Modify the allowed import additions for a specific policy entry
Modify the allowed import additions of the policy entry identified by the
policyId path parameter and the label path parameter.
Allowed import additions control which types of additions (subjects, resources) are permitted
when this entry is referenced by other entries via references. Setting an empty array
disables all additions for this entry.
Body
JSON array of allowed import addition types.
Defines which types of additions are allowed when this entry is referenced by other entries
via references.
Semantics:
- Field absent (omitted) — no restriction; the referencing entry's own subjects, resources, and namespaces are merged in as usual. This is the upgrade-friendly default.
- Field present and empty (
[]) — no additions allowed; only the referenced entry's content is effective. - Field present with values — only the listed kinds of additions survive on the referencing entry.
This field is enforced as a runtime filter, not as a write-time policy contract: a referencing entry that declares own subjects/resources/namespaces not permitted here can still be persisted, but the disallowed own additions are silently stripped at enforcement time. The same filter applies whether the reference is local (within the same policy) or an import reference.
subjects— allows referencing entries to add additional subjects on top of this entryresources— allows referencing entries to add additional resources on top of this entrynamespaces— allows referencing entries to add additional namespace patterns on top of this entry
[
"subjects"
]Parameters
policyIdstringrequiredpathThe ID of the policy needs to follow the namespaced entity ID notation (see Ditto documentation on namespaced entity IDs).
The namespace needs to:
- conform to the reverse domain name notation
labelstringrequiredpathThe label of a policy entry
If-MatchstringheaderThe If-Match header which has to conform to RFC-7232 (Conditional Requests). Common usages are:
- optimistic locking by specifying the
ETagfrom a previous HTTP response, e.g.If-Match: "hash:a75ece4e" - retrieving or modifying a resource only if it already exists, e.g.
If-Match: *
If-None-MatchstringheaderThe If-None-Match header, which has to conform to RFC-7232 (Conditional Requests). A common usage scenario is to modify a resource only if it does not yet exist, thus to create it, by specifying If-None-Match: *.
if-equalstringupdateskipskip-minimizing-mergeheaderThe if-equal header can take the values 'update' (which is the default if omitted), 'skip' or 'skip-minimizing-merge'. If 'update' is defined, the entity will always be updated, even if it is equal before the update. If 'skip' is defined, the entity not be updated if it is equal before the update. In this case a 'Precondition Failed' 412 status is returned. If 'skip-minimizing-merge' is defined, the entity will not be updated if it is equal before the update. In this case a 'Precondition Failed' 412 status is returned. Additionally, merge/patch commands will be minimized to only the fields which actually changed, compared to the current state of the entity.
timeoutstringqueryDefines how long the backend should wait for completion of the request, e.g. applied when waiting for requested
acknowledgements via the requested-acks param. Can be specified without unit (then seconds are assumed) or
together with s, ms or m unit. Example: 42s, 1m.
The default (if omitted) and maximum timeout is 60s. A value of 0 applies fire and forget semantics for
the command resulting in setting response-required=false.
response-requiredbooleanqueryDefines whether a response is required to the API call or not - if set to false the response will directly
sent back with a status code of 202 (Accepted).
The default (if ommited) response is true.
Response
The allowed import additions were successfully updated.
The request could not be completed. Possible reasons:
- the
policyIddoes not conform to the namespaced entity ID notation (see Ditto documentation on namespaced entity IDs) - the JSON body of the allowed import additions is invalid
The request could not be completed due to missing authentication.
The request could not be completed. Possible reasons:
- the caller has insufficient permissions.
You need
WRITEpermission on thepolicy:/entries/{label}/allowedAdditionsresource, without any revoke in a deeper path of the policy resource.
The request could not be completed. The policy with the given ID was not found in the context of the authenticated user.
A precondition for reading or writing the (sub-)resource failed. This will happen for write requests, if you specified an If-Match or If-None-Match header, which fails the precondition check against the current ETag of the (sub-)resource. For read requests, this error may only happen for a failing If-Match header. In case of a failing If-None-Match header for a read request, status 304 will be returned instead.
The created or modified entity is larger than the accepted limit of 100 kB.
Authorization
OpenIDConnectopenIdConnectOpenID Connect Discovery URL. The placeholder is replaced by Swagger UI when configured.
NginxBasichttp (basic)Eclipse Ditto sandbox demo user (demo1 ... demo9) + password (demo)
Bearerhttp (bearer)A JSON Web Token issued by a supported OAuth 2.0 Identity Provider.