Overview
The API Policy Manager has two types of functions that are integral to creating policies:
- Asset Functions
- Request Functions
Asset Functions
The asset variable allows Policy instances to access data associated with the asset that is being requested.
path
Description | The path to the asset being accessed. |
---|---|
Syntax | asset.path |
Example | Expression: asset.path Where the request was for a Task in the organization’s shared project. Result: /ExampleOrg/shared/TestTask |
Request Functions
The request
variable allows Policy instances to access data associated with the current request being processed.
remoteAddr
Description | The IP address of the client making the request as a string. Note that this can be an IPv4 or IPv6 address. |
---|---|
Syntax | request.remoteAddr |
Example | Expression: request.remoteAddr Where the request was made from the IP address 10.0.1.2 Result: 10.0.1.2 |
remoteUser
Description | The identifier for the user making the request as a string. |
---|---|
Syntax | request.remoteUser |
Example | Expression: request.remoteUser Where the request was made by the user “sally@example.com”. Result: sally@example.com |
isUserinRole()
Description | Checks if the user is in the given role. |
---|---|
Syntax | request.isUserInRole(role) |
Example | Expression: request.isUserInRole('admin') Where the request was made by a user that has the admin role. Result: true |
method
Description | The HTTP method used for this request. |
---|---|
Syntax | request.method |
Example | Expression: request.method == 'POST' Where the request is a POST Result: true |
uri.path
Description | The full path of the request. |
---|---|
Syntax | request.uri.path |
Example | Expression: request.uri.path Result: /api/1/rest/feed/example/shared/HelloTask |
uri.query
Description | The query parameters for this request. |
---|---|
Syntax | request.uri.query |
Example | Expression: Result: |
headers
Description | An object that contains the headers from the request. The property names in the object correspond to the HTTP header names that were in the request and lookups are case-insensitive. The values of the properties are lists of strings where each element comes from one instance of a header. Since this accessing this object can be error-prone, it is best to use the match operator to extract data, like so:
|
---|---|
Syntax |
|
Example | Expression: request.headers['Content-Type'] Where the request was made with the Content-Type header set to application/json Result: ["application/json"] |
properties
Description | An object that contains the internal properties associated with the request. |
---|---|
Syntax |
|
Example | Expression: Result: |