Skip to main content
POST
Enforce a user permission

Authorizations

Authorization
string
header
required

JWT bearer token issued by the identity provider.

Headers

Authorization
string

Bearer access token to enforce. The request is rejected with 401 (AUT-0006) when absent.

Body

application/json
action
string
required

The operation being performed on the resource.

Example:

"post"

resource
string
required

The resource being accessed (e.g. "organizations", "ledgers").

Example:

"ledger"

attributes
object

Instance identifiers the calling product extracted from the request being authorized, keyed by the product's declared scope field (midaz: "organizationId", "ledgerId"). Optional and additive: a request without it is decided exactly as before. Consumed only for a credential bound to a partner; accepted and ignored for every other credential.

Example:
clientIp
string

Originating caller IP forwarded by lib-auth for tenant IP-allowlist enforcement. Optional, and honoured ONLY when the calling service reaches this API from a network the platform declares as its own; from any other caller the field is ignored.

Example:

"203.0.113.7"

product
string

Product that owns the route, forwarded by lib-auth for user-flow isolation. Optional.

Example:

"midaz"

sub
string

Subject to enforce, forwarded by lib-auth (e.g. "admin/ledger-editor-role" for applications). Optional.

Example:

"admin/ledger-editor-role"

Response

OK

authorized
boolean
required

Whether the subject is authorized for the resource+action. A false value is still returned as HTTP 200, not 403.

Example:

true

timestamp
string<date-time>
required

Server time at which the decision was made (RFC 3339).

Example:

"2024-01-15T09:30:00Z"

reason
enum<string>

Why the request was denied. Present only when authorized is false and the credential is bound to a partner. "suspended" and "expired" mean the partner credential itself is no longer valid and the caller should answer 401; "permission" and "scope" stay the 403 a denial is today and are for logs only — never surface which axis failed to the end caller.

Available options:
permission,
scope,
suspended,
expired
Example:

"scope"