Validate a new assignment without saving

Validates the same candidate shape used to create an assignment against its saved definition and assignments without persisting it. Duplicate logical targets return 200 with status: INVALID and an ASSIGNMENT_TARGET_EXISTS diagnostic. An ALL_TENANTS baseline change also returns server-computed impact summaries.

Authorization

UnifiedSecurityBearerAuth

AuthorizationBearer <token>

A project-scoped access token generated for an organization Admin. Generate one with the Token API using the Admin's orgUserId. The token project must match the request path, and the user must currently be active and belong to the project organization. Dashboard tokens and tenant-user project tokens are not accepted.

In: header

Path Parameters

projectId*string

Your Semaphor project ID.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

definitionId*string

The definition to assign to this actor.

scopeType*UnifiedSecurityScopeType

Determines the assignment target. Every persisted Unified RLS assignment activates the policy for its target:

ALL_TENANTS — activates RLS for all tenant actors and may supply broad assignment-owned values.
TENANT — activates RLS for one tenant and may supply tenant-specific values (requires tenantId).
TENANT_USER — activates RLS for one tenant user and may supply user-specific values (requires tenantUserId).
ORG_USER — directly activates RLS for one organization user (requires orgUserId).

CLS and SLS retain their existing assignment behavior.

Value in"ALL_TENANTS" | "TENANT" | "TENANT_USER" | "ORG_USER"

orgUserId?|

Required when scopeType is ORG_USER. Must not be set for other scopes.

tenantId?|

Required when scopeType is TENANT. Must not be set for other scopes.

tenantUserId?|

Required when scopeType is TENANT_USER. Must not be set for other scopes.

params?|

Parameter values for this assignment. These fill in {{ placeholder }} tokens in the definition's templates and expressions.

Response Body

`application/json`

curl -X post "https://semaphor.cloud/api/management/v1/projects/string/unified-security/assignments/validate" \  -H "Content-Type: application/json" \  -d '{    "definitionId": "string",    "scopeType": "ALL_TENANTS",    "orgUserId": "string",    "tenantId": "string",    "tenantUserId": "string"  }'

{
  "ok": true,
  "data": {
    "validation": {
      "status": "VALID",
      "diagnostics": [
        {
          "code": "RLS_CONFIG_SHAPE_INVALID",
          "severity": "ERROR",
          "title": "string",
          "message": "string",
          "location": {
            "resourceType": "DEFINITION",
            "resourceId": "string",
            "resourceName": "string",
            "subjectType": "RULE",
            "fieldPath": "string",
            "parameterName": "string"
          },
          "remediations": [
            {
              "code": "REAUTHOR_LEGACY_RLS",
              "label": "string",
              "target": {
                "resourceType": "DEFINITION",
                "resourceId": "string"
              }
            }
          ],
          "requiresUserDecision": true,
          "retryable": true
        }
      ],
      "impact": {
        "type": "ALL_TENANTS_BASELINE_CHANGE",
        "allOtherTenantActorsRemainActive": true,
        "parameters": [
          {
            "parameterName": "string",
            "oldValue": {
              "state": "OMITTED"
            },
            "newValue": {
              "state": "OMITTED"
            },
            "tenantOverrideAssignmentCount": 0,
            "tenantUserOverrideAssignmentCount": 0
          }
        ]
      },
      "recovery": {
        "action": "SAVE_DEFINITION_AND_REVIEW_ASSIGNMENTS",
        "assignmentIds": [
          "string"
        ]
      }
    },
    "authoringContext": {
      "definitionId": "string",
      "scopeType": "ALL_TENANTS",
      "parameters": [
        {
          "parameterName": "string",
          "currentValue": {
            "state": "OMITTED"
          },
          "inherited": {
            "state": "OMITTED"
          }
        }
      ]
    }
  }
}

{
  "ok": false,
  "error": {
    "code": "INVALID_REQUEST",
    "message": "string",
    "requestId": "string",
    "issues": [
      {
        "code": "INVALID_JSON",
        "fieldPath": "string",
        "message": "string"
      }
    ],
    "retryable": true
  }
}

{
  "ok": false,
  "error": {
    "code": "INVALID_REQUEST",
    "message": "string",
    "details": {}
  }
}

{
  "ok": false,
  "error": {
    "code": "INVALID_REQUEST",
    "message": "string",
    "details": {}
  }
}

{
  "ok": false,
  "error": {
    "code": "INVALID_REQUEST",
    "message": "string",
    "requestId": "string",
    "issues": [
      {
        "code": "INVALID_JSON",
        "fieldPath": "string",
        "message": "string"
      }
    ],
    "retryable": true
  }
}

{
  "ok": false,
  "error": {
    "code": "INVALID_REQUEST",
    "message": "string",
    "requestId": "string",
    "issues": [
      {
        "code": "INVALID_JSON",
        "fieldPath": "string",
        "message": "string"
      }
    ],
    "retryable": true
  }
}

Validate a new assignment without saving

Authorization

Path Parameters

Request Body

Response Body

200application/json

400application/json

401application/json

403application/json

404application/json

500application/json

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`