Access Policy

Direct grants + scoped role assignments for resource access policy.

Namespace: Goodmem.Client.Api · Class: AccessPolicyApi

Reach this surface as client.AccessPolicy on a GoodmemClient. Every network method is asynchronous — it returns a Task<T> (or an IAsyncEnumerable<T> for pagination and streaming) and accepts a CancellationToken; the Async suffix marks the standard .NET Task-based async pattern.

Methods

CheckAsync

Evaluates 1 to 50 concrete operation-and-target checks under the authenticated caller's live authority and any API-key ceiling. Results are positional and advisory: missing targets and denied operations both return allowed=false, and every later resource request performs fresh authorization. Top-level creates target INSTANCE; CREATE_MEMORY and LIST_MEMORY target their parent SPACE; reads, mutations, proxy operations, and access-policy administration target concrete resources. LIST_API_KEY and LIST_RETRIEVE_MEMORY_LOG_POLICY are rejected because their current candidate-based list rules have no instance-wide preflight.

Declaration

public Task<CheckAuthorizationsResponse> CheckAsync(CheckAuthorizationsRequest request, CancellationToken ct = default)

HTTP — POST /v1/access-policy:check

Parameters

Returns

Task<CheckAuthorizationsResponse> — an awaitable that resolves to CheckAuthorizationsResponse.

Exceptions

Example

var decisions = await client.AccessPolicy.CheckAsync(
    new CheckAuthorizationsRequest
    {
        Checks = new[]
        {
            new AuthorizationCheck
            {
                Operation = Operation.ReadInstance,
                Target = new AccessPolicyTarget { Kind = ResourceKind.Instance },
            },
        },
    }
);
Console.WriteLine(decisions.Results[0].Allowed);

GrantsCreateAsync

Creates one direct grant after resolving its typed policy target and requiring MANAGE_ACCESS. Direct grants cannot confer credential-read or ownership-transfer authority. ALL_AUTHENTICATED grants require an assigned-resource selector. MANAGE_ACCESS and MANAGE_USER_ENROLLMENT require a concrete principal and ANY or EXACT; MANAGE_USER_ENROLLMENT with EXACT must target USER.

Declaration

public Task<AuthorizationGrant> GrantsCreateAsync(CreateAuthorizationGrantRequest request, CancellationToken ct = default)

HTTP — POST /v1/access-policy/grants

Parameters

Returns

Task<AuthorizationGrant> — an awaitable that resolves to AuthorizationGrant.

Exceptions

Example

var grant = await client.AccessPolicy.GrantsCreateAsync(
    new CreateAuthorizationGrantRequest
    {
        Audience = GrantAudience.OfPrincipalId("your-principal-id"),
        Rule = new AccessPolicyRule
        {
            Operation = Operation.ReadSpace,
            Selector = Selector.Exact,
            AssignedResource = new AccessPolicyTarget
            {
                Kind = ResourceKind.Space,
                ResourceId = spaceId,
            },
        },
    }
);

GrantsDeleteAsync

Soft-revokes one grant and returns its durable historical row. Repeating the request is idempotent while the caller retains MANAGE_ACCESS on the target.

Declaration

public Task<AuthorizationGrant> GrantsDeleteAsync(string id, CancellationToken ct = default)

HTTP — DELETE /v1/access-policy/grants/{id}

Parameters

Returns

Task<AuthorizationGrant> — an awaitable that resolves to AuthorizationGrant.

Exceptions

Example

var revokedGrant = await client.AccessPolicy.GrantsDeleteAsync("your-grant-id");

GrantsGetAsync

Reads one live grant, or one revoked historical grant when includeRevoked is true, after requiring MANAGE_ACCESS on its policy target.

Declaration

public Task<AuthorizationGrant> GrantsGetAsync(string id, AccessPolicyGrantsGetOptions? options = null, CancellationToken ct = default)

HTTP — GET /v1/access-policy/grants/{id}

Parameters

Returns

Task<AuthorizationGrant> — an awaitable that resolves to AuthorizationGrant.

Exceptions

Example

var fetchedGrant = await client.AccessPolicy.GrantsGetAsync("your-grant-id");

GrantsListAsync

Lists grants attached to one resource. MANAGE_ACCESS is required on that resource; continuation tokens are bound to the caller and filters.

Declaration

public IAsyncEnumerable<AuthorizationGrant> GrantsListAsync(AccessPolicyGrantsListOptions? options = null, CancellationToken ct = default)

HTTP — GET /v1/access-policy/grants

Parameters

Returns

IAsyncEnumerable<AuthorizationGrant> — an async stream; await foreach yields each AuthorizationGrant across pages / events.

Exceptions

Example

await foreach (
    var visibleGrant in client.AccessPolicy.GrantsListAsync(
        new AccessPolicyGrantsListOptions
        {
            ResourceKind = "SPACE",
            ResourceId = spaceId,
        }
    )
)
    Console.WriteLine(visibleGrant.GrantId);

RoleAssignmentsCreateAsync

Assigns one code-defined role to an active principal at INSTANCE or SPACE scope after requiring MANAGE_ACCESS. ROOT is maintained only by ownership workflows.

Declaration

public Task<RoleAssignment> RoleAssignmentsCreateAsync(AssignRoleRequest request, CancellationToken ct = default)

HTTP — POST /v1/access-policy/role-assignments

Parameters

Returns

Task<RoleAssignment> — an awaitable that resolves to RoleAssignment.

Exceptions

Example

var assignment = await client.AccessPolicy.RoleAssignmentsCreateAsync(
    new AssignRoleRequest
    {
        PrincipalId = "your-principal-id",
        Role = "SPACE_VIEWER",
        AssignedResource = new RoleAssignmentTarget
        {
            Kind = "SPACE",
            ResourceId = spaceId,
        },
    }
);

RoleAssignmentsDeleteAsync

Soft-revokes one non-ROOT assignment and returns its durable historical row. Repeating the request is idempotent while the caller retains MANAGE_ACCESS.

Declaration

public Task<RoleAssignment> RoleAssignmentsDeleteAsync(string id, CancellationToken ct = default)

HTTP — DELETE /v1/access-policy/role-assignments/{id}

Parameters

Returns

Task<RoleAssignment> — an awaitable that resolves to RoleAssignment.

Exceptions

Example

var revokedAssignment =
    await client.AccessPolicy.RoleAssignmentsDeleteAsync("your-role-assignment-id");

RoleAssignmentsGetAsync

Reads one live assignment, or one revoked historical assignment when includeRevoked is true, after requiring MANAGE_ACCESS on its policy target.

Declaration

public Task<RoleAssignment> RoleAssignmentsGetAsync(string id, AccessPolicyRoleAssignmentsGetOptions? options = null, CancellationToken ct = default)

HTTP — GET /v1/access-policy/role-assignments/{id}

Parameters

Returns

Task<RoleAssignment> — an awaitable that resolves to RoleAssignment.

Exceptions

Example

var fetchedAssignment =
    await client.AccessPolicy.RoleAssignmentsGetAsync("your-role-assignment-id");

RoleAssignmentsListAsync

Lists assignments attached to one required INSTANCE or SPACE boundary after requiring MANAGE_ACCESS. Continuation tokens are bound to the caller and filters.

Declaration

public IAsyncEnumerable<RoleAssignment> RoleAssignmentsListAsync(AccessPolicyRoleAssignmentsListOptions? options = null, CancellationToken ct = default)

HTTP — GET /v1/access-policy/role-assignments

Parameters

Returns

IAsyncEnumerable<RoleAssignment> — an async stream; await foreach yields each RoleAssignment across pages / events.

Exceptions

Example

await foreach (
    var visibleAssignment in client.AccessPolicy.RoleAssignmentsListAsync(
        new AccessPolicyRoleAssignmentsListOptions
        {
            ResourceKind = "SPACE",
            ResourceId = spaceId,
        }
    )
)
    Console.WriteLine(visibleAssignment.RoleAssignmentId);

Data Models

Types in the Goodmem.Client.Models namespace. Each row lists the C# property, its type, the JSON wire name, and a description.

CheckAuthorizationsRequest

Evaluates between 1 and 50 concrete authorization checks.

AuthorizationCheck

One concrete, advisory authorization check. Top-level creates target INSTANCE; CREATE_MEMORY and LIST_MEMORY target a parent SPACE; ordinary resource operations target the concrete resource. LIST_API_KEY and LIST_RETRIEVE_MEMORY_LOG_POLICY are not supported by this endpoint.

CheckAuthorizationsResponse

Positional advisory authorization results.

AuthorizationCheckResult

One advisory decision; false covers both an absent target and an authorization denial.

CreateAuthorizationGrantRequest

Creates one live direct authorization grant.

GrantAudience

Exactly one principal or the all-authenticated audience.

GrantAudienceAllAuthenticated

The literal true, selecting every successfully authenticated principal.

String enum: "True"

AuthorizationGrant

Current or historical direct authorization grant.

ListAuthorizationGrantsResponse

One page of direct authorization grants.

AssignRoleRequest

Assigns one code-defined role at an INSTANCE or SPACE boundary.

RoleAssignmentTarget

An INSTANCE or SPACE role-assignment boundary. resourceId is omitted for INSTANCE and required for SPACE.

RoleAssignment

Current or historical scoped role assignment.

Role

String enum: "ROOT" · "ADMIN" · "USER" · "SPACE_VIEWER" · "SPACE_CONTRIBUTOR" · "SPACE_CONTENT_MANAGER" · "SPACE_ADMIN"

ListRoleAssignmentsResponse

One page of scoped role assignments.