Assign condition set rules with the API

Grant a permission to a user set on a resource set by creating a condition set rule through the Permit API. This page is for developers who script attribute-based access control (ABAC) policy setup and have already created their condition sets.

A condition set rule combines three parts: a user set, a permission (an action on a resource), and a resource set. When a rule exists, every user in the user set can perform the action on every resource in the resource set.

Prerequisites

• An environment API key. See Get your API key.
• A user set and a resource set. See Create condition sets with the API.
• The resource and action named in the permission, for example the clone action on the repository resource.

Example rule: US-based employees clone private repositories

This example uses the condition sets from Create condition sets with the API:

Sets and action in this rule

User set: us_based_employees
Action: repository:clone
Resource set: private_repos

The rule reads:

Rule

Employees located in the US can clone private repositories.

Create the condition set rule

Send the rule as the JSON body of a POST request to https://api.permit.io/v2/facts/{proj_id}/{env_id}/set_rules, with the header Authorization: Bearer <API_KEY>.

{
    "user_set": "us_based_employees",
    "permission": "repository:clone",
    "resource_set": "private_repos"
}

Field	Required	Description
user_set	Yes	Key of the user set that receives the permission.
permission	Yes	The permission to grant, as <resource_key>:<action_key> (for example repository:clone) or a resource action ID.
resource_set	Yes	Key of the resource set the permission applies to.
is_role	No	When true, the rule uses the autogenerated user set of the role named in user_set. Default false.
is_resource	No	When true, the rule uses the autogenerated resource set of the resource named in resource_set. Default false.

The response is an array of the created rules. Each rule has an id, a key, the user_set, permission, and resource_set, and timestamps. If the permission is already granted, the API skips it.

Verify the rule

Send a GET request to https://api.permit.io/v2/facts/{proj_id}/{env_id}/set_rules?user_set=us_based_employees. The response lists the rule with permission set to repository:clone and resource_set set to private_repos.

You can also filter the list with the permission and resource_set query parameters.

Remove a condition set rule

Send a DELETE request to https://api.permit.io/v2/facts/{proj_id}/{env_id}/set_rules with the same user_set, permission, and resource_set fields in the body. The API returns 204 No Content. If the permission is not granted, the API skips it.

Next steps

• Walk through a complete example with a user set, a resource set, and a rule.
• Check permissions to confirm that a user in the user set can perform the action.
• See the Condition Set Rules API reference for the full request and response schemas.