Authoring Schema Operations

Use the configured POLICY_API base and protected POLICY_AUTH_HEADER file from authentication. All paths below are relative to that base. Examples read the bearer header from that file. Keep request payloads and logs free of credentials. Consult your deployed /doc document for complete nested schemas. Response examples illustrate relevant fields rather than every optional property.

These application programming interface (API) reads return 200 with schema vocabulary. They accept no request body and do not save or approve a policy. Gateway access rules apply. These reads do not require a separate command capability. Policy Integration Manager (PIM) owns the Data target vocabulary.

Cedar is the policy language whose schema defines entity types, attributes, and actions. Schema responses describe allowed types and actions. They do not list discovered users, groups, or data locations. Use /catalog/principals and /catalog/resources to obtain the identifiers needed by compile requests. For actions, use the vocabulary required by that request field rather than copying a display label from another endpoint.

GET /schema/cedar

Retrieve Cedar schema used by Policy.

Path parameters

None.

Request body

None.

Request parameters

None.

Sample request:

curl --fail-with-body -H "@${POLICY_AUTH_HEADER:?Complete authentication setup}" \
  "${POLICY_API}/schema/cedar"

Response

Cedar schema payload.

Sample response:

{
  "filename": "protegrity.cedarschema",
  "namespaces": ["Protegrity"],
  "source": "namespace Protegrity { ... }"
}

Error codes:

Possible error codes are 401, 403, and 500.

GET /schema/actions

Retrieve the schema-sourced action vocabulary grouped by enforcement point.

Path parameters

None.

Request body

None.

Request parameters

None.

Sample request:

curl --fail-with-body -H "@${POLICY_AUTH_HEADER:?Complete authentication setup}" \
  "${POLICY_API}/schema/actions"

Response

SchemaActionCatalog, grouped by enforcement point. Each group identifies its actual Cedar namespace and declared action identifiers. The federated and data-protection groups expose different native vocabularies.

Sample response:

{
  "enforcement_points": {
    "federated": {
      "enforcement_point": "federated",
      "namespace": "FederatedGuardrails",
      "actions": []
    },
    "data-protection": {
      "enforcement_point": "data-protection",
      "namespace": "PIM",
      "actions": []
    }
  }
}

Error codes:

Possible error codes are 401, 403, and 500.

GET /schema/authoring-actions

Retrieve the abstract vocabulary accepted within /policies/compile, filtered by enforcement point.

Path parameters

None.

Request body

None.

Request parameters

None.

Sample request:

curl --fail-with-body -H "@${POLICY_AUTH_HEADER:?Complete authentication setup}" \
  "${POLICY_API}/schema/authoring-actions"

Response

AuthoringActionCatalog, grouped by enforcement point. Data authoring includes viewNull for explicit null-read permission. The federated group returns an empty abstract-action list. Use its native matrix and the FEDX variant of /policies/preview instead. Here, FEDX is the API selector for Federated Guardrails, not a separate product. An empty abstract-action list does not mean that target has no native actions. An empty Data actions array does not request null-read permission. Select viewNull explicitly.

Sample response:

{
  "enforcement_points": {
    "federated": {
      "enforcement_point": "federated",
      "actions": []
    },
    "data-protection": {
      "enforcement_point": "data-protection",
      "actions": ["viewNull", "viewCleartext", "viewProtected", "protect", "reprotect"]
    }
  }
}

Error codes:

Possible error codes are 401, 403, and 500.

GET /schema/attributes

Retrieve schema-sourced attribute-based access control (ABAC) and row-level security (RLS) attributes.

Path parameters

None.

Request body

None.

Request parameters

None.

Sample request:

curl --fail-with-body -H "@${POLICY_AUTH_HEADER:?Complete authentication setup}" \
  "${POLICY_API}/schema/attributes"

Response

Attribute catalog for principal, resource, and context conditions.

Sample response:

{
  "principals": {
    "Role": [
      {
        "path": "principal.name",
        "label": "Name",
        "type": "String",
        "optional": false,
        "is_set": false,
        "enum_values": []
      }
    ]
  },
  "resource": [],
  "context": [],
  "enums": {}
}

Error codes:

Possible error codes are 401, 403, and 500.