Apply a Policy Bundle for the calling user
Apply a Policy Bundle for the calling user
Accepts an edited Policy Bundle archive and applies it as the active user-scope PolicySetVersion for the calling user.
The user's policy set is seeded from the system-default policies on
first access, forked into customer-owned policies; a user bundle
therefore contains only customer-owned policies. Applying an edit
creates a new version of the affected policy, and a new_policy entry
adds a further customer-owned policy. Platform-owned catalog policies
are never edited in place by this operation.
The request body codec is determined from Content-Type. The only codec
supported today is application/vnd.keycard.policy-bundle.v1+tar+gzip.
Supports optimistic concurrency via If-Match: when supplied, the server
applies the bundle only if the supplied ETag matches the current bundle
ETag; otherwise responds 412 Precondition Failed.
On success the server returns the materialized bundle (in the same
codec) and its new ETag.
Parameters
tar+gzip Policy Bundle archive. manifest.json is required
(see PolicyBundleManifest); schema.cedarschema is optional
and ignored — the server validates against its attested schema
for manifest.schema.version. The manifest's policies[] list is
authoritative for the resulting set: each entry must have a
matching policies/<public_id>.cedar (or, for a new_policy
entry, policies/<new_policy>.cedar) member, and a member with no
manifest entry is dropped. Only the sha fields are advisory and
recomputed server-side. Duplicate or unrecognized entries are
rejected with bundle_invalid. See the PolicyBundle tag for
the layout.
Returns
Apply a Policy Bundle for the calling user
import KeycardAPI from '@keycardai/api';
const client = new KeycardAPI({
apiKey: process.env['KEYCARD_API_API_KEY'], // This is the default and can be omitted
});
const policyBundle = await client.policyBundle.update(fs.createReadStream('path/to/file'));
console.log(policyBundle);
const content = await policyBundle.blob();
console.log(content);