openapi: 3.0.3
info:
  title: EOPA REST API
  version: 0.2.0
  contact:
    name: Open Policy Agent
    url: "https://github.com/open-policy-agent/eopa"
externalDocs:
  description: EOPA documentation
  url: "https://github.com/open-policy-agent/eopa/docs"
  x-openpolicyagent-documentation-url: "https://www.openpolicyagent.org/docs/latest/"
servers:
  - url: http://localhost:8181
    description: Local development server
paths:
  /:
    post:
      parameters:
        - $ref: "#/components/parameters/pretty"
        - $ref: "#/components/parameters/GzipAcceptEncoding"
      summary: Execute the default decision  given an input
      operationId: executeDefaultPolicyWithInput
      x-speakeasy-usage-example: true
      requestBody:
        description: The input document
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/input"
      responses:
        "200":
          $ref: "#/components/responses/SuccessfulDefaultPolicyEvaluation"
        "400":
          $ref: "#/components/responses/BadRequest"
        "404":
          $ref: "#/components/responses/PolicyNotFound"
        "500":
          $ref: "#/components/responses/ServerError"
  /v1/data/{path}:
    get:
      parameters:
        - $ref: "#/components/parameters/policyPath"
        - $ref: "#/components/parameters/GzipAcceptEncoding"
        - $ref: "#/components/parameters/pretty"
        - $ref: "#/components/parameters/provenance"
        - $ref: "#/components/parameters/explain"
        - $ref: "#/components/parameters/metrics"
        - $ref: "#/components/parameters/instrument"
        - $ref: "#/components/parameters/strict-builtin-errors"
      summary: Execute a policy
      operationId: executePolicy
      responses:
        "200":
          $ref: "#/components/responses/SuccessfulPolicyEvaluation"
        "400":
          $ref: "#/components/responses/BadRequest"
        "500":
          $ref: "#/components/responses/ServerError"
    post:
      parameters:
        - $ref: "#/components/parameters/policyPath"
        - $ref: "#/components/parameters/GzipContentEncoding"
        - $ref: "#/components/parameters/GzipAcceptEncoding"
        - $ref: "#/components/parameters/pretty"
        - $ref: "#/components/parameters/provenance"
        - $ref: "#/components/parameters/explain"
        - $ref: "#/components/parameters/metrics"
        - $ref: "#/components/parameters/instrument"
        - $ref: "#/components/parameters/strict-builtin-errors"
      summary: Execute a policy given an input
      operationId: executePolicyWithInput
      x-speakeasy-usage-example: true
      requestBody:
        description: The input document
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [input]
              properties:
                input:
                  $ref: "#/components/schemas/input"
      responses:
        "200":
          $ref: "#/components/responses/SuccessfulPolicyEvaluation"
        "400":
          $ref: "#/components/responses/BadRequest"
        "500":
          $ref: "#/components/responses/ServerError"
  /v1/batch/data/{path}:
    post:
      parameters:
        - $ref: "#/components/parameters/policyPath"
        - $ref: "#/components/parameters/GzipContentEncoding"
        - $ref: "#/components/parameters/GzipAcceptEncoding"
        - $ref: "#/components/parameters/pretty"
        - $ref: "#/components/parameters/provenance"
        - $ref: "#/components/parameters/explain"
        - $ref: "#/components/parameters/metrics"
        - $ref: "#/components/parameters/instrument"
        - $ref: "#/components/parameters/strict-builtin-errors"
      summary: Execute a policy given a batch of inputs
      operationId: executeBatchPolicyWithInput
      x-speakeasy-usage-example: true
      requestBody:
        description: The batch of inputs
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [inputs]
              properties:
                inputs:
                  type: object
                  additionalProperties:
                    $ref: "#/components/schemas/input"
      responses:
        "200":
          { $ref: "#/components/responses/BatchSuccessfulPolicyEvaluation" }
        "207": { $ref: "#/components/responses/BatchMixedResults" }
        "400": { $ref: "#/components/responses/BadRequest" }
        "500": { $ref: "#/components/responses/BatchServerError" }
  /v1/compile/{path}:
    post:
      parameters:
        - $ref: "#/components/parameters/policyPath"
        - $ref: "#/components/parameters/GzipAcceptEncoding"
        - $ref: "#/components/parameters/GzipContentEncoding"
        - $ref: "#/components/parameters/pretty"
        - $ref: "#/components/parameters/explain"
        - $ref: "#/components/parameters/metrics"
        - $ref: "#/components/parameters/instrument"
      summary: Partially evaluate a query
      operationId: compileQueryWithPartialEvaluation
      x-speakeasy-usage-example: false
      requestBody:
        description: The query, input, and other settings for partial evaluation.
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [query]
              properties:
                options:
                  $ref: "#/components/schemas/CompileOptions"
                unknowns:
                  $ref: "#/components/schemas/CompileUnknowns"
                input:
                  $ref: "#/components/schemas/input"
                  description: The input document to use during partial evaluation.
          application/vnd.styra.multitarget+json:
            schema:
              type: object
              properties:
                options:
                  $ref: "#/components/schemas/CompileOptions"
                unknowns:
                  $ref: "#/components/schemas/CompileUnknowns"
                input:
                  $ref: "#/components/schemas/input"
                  description: The input document to use during partial evaluation.
          application/vnd.styra.ucast.all+json:
            schema:
              type: object
              properties:
                options:
                  $ref: "#/components/schemas/CompileOptions"
                unknowns:
                  $ref: "#/components/schemas/CompileUnknowns"
                input:
                  $ref: "#/components/schemas/input"
                  description: The input document to use during partial evaluation.
          application/vnd.styra.ucast.minimal+json:
            schema:
              type: object
              properties:
                options:
                  $ref: "#/components/schemas/CompileOptions"
                unknowns:
                  $ref: "#/components/schemas/CompileUnknowns"
                input:
                  $ref: "#/components/schemas/input"
                  description: The input document to use during partial evaluation.
          application/vnd.styra.ucast.linq+json:
            schema:
              type: object
              properties:
                options:
                  $ref: "#/components/schemas/CompileOptions"
                unknowns:
                  $ref: "#/components/schemas/CompileUnknowns"
                input:
                  $ref: "#/components/schemas/input"
                  description: The input document to use during partial evaluation.
          application/vnd.styra.ucast.prisma+json:
            schema:
              type: object
              properties:
                options:
                  $ref: "#/components/schemas/CompileOptions"
                unknowns:
                  $ref: "#/components/schemas/CompileUnknowns"
                input:
                  $ref: "#/components/schemas/input"
                  description: The input document to use during partial evaluation.
          application/vnd.styra.sql.sqlserver+json:
            schema:
              type: object
              properties:
                options:
                  $ref: "#/components/schemas/CompileOptions"
                unknowns:
                  $ref: "#/components/schemas/CompileUnknowns"
                input:
                  $ref: "#/components/schemas/input"
                  description: The input document to use during partial evaluation.
          application/vnd.styra.sql.mysql+json:
            schema:
              type: object
              properties:
                options:
                  $ref: "#/components/schemas/CompileOptions"
                unknowns:
                  $ref: "#/components/schemas/CompileUnknowns"
                input:
                  $ref: "#/components/schemas/input"
                  description: The input document to use during partial evaluation.
          application/vnd.styra.sql.postgresql+json:
            schema:
              type: object
              properties:
                options:
                  $ref: "#/components/schemas/CompileOptions"
                unknowns:
                  $ref: "#/components/schemas/CompileUnknowns"
                input:
                  $ref: "#/components/schemas/input"
                  description: The input document to use during partial evaluation.
          application/vnd.styra.sql.sqlite+json:
            schema:
              type: object
              properties:
                options:
                  $ref: "#/components/schemas/CompileOptions"
                unknowns:
                  $ref: "#/components/schemas/CompileUnknowns"
                input:
                  $ref: "#/components/schemas/input"
                  description: The input document to use during partial evaluation.
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CompileResultJSON"
            application/vnd.styra.multitarget+json:
              schema:
                $ref: "#/components/schemas/CompileResultMultitarget"
            application/vnd.styra.ucast.all+json:
              schema:
                $ref: "#/components/schemas/CompileResultUCAST"
            application/vnd.styra.ucast.minimal+json:
              schema:
                $ref: "#/components/schemas/CompileResultUCAST"
            application/vnd.styra.ucast.linq+json:
              schema:
                $ref: "#/components/schemas/CompileResultUCAST"
            application/vnd.styra.ucast.prisma+json:
              schema:
                $ref: "#/components/schemas/CompileResultUCAST"
            application/vnd.styra.sql.sqlserver+json:
              schema:
                $ref: "#/components/schemas/CompileResultSQL"
            application/vnd.styra.sql.mysql+json:
              schema:
                $ref: "#/components/schemas/CompileResultSQL"
            application/vnd.styra.sql.postgresql+json:
              schema:
                $ref: "#/components/schemas/CompileResultSQL"
            application/vnd.styra.sql.sqlite+json:
              schema:
                $ref: "#/components/schemas/CompileResultSQL"
        "400":
          $ref: "#/components/responses/BadRequest"
        "500":
          $ref: "#/components/responses/ServerError"
  /health:
    get:
      parameters:
        - $ref: "#/components/parameters/bundles"
        - $ref: "#/components/parameters/plugins"
        - $ref: "#/components/parameters/exclude-plugin"
      summary: Verify the server is operational
      operationId: health
      description: The health API endpoint executes a simple built-in policy query to verify that the server is operational. Optionally it can account for bundle activation as well (useful for “ready” checks at startup).
      responses:
        "200":
          $ref: "#/components/responses/HealthyServer"
        "500":
          $ref: "#/components/responses/UnhealthyServer"
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
  headers:
    GzipContentEncoding:
      description: Indicates that the response body is gzip encoded
      schema:
        type: string
        enum: [gzip]
  parameters:
    policyPath:
      name: path
      in: path
      description: The path separator is used to access values inside object and array documents. If the path indexes into an array, the server will attempt to convert the array index to an integer. If the path element cannot be converted to an integer, the server will respond with 404.
      required: true
      schema:
        type: string
        default: ""
        format: urlPath
        example: "app/rbac"
    GzipContentEncoding:
      name: Content-Encoding
      description: Indicates that the request body is gzip encoded
      in: header
      schema:
        type: string
        enum: [gzip]
    GzipAcceptEncoding:
      name: Accept-Encoding
      description: Indicates the server should respond with a gzip encoded body. The server will send the compressed response only if its length is above `server.encoding.gzip.min_length` value. See the configuration section
      in: header
      schema:
        type: string
        enum: [gzip]
    pretty:
      name: pretty
      description: If parameter is `true`, response will formatted for humans.
      in: query
      schema:
        type: boolean
    provenance:
      name: provenance
      description: If parameter is true, response will include build/version info in addition to the result.
      in: query
      schema:
        type: boolean
    explain:
      name: explain
      description: Return query explanation in addition to result.
      in: query
      schema:
        type: string
        enum: [notes, fails, full, debug]
    metrics:
      name: metrics
      description: Return query performance metrics in addition to result.
      in: query
      schema:
        type: boolean
    instrument:
      name: instrument
      description: Instrument query evaluation and return a superset of performance metrics in addition to result.
      in: query
      schema:
        type: boolean
    strict-builtin-errors:
      name: strict-builtin-errors
      description: Treat built-in function call errors as fatal and return an error immediately.
      in: query
      schema:
        type: boolean
    bundles:
      name: bundles
      in: query
      description: Boolean parameter to account for bundle activation status in response. This includes any discovery bundles or bundles defined in the loaded discovery configuration.
      required: false
      schema:
        type: boolean
        default: false
    plugins:
      name: plugins
      in: query
      description: Boolean parameter to account for plugin status in response.
      required: false
      schema:
        type: boolean
        default: false
    exclude-plugin:
      name: exclude-plugin
      in: query
      description: String parameter to exclude a plugin from status checks. Can be added multiple times. Does nothing if plugins is not true. This parameter is useful for special use cases where a plugin depends on the server being fully initialized before it can fully initialize itself.
      required: false
      schema:
        type: array
        default: []
        items:
          type: string
  schemas:
    input:
      description: Arbitrary JSON used within your policies by accessing `input`
      oneOf:
        - type: boolean
        - type: string
        - type: number
        - type: array
          items: {}
        - type: object
          additionalProperties: true
          example:
            user: alice
            action: read
            object: id123
            type: dog
    result:
      description: The base or virtual document referred to by the URL path. If the path is undefined, this key will be omitted.
      oneOf:
        - type: boolean
        - type: string
        - type: number
        - type: array
          items: {}
        - type: object
          additionalProperties: true
          example:
            allow: true
            user_is_admin: true
            user_is_granted: []
    provenance:
      type: object
      description: Provenance information can be requested on individual API calls and are returned inline with the API response. To obtain provenance information on an API call, specify the `provenance=true` query parameter when executing the API call.
      properties:
        version:
          type: string
        build_commit:
          type: string
        build_timestamp:
          type: string
          format: date-time
        build_host:
          type: string
        bundles:
          type: object
          additionalProperties:
            type: object
            title: Revision
            required: [revision]
            properties:
              revision:
                type: string
    ClientError:
      type: object
      required: [code, message]
      properties:
        code: { type: string }
        message: { type: string }
        errors:
          type: array
          items:
            type: object
            required: [code, message]
            properties:
              code: { type: string }
              message: { type: string }
              location:
                type: object
                required: [file, row, col]
                properties:
                  file: { type: string }
                  row: { type: integer }
                  col: { type: integer }
    ServerError:
      type: object
      required: [code, message]
      properties:
        code: { type: string }
        message: { type: string }
        errors:
          type: array
          items:
            type: object
            required: [code, message]
            properties:
              code: { type: string }
              message: { type: string }
              location:
                type: object
                required: [file, row, col]
                properties:
                  file: { type: string }
                  row: { type: integer }
                  col: { type: integer }
        decision_id:
          type: string
          example: "b84cf736-213c-4932-a8e4-bb5c648f1b4d"
    UnhealthyServer:
      type: object
      required: [code]
      properties:
        code: { type: string }
        error: { type: string }
        message: { type: string }
    HasStatusCode:
      type: object
      properties:
        http_status_code:
          type: string
      required: [http_status_code]
    SuccessfulPolicyResponseWithStatusCode:
      allOf:
        - $ref: "#/components/schemas/HasStatusCode"
        - $ref: "#/components/schemas/SuccessfulPolicyResponse"
    ServerErrorWithStatusCode:
      allOf:
        - $ref: "#/components/schemas/HasStatusCode"
        - $ref: "#/components/schemas/ServerError"
    SuccessfulPolicyResponse:
      type: object
      properties:
        result:
          $ref: "#/components/schemas/result"
        metrics:
          type: object
          description: If query metrics are enabled, this field contains query performance metrics collected during the parse, compile, and evaluation steps.
          additionalProperties: true
        decision_id:
          type: string
          description: If decision logging is enabled, this field contains a string that uniquely identifies the decision. The identifier will be included in the decision log event for this decision. Callers can use the identifier for correlation purposes.
        provenance:
          $ref: "#/components/schemas/provenance"
    CompileOptions:
      type: object
      description: Additional options to use during partial evaluation. Only the disableInlining option is currently supported in OPA. EOPA may support additional options.
      additionalProperties: true
      properties:
        disableInlining:
          type: array
          description: A list of paths to exclude from partial evaluation inlining.
          items:
            type: string
        targetDialects:
          type: array
          description: The output targets for partial evaluation. Different targets will have different constraints.
          items:
            type: string
            enum:
              - ucast+all
              - ucast+minimal
              - ucast+prisma
              - ucast+linq
              - sql+sqlserver
              - sql+mysql
              - sql+postgresql
              - sql+sqlite
        targetSQLTableMappings:
          type: object
          properties:
            sqlserver:
              type: object
              additionalProperties: true
            mysql:
              type: object
              additionalProperties: true
            postgresql:
              type: object
              additionalProperties: true
            sqlite:
              type: object
              additionalProperties: true
        maskRule:
          type: string
          description: The Rego rule to evaluate for generating column masks.
    CompileUnknowns:
      type: array
      description: The terms to treat as unknown during partial evaluation.
      items:
        type: string
      default: ["input"]
    CompileResultJSON:
      type: object
      description: The partially evaluated result of the query. Result will be empty if the query is never true.
      properties:
        result:
          type: object
          description: The partially evaluated result of the query.
          additionalProperties: true
          properties:
            query:
              type: object
            support:
              type: object
    CompileResultUCAST:
      type: object
      description: The partially evaluated result of the query, in UCAST format. Result will be empty if the query is never true.
      properties:
        result:
          type: object
          description: The partially evaluated result of the query as UCAST.
          additionalProperties: true
          properties:
            query:
              type: object
              description: UCAST JSON object describing the conditions under which the query is true.
              additionalProperties: true
            masks:
              type: object
              description: Column masking rules, where the key is the column name, and the value describes which masking function to use.
              additionalProperties:
                $ref: "#/components/schemas/MaskingRule"
    CompileResultSQL:
      type: object
      description: The partially evaluated result of the query, in SQL format. Result will be empty if the query is never true.
      properties:
        result:
          type: object
          description: The partially evaluated result of the query as SQL.
          additionalProperties: true
          properties:
            query:
              type: string
              description: String representing the SQL equivalent of the conditions under which the query is true.
            masks:
              type: object
              description: Column masking functions, where the key is the column name, and the value describes which masking function to use.
              additionalProperties:
                $ref: "#/components/schemas/MaskingRule"
    CompileResultMultitarget:
      type: object
      description: The partially evaluated result of the query, for each target dialect. Result will be empty if the query is never true.
      properties:
        result:
          type: object
          description: The partially evaluated result of the query in each target dialect.
          additionalProperties: true
          properties:
            targets:
              type: object
              properties:
                ucast:
                  type: object
                  properties:
                    query:
                      type: object
                      description: UCAST JSON object describing the conditions under which the query is true.
                    masks:
                      type: object
                      description: Column masking rules, where the first two nested keys represent the entity name and the property name, and the value describes which masking function to use.
                      additionalProperties:
                        $ref: "#/components/schemas/MaskingRule"
                sqlserver:
                  type: object
                  properties:
                    query:
                      type: string
                      description: String representing the SQL equivalent of the conditions under which the query is true.
                    masks:
                      type: object
                      description: Column masking rules, where the first two nested keys represent the table name and the column name, and the value describes which masking function to use.
                      additionalProperties:
                        $ref: "#/components/schemas/MaskingRule"
                mysql:
                  type: object
                  properties:
                    query:
                      type: string
                      description: String representing the SQL equivalent of the conditions under which the query is true.
                    masks:
                      type: object
                      description: Column masking rules, where the first two nested keys represent the table name and the column name, and the value describes which masking function to use.
                      additionalProperties:
                        $ref: "#/components/schemas/MaskingRule"
                postgresql:
                  type: object
                  properties:
                    query:
                      type: string
                      description: String representing the SQL equivalent of the conditions under which the query is true
                    masks:
                      type: object
                      description: Column masking rules, where the first two nested keys represent the table name and the column name, and the value describes which masking function to use.
                      additionalProperties:
                        $ref: "#/components/schemas/MaskingRule"
                sqlite:
                  type: object
                  properties:
                    query:
                      type: string
                      description: String representing the SQL equivalent of the conditions under which the query is true
                    masks:
                      type: object
                      description: Column masking rules, where the first two nested keys represent the table name and the column name, and the value describes which masking function to use.
                      additionalProperties:
                        $ref: "#/components/schemas/MaskingRule"
    MaskingRule:
      type: object
      additionalProperties:
        oneOf:
          - properties:
              replace:
                oneOf:
                  - type: boolean
                  - type: string
                  - type: number
                  - type: array
                    items: {}
                  - type: object
                    additionalProperties: true
  responses:
    SuccessfulDefaultPolicyEvaluation:
      description: >
        Success.

        Evaluating the default policy has the same response behavior as a successful policy evaluation, but with only the result as the response.
      headers:
        "Content-Encoding":
          $ref: "#/components/headers/GzipContentEncoding"
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/result"
    PolicyNotFound:
      description: The policy at the specified location is undefined.
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/ClientError"
    SuccessfulPolicyEvaluation:
      description: >
        Success.

        The server also returns 200 if the path refers to an undefined document. In this case, the response will not contain a result property.
      headers:
        "Content-Encoding":
          $ref: "#/components/headers/GzipContentEncoding"
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/SuccessfulPolicyResponse"
    BatchSuccessfulPolicyEvaluation:
      description: >
        All batched policy executions succeeded.

        The server also returns 200 if the path refers to an undefined document. In this case, responses will be empty.
      headers:
        "Content-Encoding":
          $ref: "#/components/headers/GzipContentEncoding"
      content:
        application/json:
          schema:
            type: object
            properties:
              batch_decision_id:
                type: string
                example: "1bef6b7d-cd13-4890-bfe1-fd2e8de32189"
              metrics:
                type: object
                description: If query metrics are enabled, this field contains query performance metrics collected during the parse, compile, and evaluation steps.
                additionalProperties: true
              responses:
                type: object
                additionalProperties:
                  $ref: "#/components/schemas/SuccessfulPolicyResponse"
    BatchMixedResults:
      description: Mixed success and failures.
      headers:
        "Content-Encoding":
          $ref: "#/components/headers/GzipContentEncoding"
      content:
        application/json:
          schema:
            type: object
            properties:
              batch_decision_id:
                type: string
              metrics:
                type: object
                description: If query metrics are enabled, this field contains query performance metrics collected during the parse, compile, and evaluation steps.
                additionalProperties: true
              responses:
                type: object
                additionalProperties:
                  type: object
                  properties:
                    http_status_code:
                      type: string
                      example: "200"
                  oneOf:
                    - $ref: "#/components/schemas/SuccessfulPolicyResponseWithStatusCode"
                    - $ref: "#/components/schemas/ServerErrorWithStatusCode"
                  discriminator:
                    propertyName: http_status_code
                    mapping:
                      "200": "#/components/schemas/SuccessfulPolicyResponseWithStatusCode"
                      "500": "#/components/schemas/ServerErrorWithStatusCode"
    BadRequest:
      description: Bad Request
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/ClientError"
    ServerError:
      description: Server Error
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/ServerError"
    BatchServerError:
      description: >
        Server Error. All requests returned a 500 error.
      content:
        application/json:
          schema:
            type: object
            properties:
              batch_decision_id:
                type: string
              responses:
                type: object
                additionalProperties:
                  $ref: "#/components/schemas/ServerError"
    HealthyServer:
      description: OPA service is healthy. If the bundles option is specified then all configured bundles have been activated. If the plugins option is specified then all plugins are in an OK state.
      content:
        application/json:
          schema:
            type: object
    UnhealthyServer:
      description: OPA service is not healthy. If the bundles option is specified this can mean any of the configured bundles have not yet been activated. If the plugins option is specified then at least one plugin is in a non-OK state.
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/UnhealthyServer"

security:
  - {}
  - bearerAuth: []