Skip to content
OpenRelay is in early access, and the /v1 API is stable. New capabilities ship in the changelog.
PricingDashboard
GuidesAPI ReferenceCLI
API ReferenceAccount and accessAccess

Check whether a principal may perform an action

Evaluates one action for a member, service account or key of the organization and returns the decision, the layer that decided it and the deciding policies.

Required permission

Requires the policy.read permission. See Permissions for the roles and API key permissions that include it.

Command line

The orl CLI wraps this endpoint:

orl authz check-access --action <action> --principal-id <principal-id> --principal-type <principal-type>
POST
/v1/authz/check

Authorization

apiKey
headerAuthorizationBearer <token>

OpenRelay API key. Send it as Authorization: Bearer or_… (legacy vl_… keys still work).

Request Body

application/json
  1. body
principalType*string
Value in"member""service_account""api_key"
principalId*string

A user id, service account id or API key id of this organization.

action*string

An action from the catalog, e.g. compute.create.

model?string

The model to check for inference.invoke.

endpointId?string

The dedicated endpoint the model is served on.

sourceIp?string

Evaluate as if the request came from this address. Defaults to yours.

Response Body

The decision

application/json
  1. response
allow*boolean
permission*string
deniedBy?string
Value in"role""key""org_policy""platform"
message*string
policies*array<>
Example Request
curl -X POST 'https://api.openrelay.inc/v1/authz/check' \  -H 'Content-Type: application/json' \  -d '{  "principalType": "member",  "principalId": "string",  "action": "string"}'
Example Response
{  "allow": true,  "permission": "string",  "deniedBy": "role",  "message": "string",  "policies": [    {      "id": "string",      "source": "platform"    }  ]}

Show what a principal can do right now GET

Returns the permission ids and actions a member, service account or API key holds right now, and the models it may call, after its restrictions apply. Without parameters, answers for the caller. Naming a member, service account or key of the organization needs policy.read. The answer is the principal's role intersected with its key restrictions, role conditions and the organization's guardrails. Network rules are checked against the address of the request you send, not one the named principal would call from.

List the org's guardrails and custom policies GET

Returns every guardrail and custom Cedar policy in the organization, enabled or disabled, with its networks, models, endpoints and Cedar text.