Search API Use Cases

[aaguiarz]

https://github.com/SGNL-ai/authzapi/blob/4946793ec6db3337f2e3f35099fa38ad8049a1dd/authorization-api-1_0.md?plain=1#L480

In Zanzibar-style implementations, you'd want to use the Search API to "List all of the documents that a user can view". For that scenario you'd want to also specify the asset type (e.g. "documents"), and it's not useful to return all the resources that can't be accessed. There might be a lot of them which are not relevant if you want to provide to the user a list of resources they can access.

[tulshi]

The id field in the asset is optional. Does this suffice for your use case? See related discussion #24

[aaguiarz]

But asset is used in the response, right? The asset type would be required in the request:

POST /search HTTP/1.1
Host: pdp.mycompany.com?pageToken="NWU0OGFiZTItNjI1My00NTQ5LWEzYTctNWQ1YmE1MmVmM2Q4"&pageSize=2
Authorization: <myoauthtoken>

{
  "principal": {
    "id": "[email protected]"
    "ipAddress": "172.217.22.14",
  },
  "asset": {
        "type": "document"
      },
  "queries": ["delete", "read"],
}