postman_collection.json

{
  "info": {
    "name": "Authorization API 1.0",
    "description": "OpenID AuthZEN Authorization API 1.0 Implementation\n\nSpecification: https://openid.net/specs/authorization-api-1_0.html\n\n## Sample Data\n\n**Users:** alice, bob, carol, guest\n\n**Documents:** doc-public, doc-internal, doc-confidential\n\n## Policies\n\n1. Owners can always access their documents\n2. Public documents are accessible to everyone\n3. Internal documents require 'employee' role\n4. Confidential documents require same department or 'hr-admin' role",
    "version": "1.0.0",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "variable": [
    {
      "key": "baseUrl",
      "value": "http://localhost:8080",
      "type": "string"
    }
  ],
  "item": [
    {
      "name": "Health & Utility",
      "description": "Health check and utility endpoints",
      "item": [
        {
          "name": "Health Check",
          "request": {
            "method": "GET",
            "header": [],
            "url": {
              "raw": "{{baseUrl}}/health",
              "host": ["{{baseUrl}}"],
              "path": ["health"]
            },
            "description": "Check if the service is running."
          },
          "response": [
            {
              "name": "Healthy",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"status\": \"healthy\"\n}"
            }
          ]
        },
        {
          "name": "Reset Database",
          "request": {
            "method": "POST",
            "header": [],
            "url": {
              "raw": "{{baseUrl}}/reset-database",
              "host": ["{{baseUrl}}"],
              "path": ["reset-database"]
            },
            "description": "Reset the database to its initial state with seed data."
          },
          "response": [
            {
              "name": "Database Reset",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"status\": \"database reset\"\n}"
            }
          ]
        }
      ]
    },
    {
      "name": "Single Evaluation",
      "description": "POST /access/v1/evaluation\n\nCheck if a subject can perform an action on a resource.",
      "item": [
        {
          "name": "Alice views doc-public (PERMIT - Owner)",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"subject\": {\n    \"type\": \"user\",\n    \"id\": \"alice\"\n  },\n  \"action\": {\n    \"name\": \"view\"\n  },\n  \"resource\": {\n    \"type\": \"document\",\n    \"id\": \"doc-public\"\n  }\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/access/v1/evaluation",
              "host": ["{{baseUrl}}"],
              "path": ["access", "v1", "evaluation"]
            },
            "description": "Alice is the owner of doc-public, so access is granted."
          },
          "response": [
            {
              "name": "PERMIT - Owner",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"decision\": true,\n  \"context\": {\n    \"reason\": \"Subject is the resource owner\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Guest views doc-public (PERMIT - Public)",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"subject\": {\n    \"type\": \"user\",\n    \"id\": \"guest\"\n  },\n  \"action\": {\n    \"name\": \"view\"\n  },\n  \"resource\": {\n    \"type\": \"document\",\n    \"id\": \"doc-public\"\n  }\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/access/v1/evaluation",
              "host": ["{{baseUrl}}"],
              "path": ["access", "v1", "evaluation"]
            },
            "description": "Anyone can view public documents."
          },
          "response": [
            {
              "name": "PERMIT - Public",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"decision\": true,\n  \"context\": {\n    \"reason\": \"Resource is public\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Alice views doc-internal (PERMIT - Employee)",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"subject\": {\n    \"type\": \"user\",\n    \"id\": \"alice\"\n  },\n  \"action\": {\n    \"name\": \"view\"\n  },\n  \"resource\": {\n    \"type\": \"document\",\n    \"id\": \"doc-internal\"\n  }\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/access/v1/evaluation",
              "host": ["{{baseUrl}}"],
              "path": ["access", "v1", "evaluation"]
            },
            "description": "Alice has the 'employee' role, so she can view internal documents."
          },
          "response": [
            {
              "name": "PERMIT - Employee",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"decision\": true,\n  \"context\": {\n    \"reason\": \"Subject has 'employee' role for internal resource\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Guest views doc-internal (DENY - No Employee Role)",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"subject\": {\n    \"type\": \"user\",\n    \"id\": \"guest\"\n  },\n  \"action\": {\n    \"name\": \"view\"\n  },\n  \"resource\": {\n    \"type\": \"document\",\n    \"id\": \"doc-internal\"\n  }\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/access/v1/evaluation",
              "host": ["{{baseUrl}}"],
              "path": ["access", "v1", "evaluation"]
            },
            "description": "Guest doesn't have the 'employee' role, so access is denied."
          },
          "response": [
            {
              "name": "DENY - No Employee Role",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"decision\": false,\n  \"context\": {\n    \"reason\": \"Internal resources require 'employee' role\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Carol views doc-confidential (PERMIT - Owner)",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"subject\": {\n    \"type\": \"user\",\n    \"id\": \"carol\"\n  },\n  \"action\": {\n    \"name\": \"view\"\n  },\n  \"resource\": {\n    \"type\": \"document\",\n    \"id\": \"doc-confidential\"\n  }\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/access/v1/evaluation",
              "host": ["{{baseUrl}}"],
              "path": ["access", "v1", "evaluation"]
            },
            "description": "Carol is the owner of doc-confidential."
          },
          "response": [
            {
              "name": "PERMIT - Owner",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"decision\": true,\n  \"context\": {\n    \"reason\": \"Subject is the resource owner\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Alice views doc-confidential (DENY - Wrong Department)",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"subject\": {\n    \"type\": \"user\",\n    \"id\": \"alice\"\n  },\n  \"action\": {\n    \"name\": \"view\"\n  },\n  \"resource\": {\n    \"type\": \"document\",\n    \"id\": \"doc-confidential\"\n  }\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/access/v1/evaluation",
              "host": ["{{baseUrl}}"],
              "path": ["access", "v1", "evaluation"]
            },
            "description": "Alice is in engineering, but doc-confidential belongs to HR."
          },
          "response": [
            {
              "name": "DENY - Wrong Department",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"decision\": false,\n  \"context\": {\n    \"reason\": \"Confidential resources require same department or 'hr-admin' role\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Bob views doc-confidential (DENY - Wrong Department)",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"subject\": {\n    \"type\": \"user\",\n    \"id\": \"bob\"\n  },\n  \"action\": {\n    \"name\": \"view\"\n  },\n  \"resource\": {\n    \"type\": \"document\",\n    \"id\": \"doc-confidential\"\n  }\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/access/v1/evaluation",
              "host": ["{{baseUrl}}"],
              "path": ["access", "v1", "evaluation"]
            },
            "description": "Bob is a manager in engineering, but that doesn't give access to HR confidential docs."
          },
          "response": [
            {
              "name": "DENY - Wrong Department",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"decision\": false,\n  \"context\": {\n    \"reason\": \"Confidential resources require same department or 'hr-admin' role\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Unknown user (DENY - Not Found)",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"subject\": {\n    \"type\": \"user\",\n    \"id\": \"unknown-user\"\n  },\n  \"action\": {\n    \"name\": \"view\"\n  },\n  \"resource\": {\n    \"type\": \"document\",\n    \"id\": \"doc-public\"\n  }\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/access/v1/evaluation",
              "host": ["{{baseUrl}}"],
              "path": ["access", "v1", "evaluation"]
            },
            "description": "User doesn't exist in the database."
          },
          "response": [
            {
              "name": "DENY - Not Found",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"decision\": false,\n  \"context\": {\n    \"reason\": \"Subject not found\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Unknown document (DENY - Not Found)",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"subject\": {\n    \"type\": \"user\",\n    \"id\": \"alice\"\n  },\n  \"action\": {\n    \"name\": \"view\"\n  },\n  \"resource\": {\n    \"type\": \"document\",\n    \"id\": \"unknown-doc\"\n  }\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/access/v1/evaluation",
              "host": ["{{baseUrl}}"],
              "path": ["access", "v1", "evaluation"]
            },
            "description": "Document doesn't exist in the database."
          },
          "response": [
            {
              "name": "DENY - Not Found",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"decision\": false,\n  \"context\": {\n    \"reason\": \"Resource not found\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Unsupported action (DENY - Not Supported)",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"subject\": {\n    \"type\": \"user\",\n    \"id\": \"alice\"\n  },\n  \"action\": {\n    \"name\": \"delete\"\n  },\n  \"resource\": {\n    \"type\": \"document\",\n    \"id\": \"doc-public\"\n  }\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/access/v1/evaluation",
              "host": ["{{baseUrl}}"],
              "path": ["access", "v1", "evaluation"]
            },
            "description": "Only 'view' action is supported in this example."
          },
          "response": [
            {
              "name": "DENY - Not Supported",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"decision\": false,\n  \"context\": {\n    \"reason\": \"Action 'delete' is not supported\"\n  }\n}"
            }
          ]
        }
      ]
    },
    {
      "name": "Batch Evaluation",
      "description": "POST /access/v1/evaluations\n\nCheck multiple authorization requests in one API call.",
      "item": [
        {
          "name": "Alice - All Documents",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"evaluations\": [\n    {\n      \"subject\": {\"type\": \"user\", \"id\": \"alice\"},\n      \"action\": {\"name\": \"view\"},\n      \"resource\": {\"type\": \"document\", \"id\": \"doc-public\"}\n    },\n    {\n      \"subject\": {\"type\": \"user\", \"id\": \"alice\"},\n      \"action\": {\"name\": \"view\"},\n      \"resource\": {\"type\": \"document\", \"id\": \"doc-internal\"}\n    },\n    {\n      \"subject\": {\"type\": \"user\", \"id\": \"alice\"},\n      \"action\": {\"name\": \"view\"},\n      \"resource\": {\"type\": \"document\", \"id\": \"doc-confidential\"}\n    }\n  ]\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/access/v1/evaluations",
              "host": ["{{baseUrl}}"],
              "path": ["access", "v1", "evaluations"]
            },
            "description": "Check Alice's access to all three documents at once.\n\nExpected:\n- doc-public: PERMIT (owner)\n- doc-internal: PERMIT (employee)\n- doc-confidential: DENY (wrong department)"
          },
          "response": [
            {
              "name": "Alice - All Documents",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"evaluations\": [\n    {\n      \"decision\": true,\n      \"context\": {\"reason\": \"Subject is the resource owner\"}\n    },\n    {\n      \"decision\": true,\n      \"context\": {\"reason\": \"Subject has 'employee' role for internal resource\"}\n    },\n    {\n      \"decision\": false,\n      \"context\": {\"reason\": \"Confidential resources require same department or 'hr-admin' role\"}\n    }\n  ]\n}"
            }
          ]
        },
        {
          "name": "Guest - All Documents",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"evaluations\": [\n    {\n      \"subject\": {\"type\": \"user\", \"id\": \"guest\"},\n      \"action\": {\"name\": \"view\"},\n      \"resource\": {\"type\": \"document\", \"id\": \"doc-public\"}\n    },\n    {\n      \"subject\": {\"type\": \"user\", \"id\": \"guest\"},\n      \"action\": {\"name\": \"view\"},\n      \"resource\": {\"type\": \"document\", \"id\": \"doc-internal\"}\n    },\n    {\n      \"subject\": {\"type\": \"user\", \"id\": \"guest\"},\n      \"action\": {\"name\": \"view\"},\n      \"resource\": {\"type\": \"document\", \"id\": \"doc-confidential\"}\n    }\n  ]\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/access/v1/evaluations",
              "host": ["{{baseUrl}}"],
              "path": ["access", "v1", "evaluations"]
            },
            "description": "Check Guest's access to all three documents.\n\nExpected:\n- doc-public: PERMIT (public)\n- doc-internal: DENY (no employee role)\n- doc-confidential: DENY (no employee role)"
          },
          "response": [
            {
              "name": "Guest - All Documents",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"evaluations\": [\n    {\n      \"decision\": true,\n      \"context\": {\"reason\": \"Resource is public\"}\n    },\n    {\n      \"decision\": false,\n      \"context\": {\"reason\": \"Internal resources require 'employee' role\"}\n    },\n    {\n      \"decision\": false,\n      \"context\": {\"reason\": \"Internal resources require 'employee' role\"}\n    }\n  ]\n}"
            }
          ]
        },
        {
          "name": "All Users - doc-internal",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"evaluations\": [\n    {\n      \"subject\": {\"type\": \"user\", \"id\": \"alice\"},\n      \"action\": {\"name\": \"view\"},\n      \"resource\": {\"type\": \"document\", \"id\": \"doc-internal\"}\n    },\n    {\n      \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n      \"action\": {\"name\": \"view\"},\n      \"resource\": {\"type\": \"document\", \"id\": \"doc-internal\"}\n    },\n    {\n      \"subject\": {\"type\": \"user\", \"id\": \"carol\"},\n      \"action\": {\"name\": \"view\"},\n      \"resource\": {\"type\": \"document\", \"id\": \"doc-internal\"}\n    },\n    {\n      \"subject\": {\"type\": \"user\", \"id\": \"guest\"},\n      \"action\": {\"name\": \"view\"},\n      \"resource\": {\"type\": \"document\", \"id\": \"doc-internal\"}\n    }\n  ]\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/access/v1/evaluations",
              "host": ["{{baseUrl}}"],
              "path": ["access", "v1", "evaluations"]
            },
            "description": "Check all users' access to doc-internal.\n\nExpected:\n- alice: PERMIT (employee)\n- bob: PERMIT (owner)\n- carol: PERMIT (employee)\n- guest: DENY (no employee role)"
          },
          "response": [
            {
              "name": "All Users - doc-internal",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"evaluations\": [\n    {\n      \"decision\": true,\n      \"context\": {\"reason\": \"Subject has 'employee' role for internal resource\"}\n    },\n    {\n      \"decision\": true,\n      \"context\": {\"reason\": \"Subject is the resource owner\"}\n    },\n    {\n      \"decision\": true,\n      \"context\": {\"reason\": \"Subject has 'employee' role for internal resource\"}\n    },\n    {\n      \"decision\": false,\n      \"context\": {\"reason\": \"Internal resources require 'employee' role\"}\n    }\n  ]\n}"
            }
          ]
        }
      ]
    },
    {
      "name": "Search",
      "description": "POST /access/v1/search\n\nFind all subjects that can perform an action on a resource.",
      "item": [
        {
          "name": "Who can view doc-public?",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"action\": {\n    \"name\": \"view\"\n  },\n  \"resource\": {\n    \"type\": \"document\",\n    \"id\": \"doc-public\"\n  }\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/access/v1/search",
              "host": ["{{baseUrl}}"],
              "path": ["access", "v1", "search"]
            },
            "description": "Find all users who can view doc-public.\n\nExpected: All users (alice, bob, carol, guest) because it's public."
          },
          "response": [
            {
              "name": "All Users",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"subjects\": [\n    {\"type\": \"user\", \"id\": \"alice\"},\n    {\"type\": \"user\", \"id\": \"bob\"},\n    {\"type\": \"user\", \"id\": \"carol\"},\n    {\"type\": \"user\", \"id\": \"guest\"}\n  ]\n}"
            }
          ]
        },
        {
          "name": "Who can view doc-internal?",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"action\": {\n    \"name\": \"view\"\n  },\n  \"resource\": {\n    \"type\": \"document\",\n    \"id\": \"doc-internal\"\n  }\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/access/v1/search",
              "host": ["{{baseUrl}}"],
              "path": ["access", "v1", "search"]
            },
            "description": "Find all users who can view doc-internal.\n\nExpected: alice, bob, carol (employees only, not guest)."
          },
          "response": [
            {
              "name": "Employees Only",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"subjects\": [\n    {\"type\": \"user\", \"id\": \"alice\"},\n    {\"type\": \"user\", \"id\": \"bob\"},\n    {\"type\": \"user\", \"id\": \"carol\"}\n  ]\n}"
            }
          ]
        },
        {
          "name": "Who can view doc-confidential?",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"action\": {\n    \"name\": \"view\"\n  },\n  \"resource\": {\n    \"type\": \"document\",\n    \"id\": \"doc-confidential\"\n  }\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/access/v1/search",
              "host": ["{{baseUrl}}"],
              "path": ["access", "v1", "search"]
            },
            "description": "Find all users who can view doc-confidential.\n\nExpected: Only carol (owner and HR department)."
          },
          "response": [
            {
              "name": "Carol Only",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"subjects\": [\n    {\"type\": \"user\", \"id\": \"carol\"}\n  ]\n}"
            }
          ]
        },
        {
          "name": "Who can view unknown-doc?",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"action\": {\n    \"name\": \"view\"\n  },\n  \"resource\": {\n    \"type\": \"document\",\n    \"id\": \"unknown-doc\"\n  }\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/access/v1/search",
              "host": ["{{baseUrl}}"],
              "path": ["access", "v1", "search"]
            },
            "description": "Search for a document that doesn't exist.\n\nExpected: Empty list (no one has access to non-existent resource)."
          },
          "response": [
            {
              "name": "Empty List",
              "status": "OK",
              "code": 200,
              "body": "{\n  \"subjects\": []\n}"
            }
          ]
        }
      ]
    }
  ]
}