AccessControlPolicy

Shared request and response schema. Request: Access-control policy identified by the composite resource_id and subject_id fields. It has no single id; row filters and column masks must use the structured fields rather than raw SQL. Response: Access-control policy identified by the composite resource_id and subject_id fields. It has no single id; row filters and column masks use the structured response fields.

resource_idResource Id (string)required

Resource ID this policy applies to

subject_idSubject Id (string)required

Subject identifier: 'user.{uuid}' or 'group.{uuid}'

row_filters object

Structured row-filter tree, or null when no row restriction applies.

anyOf

• RowFilter
• null

kindKind (string)

Possible values: [and, or]

Default value: and

conditions object[]

Nested conditions (leaf RowFilterCondition or group RowFilter)

Array [

anyOf

• RowFilterCondition
• Option 2

kindKind (string)

Constant value: condition

Default value: condition

columnColumn (string)required

Column name to filter on

operatorRowFilterOperator (string)required

Allowed Row Filter Operator values. Values: eq, ne, gt, gte, lt, lte, in, not_in, and 4 more.

Possible values: [eq, ne, gt, gte, lt, lte, in, not_in, between, like, is_null, is_not_null]

value object

Filter value. Single value for scalar operators, list for 'in'/'not_in', 2-element list for 'between'. Omit for 'is_null'/'is_not_null'.

anyOf

• Option 1
• null

]

column_masks object

Column-mask rules keyed by column name, or null when no masking applies.

anyOf

• object
• null

object

created_at object

anyOf

• integer
• null

integer

updated_at object

anyOf

• integer
• null

integer

AccessControlPolicy

{
  "resource_id": "string",
  "subject_id": "string",
  "row_filters": {
    "kind": "and",
    "conditions": [
      {
        "kind": "condition",
        "column": "string",
        "operator": "eq"
      },
      null
    ]
  },
  "column_masks": {},
  "created_at": 0,
  "updated_at": 0
}