> ## Documentation Index
> Fetch the complete documentation index at: https://proxy-docs.permify.co/llms.txt
> Use this file to discover all available pages before exploring further.
# Read Schema
When a model is written to Permify using the [write schema API](./write-schema) a schema version will be returned by the API. That schema version can be used to inspect the schema.
Permify Schema needed to be send to API endpoint **/v1/tenants/{tenant_id}/schemas/read** for configuration of your authorization model on Permify API.
### Example Request on Postman
**POST** `/v1/tenants/{tenant_id}/schemas/read`
## OpenAPI
````yaml post /v1/tenants/{tenant_id}/schemas/read
openapi: 3.0.0
info:
title: Permify API
description: >-
Permify is an open source authorization service for creating fine-grained
and scalable authorization systems.
version: v1.6.10
contact:
name: API Support
url: https://github.com/Permify/permify/issues
email: hello@permify.co
license:
name: AGPL-3.0 license
url: https://github.com/Permify/permify/blob/master/LICENSE
servers: []
security: []
tags:
- name: Permission
- name: Watch
- name: Schema
- name: Data
- name: Bundle
- name: Tenancy
paths:
/v1/tenants/{tenant_id}/schemas/read:
post:
tags:
- Schema
summary: read schema
operationId: schemas.read
parameters:
- name: tenant_id
description: >-
Identifier of the tenant, if you are not using multi-tenancy (have
only one tenant) use pre-inserted tenant t1 for this
field. Required, and must match the pattern \“[a-zA-Z0-9-,]+\“, max
64 bytes.
in: path
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Schema.ReadBody'
required: true
responses:
'200':
description: A successful response.
content:
application/json:
schema:
$ref: '#/components/schemas/SchemaReadResponse'
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: '#/components/schemas/Status'
x-codeSamples:
- label: go
lang: go
source: >-
sr, err := client.Schema.Read(context.Background(),
&v1.SchemaReadRequest{
TenantId: "t1",
Metadata: &v1.SchemaReadRequestMetadata{
SchemaVersion: "cnbe6se5fmal18gpc66g",
},
})
- label: node
lang: javascript
source: |-
let res = client.schema.read({
tenantId: "t1",
metadata: {
schemaVersion: swResponse.schemaVersion,
},
})
- label: cURL
lang: curl
source: >-
curl --location --request POST
'localhost:3476/v1/tenants/{tenant_id}/schemas/read' \
--header 'Content-Type: application/json' \
--data-raw '{
"metadata": {
"schema_version": "cnbe6se5fmal18gpc66g"
}
}'
components:
schemas:
Schema.ReadBody:
type: object
properties:
metadata:
$ref: '#/components/schemas/SchemaReadRequestMetadata'
description: >-
SchemaReadRequest is the request message for the Read method in the
Schema service.
It contains tenant_id and metadata about the schema to be read.
SchemaReadResponse:
type: object
properties:
schema:
$ref: '#/components/schemas/SchemaDefinition'
description: >-
SchemaReadResponse is the response message for the Read method in the
Schema service.
It returns the requested schema.
Status:
type: object
properties:
code:
type: integer
format: int32
message:
type: string
details:
type: array
items:
$ref: '#/components/schemas/Any'
SchemaReadRequestMetadata:
type: object
properties:
schema_version:
type: string
description: >-
schema_version is the string that identifies the version of the
schema to be read.
description: >-
SchemaReadRequestMetadata provides additional information for the Schema
Read request.
It contains schema_version to specify which version of the schema should
be read.
SchemaDefinition:
type: object
properties:
entityDefinitions:
type: object
additionalProperties:
$ref: '#/components/schemas/EntityDefinition'
description: >-
Map of entity definitions. The key is the entity name, and the value
is the corresponding EntityDefinition.
ruleDefinitions:
type: object
additionalProperties:
$ref: '#/components/schemas/RuleDefinition'
description: >-
Map of rule definitions. The key is the rule name, and the value is
the corresponding RuleDefinition.
references:
type: object
additionalProperties:
$ref: '#/components/schemas/SchemaDefinition.Reference'
description: >-
Map of references to signify whether a string refers to an entity or
a rule.
description: >-
The SchemaDefinition message provides definitions for entities and
rules,
and includes references to clarify whether a name refers to an entity or
a rule.
Any:
type: object
properties:
'@type':
type: string
description: >-
A URL/resource name that uniquely identifies the type of the
serialized
protocol buffer message. This string must contain at least
one "/" character. The last segment of the URL's path must represent
the fully qualified name of the type (as in
`path/google.protobuf.Duration`). The name should be in a canonical
form
(e.g., leading "." is not accepted).
In practice, teams usually precompile into the binary all types that
they
expect it to use in the context of Any. However, for URLs which use
the
scheme `http`, `https`, or no scheme, one can optionally set up a
type
server that maps type URLs to message definitions as follows:
* If no scheme is provided, `https` is assumed.
* An HTTP GET on the URL must yield a [google.protobuf.Type][]
value in binary format, or produce an error.
* Applications are allowed to cache lookup results based on the
URL, or have them precompiled into a binary to avoid any
lookup. Therefore, binary compatibility needs to be preserved
on changes to types. (Use versioned type names to manage
breaking changes.)
Note: this functionality is not currently available in the official
protobuf release, and it is not used for type URLs beginning with
type.googleapis.com. As of May 2023, there are no widely used type
server
implementations and no plans to implement one.
Schemes other than `http`, `https` (or the empty scheme) might be
used with implementation specific semantics.
additionalProperties: {}
description: >-
`Any` contains an arbitrary serialized protocol buffer message along
with a
URL that describes the type of the serialized message.
Protobuf library provides support to pack/unpack Any values in the form
of utility functions or additional generated methods of the Any type.
Example 1: Pack and unpack a message in C++.
Foo foo = ...;
Any any;
any.PackFrom(foo);
...
if (any.UnpackTo(&foo)) {
...
}
Example 2: Pack and unpack a message in Java.
Foo foo = ...;
Any any = Any.pack(foo);
...
if (any.is(Foo.class)) {
foo = any.unpack(Foo.class);
}
// or ...
if (any.isSameTypeAs(Foo.getDefaultInstance())) {
foo = any.unpack(Foo.getDefaultInstance());
}
Example 3: Pack and unpack a message in Python.
foo = Foo(...)
any = Any()
any.Pack(foo)
...
if any.Is(Foo.DESCRIPTOR):
any.Unpack(foo)
...
Example 4: Pack and unpack a message in Go
foo := &pb.Foo{...}
any, err := anypb.New(foo)
if err != nil {
...
}
...
foo := &pb.Foo{}
if err := any.UnmarshalTo(foo); err != nil {
...
}
The pack methods provided by protobuf library will by default use
'type.googleapis.com/full.type.name' as the type URL and the unpack
methods only use the fully qualified type name after the last '/'
in the type URL, for example "foo.bar.com/x/y.z" will yield type
name "y.z".
JSON
====
The JSON representation of an `Any` value uses the regular
representation of the deserialized, embedded message, with an
additional field `@type` which contains the type URL. Example:
package google.profile;
message Person {
string first_name = 1;
string last_name = 2;
}
{
"@type": "type.googleapis.com/google.profile.Person",
"firstName": ,
"lastName":
}
If the embedded message type is well-known and has a custom JSON
representation, that representation will be embedded adding a field
`value` which holds the custom JSON in addition to the `@type`
field. Example (for message [google.protobuf.Duration][]):
{
"@type": "type.googleapis.com/google.protobuf.Duration",
"value": "1.212s"
}
EntityDefinition:
type: object
properties:
name:
type: string
description: >-
The name of the entity, which follows a specific string pattern and
has a maximum byte size.
relations:
type: object
additionalProperties:
$ref: '#/components/schemas/RelationDefinition'
description: >-
Map of relation definitions within this entity. The key is the
relation name, and the value is the RelationDefinition.
permissions:
type: object
additionalProperties:
$ref: '#/components/schemas/PermissionDefinition'
description: >-
Map of permission definitions within this entity. The key is the
permission name, and the value is the PermissionDefinition.
attributes:
type: object
additionalProperties:
$ref: '#/components/schemas/AttributeDefinition'
description: >-
Map of attribute definitions within this entity. The key is the
attribute name, and the value is the AttributeDefinition.
references:
type: object
additionalProperties:
$ref: '#/components/schemas/EntityDefinition.Reference'
description: >-
Map of references indicating whether a string pertains to a
relation, permission, or attribute.
description: >-
The EntityDefinition message provides detailed information about a
specific entity.
RuleDefinition:
type: object
properties:
name:
type: string
description: >-
The name of the rule, which follows a specific string pattern and
has a maximum byte size.
arguments:
type: object
additionalProperties:
$ref: '#/components/schemas/AttributeType'
description: >-
Map of arguments for this rule. The key is the attribute name, and
the value is the AttributeType.
expression:
$ref: '#/components/schemas/CheckedExpr'
description: >-
The RuleDefinition message provides detailed information about a
specific rule.
SchemaDefinition.Reference:
type: string
enum:
- REFERENCE_UNSPECIFIED
- REFERENCE_ENTITY
- REFERENCE_RULE
default: REFERENCE_UNSPECIFIED
description: >-
The Reference enum helps distinguish whether a name corresponds to an
entity or a rule.
- REFERENCE_UNSPECIFIED: Default, unspecified reference.
- REFERENCE_ENTITY: Indicates that the name refers to an entity.
- REFERENCE_RULE: Indicates that the name refers to a rule.
RelationDefinition:
type: object
properties:
name:
type: string
description: >-
The name of the relation, which follows a specific string pattern
and has a maximum byte size.
relationReferences:
type: array
items:
$ref: '#/components/schemas/RelationReference'
description: A list of references to other relations.
description: >-
The RelationDefinition message provides detailed information about a
specific relation.
PermissionDefinition:
type: object
properties:
name:
type: string
description: >-
The name of the permission, which follows a specific string pattern
and has a maximum byte size.
child:
$ref: '#/components/schemas/Child'
description: >-
The PermissionDefinition message provides detailed information about a
specific permission.
AttributeDefinition:
type: object
properties:
name:
type: string
description: >-
The name of the attribute, which follows a specific string pattern
and has a maximum byte size.
type:
$ref: '#/components/schemas/AttributeType'
description: >-
The AttributeDefinition message provides detailed information about a
specific attribute.
EntityDefinition.Reference:
type: string
enum:
- REFERENCE_UNSPECIFIED
- REFERENCE_RELATION
- REFERENCE_PERMISSION
- REFERENCE_ATTRIBUTE
default: REFERENCE_UNSPECIFIED
description: >-
The Reference enum specifies whether a name pertains to a relation,
permission, or attribute.
- REFERENCE_UNSPECIFIED: Default, unspecified reference.
- REFERENCE_RELATION: Indicates that the name refers to a relation.
- REFERENCE_PERMISSION: Indicates that the name refers to a permission.
- REFERENCE_ATTRIBUTE: Indicates that the name refers to an attribute.
AttributeType:
type: string
enum:
- ATTRIBUTE_TYPE_UNSPECIFIED
- ATTRIBUTE_TYPE_BOOLEAN
- ATTRIBUTE_TYPE_BOOLEAN_ARRAY
- ATTRIBUTE_TYPE_STRING
- ATTRIBUTE_TYPE_STRING_ARRAY
- ATTRIBUTE_TYPE_INTEGER
- ATTRIBUTE_TYPE_INTEGER_ARRAY
- ATTRIBUTE_TYPE_DOUBLE
- ATTRIBUTE_TYPE_DOUBLE_ARRAY
default: ATTRIBUTE_TYPE_UNSPECIFIED
description: |-
Enumerates the types of attribute.
- ATTRIBUTE_TYPE_UNSPECIFIED: Not specified attribute type. This is the default value.
- ATTRIBUTE_TYPE_BOOLEAN: A boolean attribute type.
- ATTRIBUTE_TYPE_BOOLEAN_ARRAY: A boolean array attribute type.
- ATTRIBUTE_TYPE_STRING: A string attribute type.
- ATTRIBUTE_TYPE_STRING_ARRAY: A string array attribute type.
- ATTRIBUTE_TYPE_INTEGER: An integer attribute type.
- ATTRIBUTE_TYPE_INTEGER_ARRAY: An integer array attribute type.
- ATTRIBUTE_TYPE_DOUBLE: A double attribute type.
- ATTRIBUTE_TYPE_DOUBLE_ARRAY: A double array attribute type.
CheckedExpr:
type: object
properties:
referenceMap:
type: object
additionalProperties:
$ref: '#/components/schemas/v1alpha1.Reference'
description: >-
A map from expression ids to resolved references.
The following entries are in this table:
- An Ident or Select expression is represented here if it resolves
to a
declaration. For instance, if `a.b.c` is represented by
`select(select(id(a), b), c)`, and `a.b` resolves to a declaration,
while `c` is a field selection, then the reference is attached to the
nested select expression (but not to the id or or the outer select).
In turn, if `a` resolves to a declaration and `b.c` are field selections,
the reference is attached to the ident expression.
- Every Call expression has an entry here, identifying the function
being
called.
- Every CreateStruct expression for a message has an entry,
identifying
the message.
typeMap:
type: object
additionalProperties:
$ref: '#/components/schemas/v1alpha1.Type'
description: >-
A map from expression ids to types.
Every expression node which has a type different than DYN has a
mapping
here. If an expression has type DYN, it is omitted from this map to
save
space.
sourceInfo:
$ref: '#/components/schemas/SourceInfo'
exprVersion:
type: string
description: >-
The expr version indicates the major / minor version number of the
`expr`
representation.
The most common reason for a version change will be to indicate to
the CEL
runtimes that transformations have been performed on the expr during
static
analysis. In some cases, this will save the runtime the work of
applying
the same or similar transformations prior to evaluation.
expr:
$ref: '#/components/schemas/Expr'
description: A CEL expression which has been successfully type checked.
RelationReference:
type: object
properties:
type:
type: string
description: >-
The type of the referenced entity, which follows a specific string
pattern and has a maximum byte size.
relation:
type: string
description: >-
The name of the referenced relation, which follows a specific string
pattern and has a maximum byte size.
description: >-
The RelationReference message provides a reference to a specific
relation.
Child:
type: object
properties:
leaf:
$ref: '#/components/schemas/Leaf'
rewrite:
$ref: '#/components/schemas/Rewrite'
description: Child represents a node in the permission tree.
v1alpha1.Reference:
type: object
properties:
name:
type: string
description: The fully qualified name of the declaration.
overloadId:
type: array
items:
type: string
description: >-
For references to functions, this is a list of
`Overload.overload_id`
values which match according to typing rules.
If the list has more than one element, overload resolution among the
presented candidates must happen at runtime because of dynamic
types. The
type checker attempts to narrow down this list as much as possible.
Empty if this is not a reference to a
[Decl.FunctionDecl][google.api.expr.v1alpha1.Decl.FunctionDecl].
value:
$ref: '#/components/schemas/Constant'
description: Describes a resolved reference to a declaration.
v1alpha1.Type:
type: object
properties:
dyn:
type: object
properties: {}
description: Dynamic type.
'null':
type: string
description: Null value.
primitive:
$ref: '#/components/schemas/PrimitiveType'
wrapper:
$ref: '#/components/schemas/PrimitiveType'
wellKnown:
$ref: '#/components/schemas/WellKnownType'
listType:
$ref: '#/components/schemas/ListType'
mapType:
$ref: '#/components/schemas/MapType'
function:
$ref: '#/components/schemas/FunctionType'
messageType:
type: string
description: >-
Protocol buffer message type.
The `message_type` string specifies the qualified message type name.
For
example, `google.plus.Profile`.
typeParam:
type: string
description: >-
Type param type.
The `type_param` string specifies the type parameter name, e.g.
`list`
would be a `list_type` whose element type was a `type_param` type
named `E`.
type:
$ref: '#/components/schemas/v1alpha1.Type'
error:
type: object
properties: {}
description: >-
Error type.
During type-checking if an expression is an error, its type is
propagated
as the `ERROR` type. This permits the type-checker to discover other
errors present in the expression.
abstractType:
$ref: '#/components/schemas/AbstractType'
description: Represents a CEL type.
SourceInfo:
type: object
properties:
syntaxVersion:
type: string
description: The syntax version of the source, e.g. `cel1`.
location:
type: string
description: >-
The location name. All position information attached to an
expression is
relative to this location.
The location could be a file, UI element, or similar. For example,
`acme/app/AnvilPolicy.cel`.
lineOffsets:
type: array
items:
type: integer
format: int32
description: >-
Monotonically increasing list of code point offsets where newlines
`\n` appear.
The line number of a given position is the index `i` where for a
given
`id` the `line_offsets[i] < id_positions[id] < line_offsets[i+1]`.
The
column may be derivd from `id_positions[id] - line_offsets[i]`.
positions:
type: object
additionalProperties:
type: integer
format: int32
description: >-
A map from the parse node id (e.g. `Expr.id`) to the code point
offset
within the source.
macroCalls:
type: object
additionalProperties:
$ref: '#/components/schemas/Expr'
description: >-
A map from the parse node id where a macro replacement was made to
the
call `Expr` that resulted in a macro expansion.
For example, `has(value.field)` is a function call that is replaced
by a
`test_only` field selection in the AST. Likewise, the call
`list.exists(e, e > 10)` translates to a comprehension expression.
The key
in the map corresponds to the expression id of the expanded macro,
and the
value is the call `Expr` that was replaced.
extensions:
type: array
items:
$ref: '#/components/schemas/Extension'
description: >-
A list of tags for extensions that were used while parsing or type
checking
the source expression. For example, optimizations that require
special
runtime support may be specified.
These are used to check feature support between components in
separate
implementations. This can be used to either skip redundant work or
report an error if the extension is unsupported.
description: Source information collected at parse time.
Expr:
type: object
properties:
id:
type: string
format: int64
description: >-
Required. An id assigned to this node by the parser which is unique
in a
given expression tree. This is used to associate type information
and other
attributes to a node in the parse tree.
constExpr:
$ref: '#/components/schemas/Constant'
identExpr:
$ref: '#/components/schemas/Ident'
selectExpr:
$ref: '#/components/schemas/Select'
callExpr:
$ref: '#/components/schemas/Expr.Call'
listExpr:
$ref: '#/components/schemas/CreateList'
structExpr:
$ref: '#/components/schemas/CreateStruct'
comprehensionExpr:
$ref: '#/components/schemas/Comprehension'
description: >-
An abstract representation of a common expression.
Expressions are abstractly represented as a collection of identifiers,
select statements, function calls, literals, and comprehensions. All
operators with the exception of the '.' operator are modelled as
function
calls. This makes it easy to represent new operators into the existing
AST.
All references within expressions must resolve to a
[Decl][google.api.expr.v1alpha1.Decl] provided at type-check for an
expression to be valid. A reference may either be a bare identifier
`name` or
a qualified identifier `google.api.name`. References may either refer to
a
value or a function declaration.
For example, the expression `google.api.name.startsWith('expr')`
references
the declaration `google.api.name` within a
[Expr.Select][google.api.expr.v1alpha1.Expr.Select] expression, and the
function declaration `startsWith`.
Leaf:
type: object
properties:
computedUserSet:
$ref: '#/components/schemas/ComputedUserSet'
tupleToUserSet:
$ref: '#/components/schemas/TupleToUserSet'
computedAttribute:
$ref: '#/components/schemas/ComputedAttribute'
call:
$ref: '#/components/schemas/v1.Call'
description: Leaf represents a leaf node in the permission tree.
Rewrite:
type: object
properties:
rewriteOperation:
$ref: '#/components/schemas/Rewrite.Operation'
children:
type: array
items:
$ref: '#/components/schemas/Child'
description: A list of children that are operated upon by the rewrite operation.
description: >-
The Rewrite message represents a specific rewrite operation.
This operation could be one of the following: union, intersection, or
exclusion.
Constant:
type: object
properties:
nullValue:
type: string
description: null value.
boolValue:
type: boolean
description: boolean value.
int64Value:
type: string
format: int64
description: int64 value.
uint64Value:
type: string
format: uint64
description: uint64 value.
doubleValue:
type: number
format: double
description: double value.
stringValue:
type: string
description: string value.
bytesValue:
type: string
format: byte
description: bytes value.
durationValue:
type: string
description: |-
protobuf.Duration value.
Deprecated: duration is no longer considered a builtin cel type.
timestampValue:
type: string
format: date-time
description: |-
protobuf.Timestamp value.
Deprecated: timestamp is no longer considered a builtin cel type.
description: >-
Represents a primitive literal.
Named 'Constant' here for backwards compatibility.
This is similar as the primitives supported in the well-known type
`google.protobuf.Value`, but richer so it can represent CEL's full range
of
primitives.
Lists and structs are not included as constants as these aggregate types
may
contain [Expr][google.api.expr.v1alpha1.Expr] elements which require
evaluation and are thus not constant.
Examples of literals include: `"hello"`, `b'bytes'`, `1u`, `4.2`, `-2`,
`true`, `null`.
PrimitiveType:
type: string
enum:
- PRIMITIVE_TYPE_UNSPECIFIED
- BOOL
- INT64
- UINT64
- DOUBLE
- STRING
- BYTES
default: PRIMITIVE_TYPE_UNSPECIFIED
description: |-
CEL primitive types.
- PRIMITIVE_TYPE_UNSPECIFIED: Unspecified type.
- BOOL: Boolean type.
- INT64: Int64 type.
Proto-based integer values are widened to int64.
- UINT64: Uint64 type.
Proto-based unsigned integer values are widened to uint64.
- DOUBLE: Double type.
Proto-based float values are widened to double values.
- STRING: String type.
- BYTES: Bytes type.
WellKnownType:
type: string
enum:
- WELL_KNOWN_TYPE_UNSPECIFIED
- ANY
- TIMESTAMP
- DURATION
default: WELL_KNOWN_TYPE_UNSPECIFIED
description: |-
Well-known protobuf types treated with first-class support in CEL.
- WELL_KNOWN_TYPE_UNSPECIFIED: Unspecified type.
- ANY: Well-known protobuf.Any type.
Any types are a polymorphic message type. During type-checking they are
treated like `DYN` types, but at runtime they are resolved to a specific
message type specified at evaluation time.
- TIMESTAMP: Well-known protobuf.Timestamp type, internally referenced as `timestamp`.
- DURATION: Well-known protobuf.Duration type, internally referenced as `duration`.
ListType:
type: object
properties:
elemType:
$ref: '#/components/schemas/v1alpha1.Type'
description: List type with typed elements, e.g. `list`.
MapType:
type: object
properties:
keyType:
$ref: '#/components/schemas/v1alpha1.Type'
valueType:
$ref: '#/components/schemas/v1alpha1.Type'
description: >-
Map type with parameterized key and value types, e.g. `map`.
FunctionType:
type: object
properties:
resultType:
$ref: '#/components/schemas/v1alpha1.Type'
argTypes:
type: array
items:
$ref: '#/components/schemas/v1alpha1.Type'
description: Argument types of the function.
description: Function type with result and arg types.
AbstractType:
type: object
properties:
name:
type: string
description: The fully qualified name of this abstract type.
parameterTypes:
type: array
items:
$ref: '#/components/schemas/v1alpha1.Type'
description: Parameter types for this abstract type.
description: Application defined abstract type.
Extension:
type: object
properties:
id:
type: string
title: 'Identifier for the extension. Example: constant_folding'
affectedComponents:
type: array
items:
$ref: '#/components/schemas/Component'
description: >-
If set, the listed components must understand the extension for the
expression to evaluate correctly.
This field has set semantics, repeated values should be
deduplicated.
version:
$ref: '#/components/schemas/Version'
description: An extension that was requested for the source expression.
Ident:
type: object
properties:
name:
type: string
description: >-
Required. Holds a single, unqualified identifier, possibly preceded
by a
'.'.
Qualified names are represented by the
[Expr.Select][google.api.expr.v1alpha1.Expr.Select] expression.
description: An identifier expression. e.g. `request`.
Select:
type: object
properties:
operand:
$ref: '#/components/schemas/Expr'
field:
type: string
description: >-
Required. The name of the field to select.
For example, in the select expression `request.auth`, the `auth`
portion
of the expression would be the `field`.
testOnly:
type: boolean
description: |-
Whether the select is to be interpreted as a field presence test.
This results from the macro `has(request.auth)`.
description: A field selection expression. e.g. `request.auth`.
Expr.Call:
type: object
properties:
target:
$ref: '#/components/schemas/Expr'
function:
type: string
description: Required. The name of the function or method being called.
args:
type: array
items:
$ref: '#/components/schemas/Expr'
description: The arguments.
description: >-
A call expression, including calls to predefined functions and
operators.
For example, `value == 10`, `size(map_value)`.
CreateList:
type: object
properties:
elements:
type: array
items:
$ref: '#/components/schemas/Expr'
description: The elements part of the list.
optionalIndices:
type: array
items:
type: integer
format: int32
description: >-
The indices within the elements list which are marked as optional
elements.
When an optional-typed value is present, the value it contains
is included in the list. If the optional-typed value is absent, the
list
element is omitted from the CreateList result.
description: |-
A list creation expression.
Lists may either be homogenous, e.g. `[1, 2, 3]`, or heterogeneous, e.g.
`dyn([1, 'hello', 2.0])`
CreateStruct:
type: object
properties:
messageName:
type: string
description: |-
The type name of the message to be created, empty when creating map
literals.
entries:
type: array
items:
$ref: '#/components/schemas/Entry'
description: The entries in the creation expression.
description: |-
A map or message creation expression.
Maps are constructed as `{'key_name': 'value'}`. Message construction is
similar, but prefixed with a type name and composed of field ids:
`types.MyType{field_id: 'value'}`.
Comprehension:
type: object
properties:
iterVar:
type: string
description: |-
The name of the first iteration variable.
When the iter_range is a list, this variable is the list element.
When the iter_range is a map, this variable is the map entry key.
iterVar2:
type: string
description: |-
The name of the second iteration variable, empty if not set.
When the iter_range is a list, this variable is the integer index.
When the iter_range is a map, this variable is the map entry value.
This field is only set for comprehension v2 macros.
iterRange:
$ref: '#/components/schemas/Expr'
accuVar:
type: string
description: The name of the variable used for accumulation of the result.
accuInit:
$ref: '#/components/schemas/Expr'
loopCondition:
$ref: '#/components/schemas/Expr'
loopStep:
$ref: '#/components/schemas/Expr'
result:
$ref: '#/components/schemas/Expr'
description: >-
A comprehension expression applied to a list or map.
Comprehensions are not part of the core syntax, but enabled with macros.
A macro matches a specific call signature within a parsed AST and
replaces
the call with an alternate AST block. Macro expansion happens at parse
time.
The following macros are supported within CEL:
Aggregate type macros may be applied to all elements in a list or all
keys
in a map:
* `all`, `exists`, `exists_one` - test a predicate expression against
the inputs and return `true` if the predicate is satisfied for all,
any, or only one value `list.all(x, x < 10)`.
* `filter` - test a predicate expression against the inputs and return
the subset of elements which satisfy the predicate:
`payments.filter(p, p > 1000)`.
* `map` - apply an expression to all elements in the input and return
the
output aggregate type: `[1, 2, 3].map(i, i * i)`.
The `has(m.x)` macro tests whether the property `x` is present in struct
`m`. The semantics of this macro depend on the type of `m`. For proto2
messages `has(m.x)` is defined as 'defined, but not set`. For proto3,
the
macro tests whether the property is set to its default. For map and
struct
types, the macro tests whether the property `x` is defined on `m`.
Comprehensions for the standard environment macros evaluation can be
best
visualized as the following pseudocode:
```
let `accu_var` = `accu_init`
for (let `iter_var` in `iter_range`) {
if (!`loop_condition`) {
break
}
`accu_var` = `loop_step`
}
return `result`
```
Comprehensions for the optional V2 macros which support map-to-map
translation differ slightly from the standard environment macros in that
they expose both the key or index in addition to the value for each list
or map entry:
```
let `accu_var` = `accu_init`
for (let `iter_var`, `iter_var2` in `iter_range`) {
if (!`loop_condition`) {
break
}
`accu_var` = `loop_step`
}
return `result`
```
ComputedUserSet:
type: object
properties:
relation:
type: string
title: Relation name
description: >-
ComputedUserSet defines a set of computed users which includes the
relation name.
TupleToUserSet:
type: object
properties:
tupleSet:
$ref: '#/components/schemas/TupleSet'
computed:
$ref: '#/components/schemas/ComputedUserSet'
description: TupleToUserSet defines a mapping from tuple sets to computed user sets.
ComputedAttribute:
type: object
properties:
name:
type: string
title: Name of the computed attribute
description: ComputedAttribute defines a computed attribute which includes its name.
v1.Call:
type: object
properties:
ruleName:
type: string
title: Name of the rule
arguments:
type: array
items:
$ref: '#/components/schemas/Argument'
title: Arguments passed to the rule
description: >-
Call represents a call to a rule. It includes the name of the rule and
the arguments passed to it.
Rewrite.Operation:
type: string
enum:
- OPERATION_UNSPECIFIED
- OPERATION_UNION
- OPERATION_INTERSECTION
- OPERATION_EXCLUSION
default: OPERATION_UNSPECIFIED
description: |-
Operation enum includes potential rewrite operations.
OPERATION_UNION: Represents a union operation.
OPERATION_INTERSECTION: Represents an intersection operation.
OPERATION_EXCLUSION: Represents an exclusion operation.
- OPERATION_UNSPECIFIED: Default, unspecified operation.
- OPERATION_UNION: Represents a union operation.
- OPERATION_INTERSECTION: Represents an intersection operation.
- OPERATION_EXCLUSION: Represents an exclusion operation.
Component:
type: string
enum:
- COMPONENT_UNSPECIFIED
- COMPONENT_PARSER
- COMPONENT_TYPE_CHECKER
- COMPONENT_RUNTIME
default: COMPONENT_UNSPECIFIED
description: |-
CEL component specifier.
- COMPONENT_UNSPECIFIED: Unspecified, default.
- COMPONENT_PARSER: Parser. Converts a CEL string to an AST.
- COMPONENT_TYPE_CHECKER: Type checker. Checks that references in an AST are defined and types
agree.
- COMPONENT_RUNTIME: Runtime. Evaluates a parsed and optionally checked CEL AST against a
context.
Version:
type: object
properties:
major:
type: string
format: int64
description: |-
Major version changes indicate different required support level from
the required components.
minor:
type: string
format: int64
description: |-
Minor version changes must not change the observed behavior from
existing implementations, but may be provided informationally.
title: Version
Entry:
type: object
properties:
id:
type: string
format: int64
description: |-
Required. An id assigned to this node by the parser which is unique
in a given expression tree. This is used to associate type
information and other attributes to the node.
fieldKey:
type: string
description: The field key for a message creator statement.
mapKey:
$ref: '#/components/schemas/Expr'
value:
$ref: '#/components/schemas/Expr'
optionalEntry:
type: boolean
description: Whether the key-value pair is optional.
description: Represents an entry.
TupleSet:
type: object
properties:
relation:
type: string
description: TupleSet represents a set of tuples associated with a specific relation.
Argument:
type: object
properties:
computedAttribute:
$ref: '#/components/schemas/ComputedAttribute'
description: >-
Argument defines the type of argument in a Call. It can be either a
ComputedAttribute or a ContextAttribute.
````