REST API

{
  "subject_kind": "user",
  "subject_id": "user-42",
  "action": "read",
  "resource_type": "document",
  "resource_id": "doc-123",
  "context": {
    "ip_address": "10.0.1.5"
  }
}

{
  "allowed": true,
  "decision": "allow",
  "reason": "rbac: permission document:read granted",
  "sources": ["rbac"]
}

{
  "checks": [
    {"subject_kind": "user", "subject_id": "user-42", "action": "read", "resource_type": "document"},
    {"subject_kind": "user", "subject_id": "user-42", "action": "delete", "resource_type": "document"}
  ]
}

{
  "results": [
    {"allowed": true, "decision": "allow", "reason": "rbac: granted"},
    {"allowed": false, "decision": "deny", "reason": "default deny"}
  ]
}

POST /v1/roles
{
  "name": "Editor",
  "slug": "editor",
  "description": "Can read and write documents",
  "parent_id": "wrol_...",
  "is_system": false,
  "is_default": false,
  "metadata": {"tier": "premium"}
}

POST /v1/permissions
{
  "name": "Read Documents",
  "resource": "document",
  "action": "read",
  "description": "Allows reading documents"
}

POST /v1/assignments
{
  "role_id": "wrol_...",
  "subject_kind": "user",
  "subject_id": "user-42",
  "resource_type": "project",
  "resource_id": "project-123",
  "expires_at": "2025-12-31T23:59:59Z"
}

POST /v1/relations
{
  "object_type": "document",
  "object_id": "doc-123",
  "relation": "viewer",
  "subject_type": "user",
  "subject_id": "user-42"
}

POST /v1/policies
{
  "name": "Office Hours Only",
  "effect": "deny",
  "priority": 10,
  "is_active": true,
  "subjects": ["*"],
  "actions": ["write"],
  "resources": ["document:*"],
  "conditions": [
    {"field": "time", "operator": "time_after", "value": "18:00"}
  ]
}

{
  "error": {
    "code": 404,
    "message": "not found"
  }
}