API docs by Redocly

BKN Safe 管理 · 行过滤策略 API (1.0.0)

Download OpenAPI specification:

Manages one fixed-condition object-instance row-filter policy for a user or role on one published object type. Row filtering is evaluated only after the caller has the object's base query_data permission and can therefore narrow, but never grant or expand, query access.

This first version supports only administrator-entered fixed values. It has no user/department auto-matching, identity-field mapping, SQL, scripts, regular expressions, nested Boolean groups, or legacy policy migration.

The API is available only when the Enterprise row-filter capability is assembled and licensed. Reads and writes require either the matching platform user- or role-administration permission, or authorize on the resource's authorization-management root. For a knowledge-network child, that root is its knowledge network; the caller must also be able to view the concrete object type. A resource authorizer may configure policies for users or custom roles only within that boundary; this does not grant role membership access or authority over another knowledge network. Creating or replacing a policy requires an enabled user or custom role; deletion remains available for stale subjects. Updates use optimistic locking; clients must read the current revision, submit it as expected_revision, and handle 409 revision_conflict without automatically overwriting the newer policy.

Row-filter policies

Get one subject's explicit row-filter policy and available fields

Authorizations:
BearerAuth
query Parameters
object_type_ref
required
string (ObjectTypeRef) [ 3 .. 257 ] characters ^[a-z0-9][a-z0-9_-]{0,127}/[a-z0-9][a-z0-9_-]...

Canonical <knowledge-network-id>/<object-type-id> reference.

subject_type
required
string (SubjectType)
Enum: "user" "role"
subject_id
required
string [ 1 .. 128 ] characters

Responses

Response samples

Content type
application/json
{
  • "object_type_ref": "supply_chain/order",
  • "subject": {
    },
  • "policy": {
    },
  • "revision": "AAAAAAAAAAE",
  • "available_fields": [
    ]
}

Create, replace, or delete one explicit row-filter policy

The request atomically updates the policy and its audit record. For a create, expected_revision must be null. For an update or deletion it must equal the revision returned by the latest GET. policy: null deletes an existing policy and is an idempotent no-op when none exists. A deleted policy no longer participates in user/role policy composition; deletion does not mean “deny every row”.

Authorizations:
BearerAuth
Request Body schema: application/json
required
object_type_ref
required
string (ObjectTypeRef) [ 3 .. 257 ] characters ^[a-z0-9][a-z0-9_-]{0,127}/[a-z0-9][a-z0-9_-]...
required
object (RowFilterSubject)
expected_revision
required
string or null non-empty

Null for creation or idempotent deletion of an absent policy; otherwise the latest snapshot revision.

required
object or null

Null deletes the explicit policy.

reason
required
string [ 1 .. 512 ] characters

Audit reason without leading or trailing whitespace.

Responses

Request samples

Content type
application/json
Example
{
  • "object_type_ref": "supply_chain/order",
  • "subject": {
    },
  • "expected_revision": null,
  • "policy": {
    },
  • "reason": "Restrict the role to the east sales region"
}

Response samples

Content type
application/json
{
  • "object_type_ref": "string",
  • "subject": {
    },
  • "policy": {
    },
  • "revision": "string",
  • "available_fields": [
    ]
}

Explain the row-filter rules currently applicable to a subject

For a user, returns the direct policy and normalized effective predicate. Matching role policies are included only for callers holding platform admin-role:view; resource-root authorizers receive the same effective predicate without role-membership sources. Complete user/role policies are ORed; conditions inside each policy retain that policy's AND or OR relation. For a role, role_policy_only is true and no user-effective predicate is calculated because a role alone does not identify a concrete user's full role membership. The response never includes filtered object instances.

Authorizations:
BearerAuth
Request Body schema: application/json
required
object_type_ref
required
string (ObjectTypeRef) [ 3 .. 257 ] characters ^[a-z0-9][a-z0-9_-]{0,127}/[a-z0-9][a-z0-9_-]...
required
object (RowFilterSubject)

Responses

Request samples

Content type
application/json
{
  • "object_type_ref": "string",
  • "subject": {
    }
}

Response samples

Content type
application/json
{
  • "snapshot": {
    },
  • "effective_predicate": {
    },
  • "effective_row_filter_digest": "string",
  • "direct_policy": {
    },
  • "role_policies": [
    ],
  • "role_policy_only": true
}