GoodMemCheck effective authorization
POST /v1/access-policy:check: Evaluates 1 to 50 concrete operation-and-target checks under the authenticated caller's live authority and any API-key ceiling.
Evaluates 1 to 50 concrete operation-and-target checks under the authenticated caller's live authority and any API-key ceiling. Results are positional and advisory: missing targets and denied operations both return allowed=false, and every later resource request performs fresh authorization. Top-level creates target INSTANCE; CREATE_MEMORY and LIST_MEMORY target their parent SPACE; reads, mutations, proxy operations, and access-policy administration target concrete resources. LIST_API_KEY and LIST_RETRIEVE_MEMORY_LOG_POLICY are rejected because their current candidate-based list rules have no instance-wide preflight.
In: header
Header Parameters
Optional waiting budget in milliseconds, measured from REST servlet ingress and shared across all internal gRPC calls. Supply one decimal integer from 1 to 86400000. Omission adds no deadline. Existing shorter deadlines still apply. Expiry returns HTTP 504 before streaming starts; after streaming starts, no successful completion event is sent. Use SSE or opt into GoodMem-Stream-Terminal for an explicit terminal outcome. Retrieval work is cooperatively cancelled. An accepted mutation may still commit after timeout or disconnect; a failed response does not imply rollback.
int641 <= value <= 86400000Concrete checks evaluated in request order.
1 <= items <= 50Response Body
curl -X POST "https://your-goodmem-server.example.com/v1/access-policy:check" \ -H "GoodMem-Timeout-Ms: 30000" \ -H "Content-Type: application/json" \ -d '{ "checks": [ { "target": { "resourceId": "550e8400-e29b-41d4-a716-446655440000" } } ] }'{
"results": [
{
"allowed": true
}
]
}Assign a scoped role
POST /v1/access-policy/role-assignments: Assigns one code-defined role to an active principal at INSTANCE or SPACE scope after requiring MANAGE_ACCESS. ROOT is maintained only by ownership workflows.
Create an authorization grant
POST /v1/access-policy/grants: Creates one direct grant after resolving its typed policy target and requiring MANAGE_ACCESS.