Get all actions for a subject

[mm192010]

Hello,

Is there a way i can get all actions for a resource for a subject?
Jen is in finance department and i have subject mapping, allowing finance department to 'update'
Jen is in engineering department and i have subject mapping, allowing engineering department to 'read'

I want to what actions are permitted for Jen and Jack for a resource "Sample.txt"

Regards
Max

[marythought]

Hi Max,

Great question. OpenTDF doesn't currently have a single API call that returns "here are all the actions Jen can perform on Sample.txt." Happy to put in a feature request for that functionality, especially if there are others with the same need. There are two APIs that get you close, but each requires some extra work on your side:

Option 1: Check each action individually with GetDecision

If you know the set of possible actions (e.g., read, update, delete), you can call GetDecision for each one and collect the results:

String[] actions = {"read", "update", "delete"};

for (String actionName : actions) {
    GetDecisionRequest request = GetDecisionRequest.newBuilder()
        .setEntityIdentifier(
            EntityIdentifier.newBuilder()
                .setEntityChain(
                    EntityChain.newBuilder()
                       .addEntities(
                            Entity.newBuilder()
                                .setEmailAddress("jen@example.com")
                        )
                )
        )
        .setAction(Action.newBuilder().setName(actionName))
        .setResource(
            Resource.newBuilder()
                .setAttributeValues(
                    Resource.AttributeValues.newBuilder()
                        .addFqns("https://example.com/attr/department/value/finance")
                )
        )
        .build();

    GetDecisionResponse resp = sdk.getServices()
        .authorizationV2()
        .getDecision(request)
        .get();

    if (resp.getDecision().getDecision() == Decision.DECISION_PERMIT) {
        System.out.println("Jen can " + actionName + " this resource");
    }
}

(Sidenote: we have a planned helper method in the works to make that entityIdentifier setter method less verbose)

If you need to check multiple subjects or resources, GetDecisionBulk lets you batch these calls efficiently.

Option 2: Use GetEntitlements and cross-reference

GetEntitlements returns all attribute values a subject is entitled to, along with the permitted actions for each. If you know which attribute values are associated with "Sample.txt", you can match them up yourself to determine the effective actions.

One important note: OpenTDF works with attribute values, not file names directly. "Sample.txt" would need to be associated with attribute values (e.g., via TDF encryption), and the authorization queries reference those attribute values.

The full authorization docs are here: https://opentdf.io/sdks/authorization

Let us know if either of these will work for you as a workaround 🙏

[mm192010]

Thanks Mary, I will use option 2, get attributes from tdf reader, compare with GetEntitlements and show menu based on that.

Regards
Max