ProjectX Policy

Everything one principal can reach

The forward query an entitlement review and an offboarding sweep both start from.

Body

WhatCanRequest

Who can do this to this resource

Computed on every call rather than stored, because a cached answer to a security question is a wrong answer. `truncated` says when the list is a sample.

Body

WhoCanRequest

Ask for a time-boxed elevation

Needs an approver who is not the requester, and lapses on its own.

Body

AccessRequest

Take emergency access

Granted immediately and reviewed afterwards whether or not it was used. The review is the control: break-glass nobody looks at is standing access with a dramatic name.

Body

BreakGlassRequest

Record the after-the-fact review of an emergency grant

What was done under it is in the audit chain; this records that somebody read it.

Body

BreakGlassReview

Emergency grants still awaiting review

The queue that makes break-glass a control rather than a name. A grant appears here whether or not it was ever used.

List grants

Expired grants are withheld unless asked for, because a review of who has access should not be buried in a list of who used to.

Create a standing grant

The kind is set by the route rather than by the body, so a caller cannot ask for break-glass at a standing grant’s ceiling.

Body

GrantRequest

Revoke a grant before it expires

The grant record is kept, revoked, so an access review can still see it was held.

Approve a pending grant

`ttl_seconds` lets an approver grant less time than was asked for. An approver who can only say yes or no will say yes.

Body

GrantApproval

Refuse a pending grant

Body

GrantRejection

List organizations in the tenant

Create an organization inside the tenant

Body

CreateOrganizationRequest

Ask whether a principal may take an action on a resource

The one decision endpoint every other service in the platform calls. Unaudited on purpose: the caller writes the audit event for the action the decision was about, and a second event here would double the platform’s audit volume to record the same fact.

Body

AuthorizeRequest

Returns

AuthorizeResponse

Ask many authorization questions in one call

Answered in order, one decision per request. What a console uses to decide which of forty buttons to render enabled.

Body

AuthorizeBatchRequest

Ask whether a principal may take an action on a resource

The documented alias of `/v1/authorize`. Same handler, so the two paths cannot drift.

Body

AuthorizeRequest

Returns

AuthorizeResponse

Evaluate a decision without taking the action

Returns every policy considered and whether it matched, which is what makes a policy editor able to explain a denial rather than merely report one.

Body

SimulateRequest

The permission catalog, grouped by pillar

Frozen in code rather than configured per tenant, so a permission means the same thing everywhere. A role naming a permission that is not here is refused, which is what stops a role appearing to grant something nothing checks.

List policies

Report what a promotion would change

Names every change and whether any of them broadens access. Nothing is written.

Body

PolicyDryRunRequest

Promote policies between draft, staging and published

`force` overrides an unsafe dry-run verdict and is annotated on the audit event, because that is the decision somebody will be asked about.

Body

PolicyPromotionRequest

Delete a policy from one environment

Fetch one policy

Carries the compiled Cedar as well as the structured definition, so a decision can be replayed exactly as it was made.

Create or replace a policy

Saving produces a new version and a digest over the compiled Cedar, which is the unit of “did this change”. Written to the draft environment; promoting it is a separate, dry-runnable step.

Body

PolicyDocumentInput

Replace the policy test suite

Run against an environment before a promotion, which is what turns “we think this change is safe” into an answer.

Body

PolicyTestSuite

Run the policy test suite

Answers 409 when any case fails, so a pipeline step can branch on the status rather than parse the body.

Evaluate a decision without taking the action

The documented alias of `/v1/authorize:simulate`.

Body

SimulateRequest

List projects in the tenant

Create a project

What usage is attributed to. A project that charges nowhere makes the showback wrong for every other project in the tenant, which is why the cost centre is not optional in practice.

Body

CreateProjectRequest

Fetch one project

List quotas with their current consumption

Set a quota on one dimension at one scope

A soft limit warns and the hard limit refuses. Both are needed: a quota that only refuses gives an operator no notice, and one that only warns is not a quota.

Body

SetQuotaRequest

Ask whether an amount would fit under the quota

Consumes nothing. Called before a provision, so the refusal arrives before the side effects.

Body

CheckQuotaRequest

List roles, built-in and custom

Create a role

Every permission must exist in the catalog. A role naming a permission nothing checks is a role that appears to grant something and does not.

Body

CreateRoleRequest

Delete a role

Refused while anybody still holds it, because the alternative is silently removing their access.

Fetch one role with its effective permissions

`effective_permissions` is the closure over inheritance, which is the only number that answers what holding this role actually lets somebody do.

Change a role

Absent fields are left alone. Supplying `permissions` replaces the list entire.

Body

UpdateRoleRequest

List cross-tenant shares, in both directions

What this tenant has let out and what has been let in to it, because a review needs both.

Share one resource with another tenant for a bounded time

The only sanctioned way across a tenant boundary, and it expires on its own: a cross-tenant grant with no expiry is a merged tenancy nobody agreed to.

Body

CreateShareRequest

Revoke a share before it expires

The share record is kept, revoked, rather than removed: who let whom in and who closed it is the evidence.

List tenants

Everybody may ask; what differs is what the question is about. Staff are answered with the register, a customer with themselves — authorizing both against the caller’s own tenant and then returning every row would hand the customer list to anyone holding a permission their own tenant-admin role includes by default.

Register a tenant

`isolation` is the commercial decision made technical: a dedicated tenant gets its own schema. The key appears in every URN of theirs and cannot be changed afterwards.

Body

CreateTenantRequest

Create a company that signed up, with its first administrator

Self-service sign-up (A5). Creates the tenant and its default workspace, issues the service grants every customer tenant needs, and gives the first user the built-in `tenant-admin` role in that tenant. Idempotent: a retried sign-up finds the tenant and issues only what is missing. Callable from the platform tenant only — a customer administrator holding wildcard permissions in their own tenant still cannot create another company.

Body

ProvisionTenantRequest

Fetch one tenant

Reading your own record is a same-tenant read; reading somebody else’s is a read of the register, which lives in the platform tenant. So the operator console reaches it with the grant it already holds and a customer is refused by tenant isolation rather than by a check written into the handler.

Export a tenant’s configuration

The portability half of the exit story: what a customer takes with them, in a format they can read without us.

Suspend, terminate or restore a tenant

Suspension stops new spend and keeps the data. Termination starts the clock on deletion, which is a separate, evidenced operation rather than a state change.

Body

TenantLifecycleRequest

Set which substrates a tenant’s resources may live on

The residency floor. Enforced at every provision and every query plan, not only at creation — a rule applied once is a rule a migration can break.

Body

ResidencyRequest

Remove a membership

Identified by all three of principal, scope and role, in the query string rather than a body: the same person may hold two roles at one scope, and dropping the wrong one is silent.

List memberships

Grant a principal a role at a scope

Body

CreateMembershipRequest

List workspaces in the tenant

Create a workspace

The unit of collaboration and of cost. `cloud_mode` decides whether resources here are ordered from ProjectX or provisioned onto the customer’s own substrate, and on a customer-owned substrate no infrastructure margin is metered.

Body

CreateWorkspaceRequest

Fetch one workspace

Archive a workspace

Stops new work in it and keeps everything. Not a delete: the resources and their history remain.

Copy a workspace’s configuration under a new name

Memberships and resources are not copied: a clone that carried the original’s access list would be a way to hand somebody a second copy of data they were granted once.

Body

CloneWorkspaceRequest

Narrow a workspace’s substrate allowance

May narrow the tenant’s allowance and never widen it.

Body

ResidencyRequest