiError' security: - ApiKey: [] x-codeSamples: - lang: javascript label: Node.js source: "import { Oso } from 'oso-cloud';\n\nconst apiKey = process.env.OSO_CLOUD_API_KEY;\nconst oso = new Oso(\"https://cloud.osohq.com\", apiKey);\n\n// List all repositories the user can read\nconst alice = { type: \"User\", id: \"alice\" };\nconst repositoryIds = await oso.list(alice, \"read\", \"Repository\");\nconsole.log(\"Readable repositories:\", repositoryIds);\n\n// With context facts\nconst issueIds = await oso.list(\n alice, \n \"read\", \n \"Issue\",\n [\n [\"has_relation\", { type: \"Issue\", id: \"123\" }, \"parent\", { type: \"Repository\", id: \"anvils\" }],\n [\"has_relation\", { type: \"Issue\", id: \"456\" }, \"parent\", { type: \"Repository\", id: \"acme\" }]\n ]\n);\n" - lang: python label: Python source: "import os\nfrom oso_cloud import Oso, Value\n\noso = Oso(api_key=os.environ.get('OSO_CLOUD_API_KEY', None))\n\n# List all repositories the user can read\nalice = Value(\"User\", \"alice\")\nrepository_ids = oso.list(alice, \"read\", \"Repository\")\nprint(f\"Readable repositories: {repository_ids}\")\n\n# With context facts\nissue_ids = oso.list(\n alice, \n \"read\", \n \"Issue\",\n context_facts=[\n (\"has_relation\", Value(\"Issue\", \"123\"), \"parent\", Value(\"Repository\", \"anvils\")),\n (\"has_relation\", Value(\"Issue\", \"456\"), \"parent\", Value(\"Repository\", \"acme\"))\n ]\n)\n" - lang: go label: Go source: "package main\n\nimport (\n \"log\"\n \"os\"\n oso \"github.com/osohq/go-oso-cloud/v2\"\n)\n\nfunc main() {\n apiKey := os.Getenv(\"OSO_CLOUD_API_KEY\")\n osoClient := oso.NewClient(\"https://cloud.osohq.com\", apiKey)\n\n// List all repositories the user can read\nuser := oso.NewValue(\"User\", \"alice\")\nrepositoryIds, err := osoClient.List(user, \"read\", \"Repository\", nil)\nif err != nil {\n log.Fatal(err)\n}\nfmt.Printf(\"Readable repositories: %v\\n\", repositoryIds)\n\n// With context facts\ncontextFacts := []oso.Fact{\n oso.NewFact(\"has_relation\", oso.NewValue(\"Issue\", \"123\"), oso.String(\"parent\"), oso.NewValue(\"Repository\", \"anvils\")),\n oso.NewFact(\"has_relation\", oso.NewValue(\"Issue\", \"456\"), oso.String(\"parent\"), oso.NewValue(\"Repository\", \"acme\")),\n}\nissueIds, err := osoClient.ListWithContext(user, \"read\", \"Issue\", contextFacts)\n}\n" - lang: java label: Java source: "package com.mycompany;\n\nimport java.io.IOException;\nimport java.util.Arrays;\nimport java.util.List;\nimport com.osohq.oso_cloud.Oso;\nimport com.osohq.oso_cloud.api.ApiException;\nimport com.osohq.oso_cloud.api.Value;\n\npublic class App {\n public static void main(String[] args) {\n String apiKey = System.getenv(\"OSO_CLOUD_API_KEY\");\n Oso oso = new Oso(apiKey);\n \n try {\n // List all repositories the user can read\n Value alice = new Value(\"User\", \"alice\");\n List repositoryIds = oso.list(alice, \"read\", \"Repository\");\n System.out.println(\"Readable repositories: \" + repositoryIds);\n \n // With context facts\n Value issue1 = new Value(\"Issue\", \"123\");\n Value issue2 = new Value(\"Issue\", \"456\");\n Value repo1 = new Value(\"Repository\", \"anvils\");\n Value repo2 = new Value(\"Repository\", \"acme\");\n \n List issueIds = oso.list(alice, \"read\", \"Issue\", Arrays.asList(\n Arrays.asList(\"has_relation\", issue1, \"parent\", repo1),\n Arrays.asList(\"has_relation\", issue2, \"parent\", repo2)\n ));\n } catch (IOException | ApiException e) {\n System.err.println(\"Error: \" + e.getMessage());\n }\n }\n}\n" - lang: ruby label: Ruby source: "require 'oso-cloud'\n\napi_key = ENV.fetch('OSO_CLOUD_API_KEY', nil)\noso = OsoCloud::Oso.new(url: \"https://cloud.osohq.com\", api_key: api_key)\n\n# List all repositories the user can read\nalice = OsoCloud::Value.new(type: \"User\", id: \"alice\")\nrepository_ids = oso.list(alice, \"read\", \"Repository\")\nputs \"Readable repositories: #{repository_ids}\"\n\n# With context facts\nissue_ids = oso.list(alice, \"read\", \"Issue\", \n context_facts: [\n [\"has_relation\", OsoCloud::Value.new(type: \"Issue\", id: \"123\"), \"parent\", OsoCloud::Value.new(type: \"Repository\", id: \"anvils\")],\n [\"has_relation\", OsoCloud::Value.new(type: \"Issue\", id: \"456\"), \"parent\", OsoCloud::Value.new(type: \"Repository\", id: \"acme\")]\n ]\n)\n" - lang: csharp label: C# source: "using OsoCloud;\n\nstring? apiKey = Environment.GetEnvironmentVariable(\"OSO_CLOUD_API_KEY\");\nvar oso = new Oso(\"https://api.osohq.com\", apiKey);\n\n// List all repositories the user can read\nvar alice = new Value(\"User\", \"alice\");\nvar repositoryIds = await oso.List(alice, \"read\", \"Repository\");\nConsole.WriteLine($\"Readable repositories: {string.Join(\", \", repositoryIds)}\");\n\n// With context facts\nvar issueIds = await oso.List(alice, \"read\", \"Issue\", \n contextFacts: new[] {\n new[] { \"has_relation\", new Value(\"Issue\", \"123\"), \"parent\", new Value(\"Repository\", \"anvils\") },\n new[] { \"has_relation\", new Value(\"Issue\", \"456\"), \"parent\", new Value(\"Repository\", \"acme\") }\n });\n" /actions: post: tags: - Check API description: Fetches a list of actions which an actor can perform on a particular resource. operationId: post_actions requestBody: content: application/json: schema: $ref: '#/components/schemas/ActionsQuery' required: true responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/ActionsResult' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ApiError' security: - ApiKey: [] x-codeSamples: - lang: javascript label: Node.js source: "import { Oso } from 'oso-cloud';\n\nconst apiKey = process.env.OSO_CLOUD_API_KEY;\nconst oso = new Oso(\"https://cloud.osohq.com\", apiKey);\n\n// Get all actions user can perform on repository\nconst user = { type: \"User\", id: \"alice\" };\nconst repository = { type: \"Repository\", id: \"anvils\" };\nconst actions = await oso.actions(user, repository);\nconsole.log(\"Available actions:\", actions);\n\n// With context facts\nconst issue = { type: \"Issue\", id: \"123\" };\nconst contextActions = await oso.actions(\n user, \n issue, \n [[\"has_relation\", issue, \"parent\", repository]]\n);\n" - lang: python label: Python source: "import os\nfrom oso_cloud import Oso, Value\n\noso = Oso(api_key=os.environ.get('OSO_CLOUD_API_KEY', None))\n\n# Get all actions user can perform on repository\nalice = Value(\"User\", \"alice\")\nrepository = Value(\"Repository\", \"anvils\")\nactions = oso.actions(alice, repository)\nprint(f\"Available actions: {actions}\")\n\n# With context facts\nissue = Value(\"Issue\", \"123\")\nactions = oso.actions(\n alice, \n issue, \n context_facts=[(\"has_relation\", issue, \"parent\", repository)]\n)\n" - lang: go label: Go source: "package main\n\nimport (\n \"log\"\n \"os\"\n oso \"github.com/osohq/go-oso-cloud/v2\"\n)\n\nfunc main() {\n apiKey := os.Getenv(\"OSO_CLOUD_API_KEY\")\n osoClient := oso.NewClient(\"https://cloud.osohq.com\", apiKey)\n\n// Get all actions user can perform on repository\nuser := oso.NewValue(\"User\", \"alice\")\nrepository := oso.NewValue(\"Repository\", \"anvils\")\nactions, err := osoClient.Actions(user, repository)\nif err != nil {\n log.Fatal(err)\n}\nfmt.Printf(\"Available actions: %v\\n\", actions)\n\n// With context facts\nissue := oso.NewValue(\"Issue\", \"123\")\ncontextFacts := []oso.Fact{\n oso.NewFact(\"has_relation\", issue, oso.String(\"parent\"), repository),\n}\nactions, err = osoClient.ActionsWithContext(user, issue, contextFacts)\n}\n" - lang: java label: Java source: "package com.mycompany;\n\nimport java.io.IOException;\nimport java.util.Arrays;\nimport java.util.List;\nimport com.osohq.oso_cloud.Oso;\nimport com.osohq.oso_cloud.api.ApiException;\nimport com.osohq.oso_cloud.api.Value;\n\npublic class App {\n public static void main(String[] args) {\n String apiKey = System.getenv(\"OSO_CLOUD_API_KEY\");\n Oso oso = new Oso(apiKey);\n \n try {\n // Get all actions user can perform on repository\n Value user = new Value(\"User\", \"alice\");\n Value repository = new Value(\"Repository\", \"anvils\");\n List actions = oso.actions(user, repository);\n System.out.println(\"Available actions: \" + actions);\n \n // With context facts\n Value issue = new Value(\"Issue\", \"123\");\n List contextActions = oso.actions(user, issue,\n Arrays.asList(Arrays.asList(\"has_relation\", issue, \"parent\", repository)));\n } catch (IOException | ApiException e) {\n System.err.println(\"Error: \" + e.getMessage());\n }\n }\n}\n" - lang: ruby label: Ruby source: "require 'oso-cloud'\n\napi_key = ENV.fetch('OSO_CLOUD_API_KEY', nil)\noso = OsoCloud::Oso.new(url: \"https://cloud.osohq.com\", api_key: api_key)\n\n# Get all actions user can perform on repository\nuser = OsoCloud::Value.new(type: \"User\", id: \"alice\")\nrepository = OsoCloud::Value.new(type: \"Repository\", id: \"anvils\")\nactions = oso.actions(user, repository)\nputs \"Available actions: #{actions}\"\n\n# With context facts\nissue = OsoCloud::Value.new(type: \"Issue\", id: \"123\")\ncontext_actions = oso.actions(user, issue,\n context_facts: [[\"has_relation\", issue, \"parent\", repository]])\n" - lang: csharp label: C# source: "using OsoCloud;\n\nstring? apiKey = Environment.GetEnvironmentVariable(\"OSO_CLOUD_API_KEY\");\nvar oso = new Oso(\"https://api.osohq.com\", apiKey);\n\n// Get all actions user can perform on repository\nvar user = new Value(\"User\", \"alice\");\nvar repository = new Value(\"Repository\", \"anvils\");\nvar actions = await oso.Actions(user, repository);\nConsole.WriteLine($\"Available actions: {string.Join(\", \", actions)}\");\n\n// With context facts\nvar issue = new Value(\"Issue\", \"123\");\nvar contextActions = await oso.Actions(user, issue,\n contextFacts: new[] { new[] { \"has_relation\", issue, \"parent\", repository } });\n" /query: post: tags: - Check API description: 'Query v1: query for any predicate and any combination of concrete and wildcard arguments. Unlike `GET /facts`, which only lists facts you''ve added to Oso Cloud, you can use `POST /query` to list derived information about any rule in your policy.' operationId: post_query requestBody: content: application/json: schema: $ref: '#/components/schemas/QueryDeprecated' required: true responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/QueryResultDeprecated' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ApiError' deprecated: true security: - ApiKey: [] /evaluate_query: post: tags: - Check API description: 'Query v2: query for any expression. Unlike `GET /facts`, which only lists facts you''ve added to Oso Cloud, you can use `POST /evaluate_query` to list derived information about any rule in your policy.' operationId: post_evaluate_query requestBody: content: application/json: schema: $ref: '#/components/schemas/Query' required: true responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/QueryResult' default: description: '' content: application/json: schema: $ref: '#/components/schemas/ApiError' security: - ApiKey: [] x-codeSamples: - lang: javascript label: Node.js source: "import { Oso } from 'oso-cloud';\n\nconst apiKey = process.env.OSO_CLOUD_API_KEY;\nconst oso = new Oso(\"https://cloud.osohq.com\", apiKey);\n\n// Basic query building\nconst actor = { type: \"User\", id: \"alice\" };\nconst repository = { type: \"Repository\", id: \"anvils\" };\nconst query = oso.buildQuery([\"allow\", actor, \"read\", repository]);\nconst result = await query.evaluate(repository);\n\n// Add constraints with 'and'\nconst constrainedQuery = oso.buildQuery([\"allow\", actor, \"read\", repository])\n .and([\"has_relation\", repository, \"folder\", { type: \"Folder\", id: \"docs\" }]);\n\n// Different evaluation modes\nconst exists = await query.evaluate(); // Boolean\nconst actions = await query.evaluate(\"action\"); // Single variable\nconst pairs = await query.evaluate([\"action\", \"repository\"]); // Tuple variables\n" - lang: python label: Python source: "import os\nfrom oso_cloud import Oso, Value\n\noso = Oso(api_key=os.environ.get('OSO_CLOUD_API_KEY', None))\n\n# Basic query building\nactor = Value(\"User\", \"alice\")\nrepository = Value(\"Repository\", \"anvils\")\nquery = oso.build_query((\"allow\", actor, \"read\", repository))\nresult = query.evaluate(repository)\n\n# Add constraints with 'and_'\nconstrained_query = oso.build_query((\"allow\", actor, \"read\", repository)) \\\n .and_((\"has_relation\", repository, \"folder\", Value(\"Folder\", \"docs\")))\n\n# Different evaluation modes\nexists = query.evaluate() # Boolean\nactions = query.evaluate(\"action\") # Single variable\npairs = query.evaluate((\"action\", \"repository\")) # Tuple variables\n" - lang: go label: Go source: "package main\n\nimport (\n \"log\"\n \"os\"\n oso \"github.com/osohq/go-oso-cloud/v2\"\n)\n\nfunc main() {\n apiKey := os.Getenv(\"OSO_CLOUD_API_KEY\")\n osoClient := oso.NewClient(\"https://cloud.osohq.com\", apiKey)\n\n// Basic query building\nactor := oso.NewValue(\"User\", \"alice\")\nrepository := oso.NewValue(\"Repository\", \"anvils\")\nquery := osoClient.BuildQuery(oso.NewQueryFact(\"allow\", actor, oso.String(\"read\"), repository))\nrepos, err := query.EvaluateValues(repository)\n\n// Add constraints with 'And'\nfolder := oso.NewValue(\"Folder\", \"docs\")\nconstrainedQuery := osoClient.BuildQuery(oso.NewQueryFact(\"allow\", actor, oso.String(\"read\"), repository)).\n And(oso.NewQueryFact(\"has_relation\", repository, oso.String(\"folder\"), folder))\n\n// Different evaluation modes\nallowed, err := query.EvaluateExists() // Boolean\nactions, err := query.EvaluateValues(oso.NewVariable(\"action\")) // Values for variable\n}\n" - lang: java label: Java source: "package com.mycompany;\n\nimport java.io.IOException;\nimport com.osohq.oso_cloud.Oso;\nimport com.osohq.oso_cloud.api.ApiException;\nimport com.osohq.oso_cloud.api.Value;\n\npublic class App {\n public static void main(String[] args) {\n String apiKey = System.getenv(\"OSO_CLOUD_API_KEY\");\n Oso oso = new Oso(apiKey);\n \n try {\n // Basic query building\n Value actor = new Value(\"User\", \"alice\");\n Value repository = new Value(\"Repository\", \"anvils\");\n var query = oso.buildQuery(\"allow\", actor, \"read\", repository);\n var result = query.evaluate(repository);\n \n // Add constraints with 'and'\n Value folder = new Value(\"Folder\", \"docs\");\n var constrainedQuery = oso.buildQuery(\"allow\", actor, \"read\", repository)\n .and(\"has_relation\", repository, \"folder\", folder);\n \n // Different evaluation modes\n boolean exists = query.evaluate(); // Boolean\n var actions = query.evaluate(\"action\"); // Single variable\n var pairs = query.evaluate(\"action\", \"repository\"); // Tuple variables\n } catch (IOException | ApiException e) {\n System.err.println(\"Error: \" + e.getMessage());\n }\n }\n}\n" - lang: ruby label: Ruby source: "require 'oso-cloud'\n\napi_key = ENV.fetch('OSO_CLOUD_API_KEY', nil)\noso = OsoCloud::Oso.new(url: \"https://cloud.osohq.com\", api_key: api_key)\n\n# Basic query building\nactor = OsoCloud::Value.new(type: \"User\", id: \"alice\")\nrepository = OsoCloud::Value.new(type: \"Repository\", id: \"anvils\")\nquery = oso.build_query([\"allow\", actor, \"read\", repository])\nresult = query.evaluate(repository)\n\n# Add constraints with 'and_'\nfolder = OsoCloud::Value.new(type: \"Folder\", id: \"docs\")\nconstrained_query = oso.build_query([\"allow\", actor, \"read\", repository])\n .and_([\"has_relation\", repository, \"folder\", folder])\n\n# Different evaluation modes\nexists = query.evaluate() # Boolean\nactions = query.evaluate(\"action\") # Single variable\npairs = query.evaluate([\"action\", \"repository\"]) # Tuple variables\n" - lang: csharp label: C# source: "using OsoCloud;\n\nstring? apiKey = Environment.GetEnvironmentVariable(\"OSO_CLOUD_API_KEY\");\nvar oso = new Oso(\"https://api.osohq.com\", apiKey);\n\n// Basic query building\nvar actor = new Value(\"User\", \"alice\");\nvar repository = new Value(\"Repository\", \"anvils\");\nvar query = oso.BuildQuery(\"allow\", actor, \"read\", repository);\nvar result = await query.Evaluate(repository);\n\n// Add constraints with 'And'\nvar folder = new Value(\"Folder\", \"docs\");\nvar constrainedQuery = oso.BuildQuery(\"allow\", actor, \"read\", repository)\n .And(\"has_relation\", repository, \"folder\", folder);\n\n// Different evaluation modes\nbool exists = await query.Evaluate(); // Boolean\nvar actions = await query.Evaluate(\"action\"); // Single variable\nvar pairs = await query.Evaluate(new[] { \"action\", \"repository\" }); // Tuple variables\n" components: schemas: ListResult: type: object required: - results - next_page_token properties: results: type: array items: type: string next_page_token: description: Optional token for fetching the next page of results. Present when more results are available. type: string nullable: true Constraint: description: Constraints on a variable. All variables must have a type, and they may also be constrained to a set of values. type: object required: - type properties: type: description: The type of the variable. type: string ids: description: The possible values of the variable. `None` means the variable can be any value. `Some(["foo"])` means the variable must be exactly `"foo"`. `Some(["foo", "bar"])` means the variable can be either `"foo"` or `"bar"`. The latter is how we represent `In` expressions in the new Query API. type: array items: type: string nullable: true ApiError: type: object required: - message properties: message: type: string ListQuery: type: object required: - action - actor_id - actor_type - resource_type - page_size properties: actor_type: type: string actor_id: type: string action: type: string resource_type: type: string context_facts: default: [] type: array items: $ref: '#/components/schemas/Fact' page_size: description: Required. Page size for pagination. Must be at least 10,000. Results will be paginated and a `next_page_token` will be included in the response if more results are available. Ignored when `page_token` is provided, since the page size is determined by the original request. default: 10000 type: integer format: uint minimum: 10000 page_token: description: Page token for fetching subsequent pages of results. Use the `next_page_token` from a previous response. When provided, `page_size` is ignored. default: null type: string nullable: true ActionsQuery: type: object required: - actor_id - actor_type - resource_id - resource_type properties: actor_type: type: string actor_id: type: string resource_type: type: string resource_id: type: string context_facts: default: [] type: array items: $ref: '#/components/schemas/Fact' AuthorizeResourcesResult: type: object required: - results properties: results: type: array items: $ref: '#/components/schemas/Value' Query: description: A generic query comprising 1+ predicates conjuncted together. type: object required: - calls - constraints - context_facts - predicate properties: predicate: description: 'Predicate name and variable names. INVARIANT: all variable names must exist in `constraints`. This ensures that all variables at least have a type.' type: array items: - type: string - type: array items: type: string maxItems: 2 minItems: 2 calls: description: 'Predicate name and variable names. INVARIANT: all variable names must exist in `constraints`. This ensures that all variables at least have a type.' type: array items: type: array items: - type: string - type: array items: type: string maxItems: 2 minItems: 2 constraints: description: Map of variable names to their type and value(s). Every variable is at least typed and may also be constrained to a set of values. type: object additionalProperties: $ref: '#/components/schemas/Constraint' context_facts: type: array items: $ref: '#/components/schemas/ConcreteFact' TypedId: type: object required: - id - type properties: type: type: string id: type: string ActionsResult: type: object required: - results properties: results: type: array items: type: string QueryDeprecated: type: object required: - fact properties: fact: $ref: '#/components/schemas/Fact' context_facts: default: [] type: array items: $ref: '#/components/schemas/Fact' AuthorizeQuery: type: object required: - action - actor_id - actor_type - resource_id - resource_type properties: actor_type: type: string actor_id: type: string action: type: string resource_type: type: string resource_id: type: string context_facts: default: [] type: array items: $ref: '#/components/schemas/Fact' Value: type: object properties: type: type: string nullable: true id: type: string nullable: true AuthorizeResult: type: object required: - allowed properties: allowed: type: boolean QueryResultDeprecated: type: object required: - results properties: results: type: array items: $ref: '#/components/schemas/Fact' AuthorizeResourcesQuery: type: object required: - action - actor_id - actor_type - resources properties: actor_type: type: string actor_id: type: string action: type: string resources: type: array items: $ref: '#/components/schemas/Value' context_facts: default: [] type: array items: $ref: '#/components/schemas/Fact' QueryResult: type: object required: - results properties: results: type: array items: type: object additionalProperties: type: string nullable: true Fact: description: 'A pattern object for matching authorization-relevant data, ie: facts.' type: object required: - args - predicate properties: predicate: type: string args: type: array items: $ref: '#/components/schemas/Value' ConcreteFact: description: 'A specific piece of authorization-relevant data, ie: a fact. `ConcreteFact`s are suitable for storing in the database, since they represent the information in a specific, fully-qualified fact. To represent the set of facts matching a pattern instead, see [`Fact`].' type: object required: - args - predicate properties: predicate: type: string args: type: array items: $ref: '#/components/schemas/TypedId' securitySchemes: ApiKey: description: Requires an API key to access. type: http scheme: bearer bearerFormat: Bearer e_0123_123_token0123