Enforce a user permission
Enforces a permission for the Bearer token subject against a resource and action. A denied permission is returned as 200 with authorized=false, not 403. A 403 means the caller IP is outside the IP allowlist (AUT-0021).
Authorizations
JWT bearer token issued by the identity provider.
Headers
Bearer access token to enforce. The request is rejected with 401 (AUT-0006) when absent.
Body
The operation being performed on the resource.
"post"
The resource being accessed (e.g. "organizations", "ledgers").
"ledger"
Instance identifiers the calling product extracted from the request being authorized, keyed by the product's declared scope field (midaz: "organizationId", "ledgerId"). Optional and additive: a request without it is decided exactly as before. Consumed only for a credential bound to a partner; accepted and ignored for every other credential.
Originating caller IP forwarded by lib-auth for tenant IP-allowlist enforcement. Optional, and honoured ONLY when the calling service reaches this API from a network the platform declares as its own; from any other caller the field is ignored.
"203.0.113.7"
Product that owns the route, forwarded by lib-auth for user-flow isolation. Optional.
"midaz"
Subject to enforce, forwarded by lib-auth (e.g. "admin/ledger-editor-role" for applications). Optional.
"admin/ledger-editor-role"
Response
OK
Whether the subject is authorized for the resource+action. A false value is still returned as HTTP 200, not 403.
true
Server time at which the decision was made (RFC 3339).
"2024-01-15T09:30:00Z"
Why the request was denied. Present only when authorized is false and the credential is bound to a partner. "suspended" and "expired" mean the partner credential itself is no longer valid and the caller should answer 401; "permission" and "scope" stay the 403 a denial is today and are for logs only — never surface which axis failed to the end caller.
permission, scope, suspended, expired "scope"

