### URL placeholder syntax examples Source: https://docs.indykite.com/docs/examples/data-resolver-placeholders Examples of valid URL placeholder configurations for paths and query parameters. ```text {$myValue} ``` ```text {$myValue || 123} ``` ```text ?a={$var || Hello world!} ``` -------------------------------- ### Install the Go SDK Source: https://docs.indykite.com/docs/apis/sdks/go-sdk Installs the Indykite Go SDK. Requires Go version 1.22 or later. ```bash go install github.com/indykite/indykite-sdk-go ``` -------------------------------- ### Install Python SDK Source: https://docs.indykite.com/docs/apis/sdks/python-sdk Use pip to install the Indykite Python SDK package. ```bash pip install indykite-sdk-python ``` -------------------------------- ### Body placeholder syntax examples Source: https://docs.indykite.com/docs/examples/data-resolver-placeholders Examples of valid JSON body placeholder configurations, including numeric and string defaults. ```json "$myValue" ``` ```json {"key": "$myVvalue || 1.23e-10"} ``` ```json {"key": "$myValue || \"default\""} ``` ```json {"$myValue || {\"default\": \"object\"}"} ``` -------------------------------- ### ContX IQ policy and query example Source: https://docs.indykite.com/docs/agent-gateway/workflow-setup Example ContX IQ policy and query that returns which workflows the protected agent belongs to and which agent chain is allowed in each workflow. ```json { "meta": { "policy_version": "1.0-ciq" }, "subject": { "type": "_Application" }, "condition": { "cypher": "MATCH (subject:_Application) MATCH (wf:Workflow)-[rels:INVOKES*]->(a:Agent {external_id: $agent_id}) WHERE ALL(r IN rels WHERE r.workflow_name = wf.external_id AND endNode(r):Agent) WITH subject, wf.external_id AS workflow, [r IN rels | endNode(r).external_id] AS agent_list", "filter": [] }, "allowed_reads": { "nodes": [], "relationships": [], "aggregate_values": [ "workflow", "agent_list" ] } } ``` ```json { "aggregate_values": [ "workflow", "agent_list" ] } ``` -------------------------------- ### Full data resolver response example Source: https://docs.indykite.com/docs/examples/data-resolver-jq Example full response from a data resolver, showing nested objects, arrays, arrays of arrays, and special key cases (numeric key, quoted key with brackets, dotted key). ```json { "text": "abc", "obj": { "secondLevel": [ { "someValue": 123 }, { "someValue": 456.789 }, { "someValue": [ "value1", "value1.1" ] }, { "someValue": null }, { "someValue": false } ], "arrayOfArrays": [ [1, 2, 3], [4, 5, 6], [7, 8, 9] ], "specialCases": { "123": "pure numeric key", "super-'key'[1]": "value", "dotted.key.within": ["a", "b", "c"] } } } ``` -------------------------------- ### Define Property Metadata Source: https://docs.indykite.com/docs/control/contx-iq/query-syntax Example showing how to include metadata such as source system or assurance level within a property definition. ```json "properties": [ { "type": "status", "value": "active", "metadata": [ { "type": "source", "value": "CRM" }, { "type": "assuranceLevel", "value": 2 } ] } ] ``` -------------------------------- ### Define indykite_external_data_resolver GET resource Source: https://docs.indykite.com/docs/onboard/data-references Example configuration for an external data resolver using the GET method. ```hcl resource "indykite_external_data_resolver" "get-resolver" { name = "terraform-resolver-get" display_name = "Terraform external data resolver get" description = "External data resolver for terraform pipeline" location = "AppSpaceID" url = "https://www.example.com/sourceresolver?data=xxx" method = "GET" headers { name = "Authorization" values = ["Bearer edolkUTY"] } request_type = "json" response_type = "json" response_selector = ".resp" } ``` -------------------------------- ### Example JSON policy file Source: https://docs.indykite.com/docs/examples/json-authz-policy A complete example of a JSON authorization policy file. It defines a policy version, a subject of type Person, an action CAN_DRIVE, a resource of type Car, and a cypher condition that requires a path from the subject to the resource via an OWNS relationship. ```json { "meta": { "policyVersion": "1.0-indykite" }, "subject": { "type": "Person" }, "actions": [ "CAN_DRIVE" ], "resource": { "type": "Car" }, "condition": { "cypher": "MATCH (subject:Person)-[:OWNS]->(resource:Car)" } } ``` -------------------------------- ### WhoAuthorized response example Source: https://docs.indykite.com/docs/apis/authorizationapi Example response from the WhoAuthorized API. Shows decisionTime and a decisions object with per-resource and per-action subject lists. ```json { "decisionTime": "2022-12-12T08:39:00.110145Z", "decisions": { "Car": { "resources": { "carA": { "actions": { "CAN_DRIVE": { "subjects": [ {"externalID": "subjectA"}, ] }, "CAN_PERFORM_SERIVCE": { "subjects": [ {"externalID": "subjectB"}, ] }, }, }, "carB": { "Actions": { "CAN_DRIVE": { "subjects": [ {"externalID": "subjectC"}, ] }, }, }, }, }, }, } ``` -------------------------------- ### IsAuthorized Response Example Source: https://docs.indykite.com/docs/apis/authorizationapi Example JSON response body for the IsAuthorized endpoint, detailing the decision time and the allow status for specific actions on resources. ```json { "decisionTime": "2022-12-12T08:39:00.110145Z", "decisions": { "Car": { "Resources": { "carA": { "Actions": { "CAN_DRIVE": { "allow": true, }, "CAN_PERFORM_SERIVCE": { "allow": false, }, }, }, "carB": { "Actions": { "CAN_DRIVE": { "allow": false, }, }, }, }, }, }, } ``` -------------------------------- ### Example request body for search/resource Source: https://docs.indykite.com/docs/apis/authzen-api A JSON request body containing the subject, resource, action, and optional context parameters. ```json { "subject": { "type": "User", "id": "alice@acmecorp.com" }, "resource": { "type": "Account" }, "action": { "name": "CAN_READ" }, "context": { "policy_tags": [ "tag1" ], "input_params": { "department": "Sales" } } } ``` -------------------------------- ### Example response body for search/resource Source: https://docs.indykite.com/docs/apis/authzen-api A JSON response body containing an array of resources that the subject is authorized to access. ```json { "results": [ { "type": "Account", "id": "123" }, { "type": "Account", "id": "456" } ] } ``` -------------------------------- ### Check Terraform version Source: https://docs.indykite.com/docs/terraform-provider/terraform-provider-setup Verify the installed version of Terraform. ```bash terraform -v ``` -------------------------------- ### nodes array wildcard example Source: https://docs.indykite.com/docs/control/contx-iq/query-syntax Shows how to use the wildcard to return all properties permitted by the policy for a variable. ```json "nodes": ["person.property.*"] ``` -------------------------------- ### KBAC/AuthZEN policy example Source: https://docs.indykite.com/docs/agent-gateway/workflow-setup Example policy that answers whether a subject may trigger a workflow. Assumes a relationship like (:Person)-[:CAN_TRIGGER]->(:Workflow). If using additional subject types, create matching policies and list them in authzen.subject_types. ```json { "meta": { "policyVersion": "1.0-kbac" }, "subject": { "type": "Person" }, "actions": [ "CAN_TRIGGER" ], "resource": { "type": "Workflow" }, "condition": { "cypher": "MATCH (subject)-[:CAN_TRIGGER]->(resource:Workflow)" } } ``` -------------------------------- ### IsAuthorized Request Example Source: https://docs.indykite.com/docs/apis/authorizationapi Example JSON request body for the IsAuthorized endpoint, specifying the subject, a list of resources with actions, input parameters, and policy tags. ```json { "subject": { "external_id": { "type": "Person", "external_id": "person1" } }, "resources": [ { "externalId": "carA", "type": "Car", "actions": [ "CAN_DRIVE" ] }, { "externalId": "carB", "type": "Car", "actions": [ "CAN_DRIVE" ] } ], "input_params": { "color": { "string_value": "red" } }, "policy_tags": ["CarPolices"] } ``` -------------------------------- ### aggregate_values query example Source: https://docs.indykite.com/docs/control/contx-iq/query-syntax Shows how to specify the aggregate_values array to return the aggregated result. ```json "aggregate_values": ["roles"] ``` -------------------------------- ### nodes array example Source: https://docs.indykite.com/docs/control/contx-iq/query-syntax Shows how to specify the nodes array with property paths for vehicle, person, and pm variables. ```json "nodes": [ "vehicle.property.isActive", "person.property.givenName", "person.property.lastName", "pm.property.reservation" ] ``` -------------------------------- ### Example 3: Policy with path traversal and property comparisons Source: https://docs.indykite.com/docs/examples/json-authz-policy Defines a policy for renting a car, requiring a path through a rental company and property nodes with specific conditions. The condition uses multiple MATCH clauses and comparisons. ```json { "meta": { "policyVersion": "1.0-indykite" }, "subject": { "type": "Person" }, "actions": [ "CAN_RENT" ], "resource": { "type": "Car" }, "condition": { "cypher": "MATCH (pp:Property {type:'loa'})<-[:HAS]-(subject:Person)-[*0..5]->()-[:SUBSCRIBED_TO]->(:RentalCompany)-[:OPERATES_AT*1..2]->(:Location)-[:CONTROLS]->(resource:Car)-[:HAS]->(cp:Property {type:'minAge'}) MATCH (subject)-[:HAS]->(sp:Property {type:'age'}) WHERE sp.value >= cp.value AND pp.value > 1" } } ``` -------------------------------- ### Example response body for search/action Source: https://docs.indykite.com/docs/apis/authzen-api This JSON object shows the successful response from the search/action endpoint, returning an array of actions the subject is permitted to perform on the resource. ```json { "results": [ { "name": "CAN_READ" }, { "name": "CAN_WRITE" } ] } ``` -------------------------------- ### Example 2: Policy with WITH clause and WhoAuthorized request Source: https://docs.indykite.com/docs/examples/json-authz-policy Similar to Example 1 but includes a WITH clause in the condition. The resulting Cypher for WhoAuthorized request is shown, returning subject external IDs. ```json { "meta": { "policyVersion": "1.0-indykite" }, "subject": { "type": "Person" }, "actions": [ "CAN_DRIVE" ], "resource": { "type": "Car" }, "condition": { "cypher": "MATCH (resource)-[:HAS]->(p:Property) WHERE p.type='color' AND p.value=$color WITH subject, resource, p MATCH (subject)-[:OWNS]->(resource)", "inputParams": ["color"] } } ``` ```cypher MATCH (subject:DigitalTwin:Person) MATCH (resource:Resource:Car) WHERE resource.external_id IN $resource_ids MATCH (resource)-[:HAS]->(p:Property) WHERE p.type='color' AND p.value=$color WITH subject, resource, p MATCH (subject)-[:OWNS]->(resource) RETURN {allowed: collect(DISTINCT subject.external_id)}; ``` -------------------------------- ### WhoAuthorized request example Source: https://docs.indykite.com/docs/apis/authorizationapi Example request body for the WhoAuthorized API. It lists resources with externalId and type, optionally actions, plus input_params and policy_tags to filter policies. ```json { "resources": [ { "externalId": "carA", "type": "Car" }, { "externalId": "carB", "type": "Car", "actions": [ "CAN_DRIVE" ] } ], "input_params": { "color": { "string_value": "red" } }, "policy_tags": ["CarPolices"] } ``` -------------------------------- ### TXT audit log format Source: https://docs.indykite.com/docs/agent-gateway/deployment Example TXT audit log entry with key-value pairs. ```text [2026-01-02T15:04:05.999999999Z07:00] decision=AUTHORIZED reason=subject can trigger workflows wf1, wf2 and the actors in the delegation chain subject=alice actor=agent1 actorsChain=agent1,agent2 action=invoke service=gateway1 traceID=c323b688-3c01-4559-838d-59ac7a81ee1 ``` -------------------------------- ### WhatAuthorized Response Example Source: https://docs.indykite.com/docs/apis/authorizationapi A sample JSON response from the WhatAuthorized API, showing the decision time and the list of allowed resources for each action and resource type. ```json { "decisionTime": "2022-12-12T08:39:00.110145Z", "decisions": { "Car": { "Actions": { "CAN_DRIVE": { "resources": [ { "externalId": "carA" }, { "externalId": "carB" } ] }, "CAN_PERFORM_SERIVCE": { "resources": [ { "externalId": "carA" } ] } }, "Document": { "READ": { "resources": [ { "externalId": "docA" }, { "externalId": "docB" } ] }, "WRITE": { "resources": [ { "externalId": "docA" } ] } } } } } ``` -------------------------------- ### Example request body for search/action Source: https://docs.indykite.com/docs/apis/authzen-api This JSON object represents the required structure for a POST request to the /access/v1/search/action endpoint, specifying the subject, resource, and optional context. ```json { "subject": { "type": "User", "id": "alice@acmecorp.com" }, "resource": { "type": "Account", "id": "123" }, "context": { "policy_tags": [ "tag1" ], "input_params": { "department": "Sales" } } } ``` -------------------------------- ### Workflow interpretation example Source: https://docs.indykite.com/docs/agent-gateway/workflow-setup Shows how a workflow relationship is interpreted: in workflow 'wf1', agent1 is allowed to invoke agent2. ```cypher (agent1)-[INVOKES {workflow_name: "wf1"}]->(agent2) ``` -------------------------------- ### Example dataset JSON Source: https://docs.indykite.com/docs/examples/dataset-simple A JSON structure containing nodes for customers and vehicles, including properties and metadata for identity verification. ```json { "nodes": [ { "external_id": "customerA", "type": "Customer", "is_identity": true, "properties": [ { "type": "given_name", "value": "Alexander" }, { "type": "family_name", "value": "Anderson" }, { "type": "email", "value": "aanderson@mailinator.com" }, { "type": "driver_license", "value": 54321, "metadata": { "assurance_level": 1, "source": "BRREG" } } ] }, { "external_id": "customerB", "type": "Customer", "is_identity": true, "properties": [ { "type": "given_name", "value": "Bryan" }, { "type": "family_name", "value": "Baker" }, { "type": "email", "value": "bbaker@mailinator.com" }, { "type": "driver_license", "value": 86420 } ] }, { "external_id": "customerC", "type": "Customer", "is_identity": true, "properties": [ { "type": "given_name", "value": "Charlize" }, { "type": "family_name", "value": "Chan" }, { "type": "email", "value": "cchan@mailinator.com" }, { "type": "driver_license", "value": 97531 } ] }, { "external_id": "customerD", "type": "Customer", "is_identity": true, "properties": [ { "type": "given_name", "value": "Daisy" }, { "type": "family_name", "value": "Anderson" }, { "type": "email", "value": "danderson@mailinator.com" }, { "type": "driver_license", "value": 13570, "metadata": { "assurance_level": 1, "source": "BRREG" } } ] }, { "external_id": "customerE", "type": "Customer", "is_identity": true, "properties": [ { "type": "given_name", "value": "Alexander" }, { "type": "family_name", "value": "Ellis" }, { "type": "email", "value": "eellis@mailinator.com" }, { "type": "driver_license", "value": 12358, "metadata": { "assurance_level": 1, "source": "BRREG" } } ] }, { "external_id": "car1", "type": "Car", "is_identity": false, "properties": [ { "type": "make", "value": "Honda" }, { "type": "model", "value": "Accord" }, { "type": "vin", "value": "1HGCG32562A802313" }, { "type": "year", "value": 2018 } ] }, { "external_id": "car2", "type": "Car", "is_identity": false, "properties": [ { "type": "make", "value": "Ferrari" }, { "type": "model", "value": "430 Scuderia" }, { "type": "vin", "value": "ZFFKW64A680161012" }, { "type": "year", "value": 2008 } ] }, { "external_id": "mc1", "type": "Motorcycle", "is_identity": false, "properties": [ { "type": "make", "value": "Triumph" }, { "type": "model", "value": "Street Twin" }, { "type": "vin", "value": "MCTST1HGCG32562A80" }, { "type": "year", "value": 2019 } ] } ] } ``` -------------------------------- ### Policy cypher with COLLECT Source: https://docs.indykite.com/docs/control/contx-iq/query-syntax Example policy cypher that uses COLLECT to aggregate role names. ```cypher MATCH (subject:Person)-[:HAS_ROLE]->(role:Role) WITH subject, COLLECT(role.name) AS roles ``` -------------------------------- ### Query filter example for license plate Source: https://docs.indykite.com/docs/control/contx-iq/query-syntax Example of a query-level filter that narrows results to a specific license plate at query time. The filter has the same structure as the policy filter but without the app field; omit it if no additional filtering is needed. ```json "filter": { "attribute": "ln.property.value", "operator": "=", "value": "$lnValue" } ``` -------------------------------- ### Example response body for search/subject Source: https://docs.indykite.com/docs/apis/authzen-api This JSON object shows the successful response from the search/subject endpoint, returning an array of subjects allowed to perform the requested action. ```json { "results": [ { "type": "User", "id": "alice@acmecorp.com" }, { "type": "User", "id": "john@acmecorp.com" } ] } ``` -------------------------------- ### Example of custom_metadata property metadata Source: https://docs.indykite.com/docs/glossary Shows the structure of the optional custom_metadata field for property metadata. The allowed value types are the same as those for Properties. ```json { "custom_metadata": { "stringKey": "stringValue" } } ``` -------------------------------- ### Assumed relationship for KBAC policy Source: https://docs.indykite.com/docs/agent-gateway/workflow-setup The relationship that the KBAC policy example assumes. ```cypher (:Person)-[:CAN_TRIGGER]->(:Workflow) ``` -------------------------------- ### Example request body for search/subject Source: https://docs.indykite.com/docs/apis/authzen-api This JSON object represents the required structure for a POST request to the /access/v1/search/subject endpoint, including resource, action, subject, and optional context fields. ```json { "resource": { "type": "Account", "id": "123" }, "action": { "name": "CAN_READ" }, "subject": { "type": "User" }, "context": { "policy_tags": [ "tag1" ], "input_params": { "department": "Sales" } } } ``` -------------------------------- ### Delete Relationships Source: https://docs.indykite.com/docs/examples/ingest-examples Example request to delete a relationship by specifying the source, target, and relationship type. ```json { "relationships": [ { "type": "RENT", "source": { "external_id": "customerA", "type": "Customer" }, "target": { "external_id": "car1", "type": "Car" } } ] } ``` -------------------------------- ### Create indykite_application_agent_credential with Terraform Source: https://docs.indykite.com/docs/apis Example of using the indykite_application_agent_credential resource to create app agent credentials with a custom public JWK. ```hcl resource "indykite_application_agent_credential" "with-public" { app_agent_id = data.indykite_application_agent.opa.id display_name = "Key with custom private-public key pair" expire_time = "2040-12-31T12:34:56-01:00" public_key_jwk = <<-EOT { "kty": "EC", "use": "sig", "crv": "P-256", "kid": "sig-1631087814", "x": "WZQ9LMC08l-L05oxRa-9ObmaPQlTuWHX2GaAmMgAuSE", "y": "V5VuhYvyQ2ACiVznB_aqzfVWmwfhvPFD6Dc4X32WUE8", "alg": "ES256" } EOT } ``` -------------------------------- ### Agent Gateway YAML configuration Source: https://docs.indykite.com/docs/agent-gateway/configuration Complete example configuration for the Agent Gateway service. It includes service settings (name, port, environment, log level), identity provider endpoints, protected agent authentication, AuthZEN settings for workflow retrieval, ContX IQ settings for workflow definitions, and audit log delivery via webhook with mTLS. ```yaml --- # Service configuration, standard service settings. service: name: agent-gateway port: 1234 environment: prod log_level: debug # Identity Provider (IdP) configuration, defines the endpoints to authenticate users (subjects) and agents (actors). identity_provider: base_url: http://idp.example.com:1234 introspect_endpoint: /token/introspect client_credential_endpoint: /token exchange_endpoint: /token/exchange # Protected Agent configuration, defines where the request are forwarded and how to authenticate the agent. protected_agent: base_url: http://agent.example.com:5678 authentication: type: credentials client_secret: secret-password client_id: idp-actor-client-id # AuthZEN configuration, used to retrieve available workflows. authzen: base_url: https://us.api.indykite.com/access/v1 action: CAN_TRIGGER subject_types: - Person - User - Agent cache_ttl: 5m cache_update_after: 5m cache_update_after_error: 10s # ContX IQ (ciq) configuration, used to retrieve workflow definitions. contx_iq: base_url: https://us.api.indykite.com/contx-iq/v1 query_id: gid:abc123def456 app_agent_credentials_token: jwtheader.payload.signature cache_ttl: 5m cache_update_after: 5m cache_update_after_error: 10s allowed_workflow_id: my-awsome-workflow # Audit Log configuration, used to deliver audit messages. audit: delivery: webhook http: url: https://example.com:9090/audit method: POST auth: type: mTLS mtls_certificate_file_path: cert.pem mtls_private_key_path: key.pem ``` -------------------------------- ### Define indykite_external_data_resolver POST resource Source: https://docs.indykite.com/docs/onboard/data-references Example configuration for an external data resolver using the POST method with a request payload. ```hcl resource "indykite_external_data_resolver" "post-resolver" { name = "terraform-resolver-post" display_name = "Terraform external data resolver post" description = "External data resolver for terraform pipeline" location = "AppSpaceID" url = "https://example.com/sourceresolver2/where-data" method = "POST" headers { name = "Authorization" values = ["Bearer edbkLbPnb6VfcRPTkUTY"] } headers { name = "Content-Type" values = ["application/json"] } request_type = "json" request_payload = "{\"data\": \"$resp\"}" response_type = "json" response_selector = ".resp" } ``` -------------------------------- ### WhatAuthorized Request Example Source: https://docs.indykite.com/docs/apis/authorizationapi A sample JSON request body for the WhatAuthorized API, specifying the subject, resource types, actions, input parameters, and policy tags. ```json { "subject": { "external_id": { "type": "Person", "external_id": "person1" } }, "resource_types": [ { "type": "Car", "actions": [ "CAN_DRIVE" ] } ], "input_params": { "color": { "string_value": "red" } }, "policy_tags": ["CarPolices"] } ``` -------------------------------- ### Create a New Contract Node Source: https://docs.indykite.com/docs/control/contx-iq/query-syntax Example of using upsert_nodes to create a new node with an external identifier and properties resolved from input parameters. ```json "upsert_nodes": [ { "name": "contract", "type": "Contract", "external_id": "$contract_extid", "properties": [ { "type": "id", "value": "$contractId" }, { "type": "status", "value": "active" } ] } ] ``` -------------------------------- ### AuthZen evaluation response body Source: https://docs.indykite.com/docs/apis/authzen-api Example response body from the AuthZen evaluation endpoint. Contains a boolean decision and an optional context object with reason and advices. ```json { "decision": true, "context": { "reason": "Request failed policy gid:...", "advices": [ { "error": "insufficient_user_authentication", "error_description": "A different authentication level is required", "acr_values": "acr1 acr2" } ] } } ``` -------------------------------- ### Example 1: Policy with OWNS relationship and color property Source: https://docs.indykite.com/docs/examples/json-authz-policy Defines a policy where a Person can drive a Car they own, with a condition that the car's color matches the request parameter. The resulting Cypher for IsAuthorized request is shown. ```json { "meta": { "policyVersion": "1.0-indykite" }, "subject": { "type": "Person" }, "actions": [ "CAN_DRIVE" ], "resource": { "type": "Car" }, "condition": { "cypher": "MATCH (subject)-[:OWNS]->(resource)-[:HAS]->(p:Property) WHERE p.type='color' AND p.value=$color", "inputParams": ["color"] } } ``` ```cypher MATCH (subject:DigitalTwin:Person) WHERE subject.id = $subject_id MATCH (resource:Resource:Car) WHERE resource.external_id IN $resource_ids MATCH (subject)-[:OWNS]->(resource)-[:HAS]->(p:Property WHERE p.type='color' AND p.value=$color) RETURN {allowed: collect(DISTINCT resource.external_id)}; ``` -------------------------------- ### Example request body for evaluations endpoint Source: https://docs.indykite.com/docs/apis/authzen-api Shows the JSON structure for a batch evaluation request. The request body must contain an evaluations array with objects that include subject, resource, and action. Defaults for subject, resource, and action can be provided at the root. The context object can include policy_tags and input_params. ```json { "subject": { "type": "User", "id": "alice@acmecorp.com" }, "action": { "name": "CAN_READ" }, "evaluations": [ { "resource": { "type": "Account", "id": "123" } }, { "resource": { "type": "Account", "id": "456" } } ], "context": { "policy_tags": [ "tag1" ], "input_params": { "department": "Sales" } } } ``` -------------------------------- ### Example response body for evaluations endpoint Source: https://docs.indykite.com/docs/apis/authzen-api Shows the JSON structure of a successful response. The response includes an array of decisions ordered according to the requested evaluations. Each decision has a boolean decision field and an optional context object with reason and advices. ```json { "evaluations": [ { "decision": true }, { "decision": false, "context": { "reason": "Request failed policy gid:...", "advices": [ { "error": "insufficient_user_authentication", "error_description": "A different authentication level is required", "acr_values": "acr1 acr2" } ] } } ] } ``` -------------------------------- ### Delete Relationships Properties Source: https://docs.indykite.com/docs/examples/ingest-examples Example request to delete specific properties from a relationship by specifying the source, target, type, and the property_types to remove. ```json { "relationships": [ { "type": "RENT", "property_types": ["location"], "source": { "external_id": "customerA", "type": "Customer" }, "target": { "external_id": "car1", "type": "Car" } } ] } ``` -------------------------------- ### Test authorization with IsAuthorized curl Source: https://docs.indykite.com/docs/enrich/trust-score Example curl command to test any of the above authorization policies using the Authorization API `IsAuthorized` endpoint. Replace `{token}` with a valid bearer token. The request checks if customerA can rent car1. ```bash curl --location 'https://eu.api.indykite.com/indykite.authorization.v1beta1.AuthorizationAPI/IsAuthorized' \ --header 'Content-Type: application/json' \ --header 'Authorization: Bearer {token}' \ --data ' { "subject": { "external_id": { "type": "Customer", "external_id": "customerA" } }, "resources": [ { "externalId": "car1", "type": "Car", "actions":["RENT"] } ] }' ``` -------------------------------- ### Query nodes and trust score by node label via IdentityKnowledgeRead Source: https://docs.indykite.com/docs/enrich/trust-score Queries all nodes with a specific label (Customer in the example) and their trust score, returning both the node and the trust score properties. Replace Customer with your own node label if using your own data. ```bash curl --location 'https://eu.api.indykite.com/indykite.knowledge.v1beta2.IdentityKnowledgeAPI/IdentityKnowledgeRead' \ --header 'Content-Type: application/json' \ --header 'Authorization: Bearer {token}' \ --data '{ "query": "MATCH (c:Customer)-[:_HAS]->(t:_TrustScore {_ingress: $profile})", "input_params": { "profile": "trust-score-profile-name" }, "returns": [ { "variable": "c", "properties": [] }, { "variable": "t", "properties": [] } ] }' ``` -------------------------------- ### AuthZen evaluation request body Source: https://docs.indykite.com/docs/apis/authzen-api Example request body for the AuthZen evaluation endpoint. Must include subject, resource, and action objects; context is optional and can contain policy_tags and input_params. ```json { "subject": { "type": "User", "id": "alice@acmecorp.com" }, "resource": { "type": "Account", "id": "123" }, "action": { "name": "CAN_READ" }, "context": { "policy_tags": [ "tag1" ], "input_params": { "department": "Sales" } } } ``` -------------------------------- ### delete_relationships example: "delete_relationships": ["r4"] Source: https://docs.indykite.com/docs/control/contx-iq/query-syntax Shows the JSON array format for delete_relationships. Each entry must match a variable name in the policy's condition.cypher and be listed in allowed_deletes.relationships. Use . to delete a specific property from the relationship. ```json "delete_relationships": ["r4"] ``` -------------------------------- ### Create a Trust Score Profile with indykite_trust_score_profile Source: https://docs.indykite.com/docs/enrich/trust-score Creates a Trust Score Profile in Terraform using the `indykite_trust_score_profile` resource. The example defines a profile linked to the `Customer` node with two dimensions (`NAME_VERIFICATION` and `NAME_ORIGIN`) and a daily update schedule. The `location` must be set to an AppSpace ID. ```hcl resource "indykite_trust_score_profile" "trust-score" { name = "terraform-trust-score-profile" display_name = "Terraform Trust Score Profile" description = "Trust score profile for terraform pipeline" location = "AppSpaceID" node_classification = "Customer" dimension { name = "NAME_VERIFICATION" weight = 0.75 } dimension { name = "NAME_ORIGIN" weight = 0.5 } schedule = "UPDATE_FREQUENCY_DAILY" } ``` -------------------------------- ### delete_nodes example: "delete_nodes": ["contract"] Source: https://docs.indykite.com/docs/control/contx-iq/query-syntax Shows the JSON array format for delete_nodes. Each entry must match a variable name in the policy's condition.cypher and be listed in allowed_deletes.nodes. Use .property. to delete a specific property. Deleting a node also deletes all its associated property nodes. ```json "delete_nodes": ["contract"] ``` -------------------------------- ### Import the Go SDK Source: https://docs.indykite.com/docs/apis/sdks/go-sdk Imports the Indykite Go SDK into your application. ```go import "github.com/indykite/indykite-sdk-go" ``` -------------------------------- ### Set Windows Environment Variables Source: https://docs.indykite.com/docs/apis/sdks/python-sdk Configure service account and application credentials for Windows environments. ```bash setex INDYKITE_SERVICE_ACCOUNT_CREDENTIALS_FILE="C:\Users\xx\Documents\configuration.json" ``` ```bash setex INDYKITE_APPLICATION_CREDENTIALS_FILE="C:\Users\xx\Documents\configuration.json" ``` ```bash setex INDYKITE_APPLICATION_CREDENTIALS= ``` -------------------------------- ### Set Linux Environment Variables Source: https://docs.indykite.com/docs/apis/sdks/python-sdk Configure service account and application credentials for Linux environments. ```bash export INDYKITE_SERVICE_ACCOUNT_CREDENTIALS_FILE=/home/user/configuration.json ``` ```bash export INDYKITE_APPLICATION_CREDENTIALS_FILE=/home/user/configuration.json ``` ```bash export INDYKITE_APPLICATION_CREDENTIALS= ``` -------------------------------- ### Set service account credentials (Windows) Source: https://docs.indykite.com/docs/apis/sdks/go-sdk Sets the service account credentials file path for Windows. ```bash setex INDYKITE_SERVICE_ACCOUNT_CREDENTIALS_FILE="C:\Users\xx\Documents\configuration.json" ``` -------------------------------- ### URL placeholder end-to-end workflow Source: https://docs.indykite.com/docs/examples/data-resolver-placeholders Demonstrates the transformation of a URL template with placeholders into a final URL using provided input parameters. ```text https://example.com/{$inPath}/test?a={$q1}&b={$q2 || Hello world!} ``` ```text {"inPath": 456, "q1": "X@b"} ``` ```text https://example.com/456/test?a=X%40b&b=Hello+world! ``` -------------------------------- ### Set app agent credentials file (Linux) Source: https://docs.indykite.com/docs/apis/sdks/go-sdk Sets the app agent credentials file path for Linux. Required to use platform features. ```bash export INDYKITE_APPLICATION_CREDENTIALS_FILE=/home/user/configuration.json ``` -------------------------------- ### Set app agent credentials as JSON (Windows) Source: https://docs.indykite.com/docs/apis/sdks/go-sdk Alternative to setting the app agent credentials file path on Windows: uses the stringified JSON file content directly. ```bash setex INDYKITE_APPLICATION_CREDENTIALS= ``` -------------------------------- ### Set app agent credentials file (Windows) Source: https://docs.indykite.com/docs/apis/sdks/go-sdk Sets the app agent credentials file path for Windows. Required to use platform features. ```bash setex INDYKITE_APPLICATION_CREDENTIALS_FILE="C:\Users\xx\Documents\configuration.json" ``` -------------------------------- ### Create IndyKite application space with indykite_application_space Source: https://docs.indykite.com/docs/terraform-provider/terraform-scripts Creates a project (application space) in the IndyKite platform, associated with the customer fetched earlier. Uses local value for unique name and sets lifecycle to create before destroy. ```hcl resource "indykite_application_space" "appspace" { customer_id = data.indykite_customer.customer.id name = local.app_space_name display_name = "Terraform appspace ${time_static.example.unix}" description = "Application space for terraform pipeline" region = "europe-west1" lifecycle { create_before_destroy = true } deletion_protection = false } ``` -------------------------------- ### CloudEvents 1.0 JSON Payload Source: https://docs.indykite.com/docs/control/outbound-events A typical example of an outbound event payload formatted according to the CloudEvents 1.0 specification. ```json { "specversion": "1.0", "type": "indykite.audit.capture.upsert.relationship", "source": "event-route-name", "id": "event-id", "time": "2026-02-26T10:00:00Z", "datacontenttype": "application/json", "data": { "action": "CREATE", "data_type": "DATA_TYPE_RELATIONSHIP", "payload": { "external_id": "car-owns-user", "id": "gid:relationship:123", "label": "OWNS" } } } ``` -------------------------------- ### Set app agent credentials as JSON (Linux) Source: https://docs.indykite.com/docs/apis/sdks/go-sdk Alternative to setting the app agent credentials file path: uses the stringified JSON file content directly. ```bash export INDYKITE_APPLICATION_CREDENTIALS= ``` -------------------------------- ### Delete Nodes Properties Metadata Source: https://docs.indykite.com/docs/examples/ingest-examples Example request to delete specific metadata fields from a node property identified by external_id and type. ```json { "nodes": [ { "external_id": "customerA", "type": "Customer", "property_type": "email", "metadata_fields": [ "assurance_level", "source", "verification_time", "custom_metadata" ] } ] } ``` -------------------------------- ### Set Mac OS Environment Variables Source: https://docs.indykite.com/docs/apis/sdks/python-sdk Configure service account and application credentials for Mac OS environments. ```bash export INDYKITE_SERVICE_ACCOUNT_CREDENTIALS_FILE=/Users/username/configuration.json ``` ```bash export INDYKITE_APPLICATION_CREDENTIALS_FILE=/Users/username/configuration.json ``` ```bash export INDYKITE_APPLICATION_CREDENTIALS= ``` -------------------------------- ### Set service account credentials (macOS) Source: https://docs.indykite.com/docs/apis/sdks/go-sdk Sets the service account credentials file path for macOS. ```bash export INDYKITE_SERVICE_ACCOUNT_CREDENTIALS_FILE=/Users/username/configuration.json ``` -------------------------------- ### JSON relationship dataset Source: https://docs.indykite.com/docs/examples/dataset-simple A collection of relationship objects defining interactions between customers and vehicles, including the type of relationship and the year it started. ```json { "relationships": [ { "type": "RENT", "properties": [ { "type": "since", "value": 2019 } ], "source": { "external_id": "customerA", "type": "Customer" }, "target": { "external_id": "car1", "type": "Car" } }, { "type": "RENT", "properties": [ { "type": "since", "value": 2018 } ], "source": { "external_id": "customerA", "type": "Customer" }, "target": { "external_id": "car2", "type": "Car" } }, { "type": "RENT", "properties": [ { "type": "since", "value": 2018 } ], "source": { "external_id": "customerB", "type": "Customer" }, "target": { "external_id": "car2", "type": "Car" } }, { "type": "RENT", "properties": [ { "type": "since", "value": 2020 } ], "source": { "external_id": "customerB", "type": "Customer" }, "target": { "external_id": "mc1", "type": "Motorcycle" } }, { "type": "LEASE", "properties": [ { "type": "since", "value": 2021 } ], "source": { "external_id": "customerD", "type": "Customer" }, "target": { "external_id": "car1", "type": "Car" } } ] } ``` -------------------------------- ### Body placeholder end-to-end workflow Source: https://docs.indykite.com/docs/examples/data-resolver-placeholders Demonstrates the transformation of a JSON body template with placeholders into a final JSON object using provided input parameters. ```json { "scalar": "$s1Val", "key": "$k1Val", "arr": [1, 2, "$a1Val || 3"], "obj": "$o1Val", "defaultObj": "$o2Val || {\"key\": \"value\"}" } ``` ```json { "s1Val": "Hello, World!", "k1Val": ["x", "y", "z"], "o1Val": { "newArr": [5, 5, 5], }, } ``` ```json { "scalar": "Hello, World!", "key": ["x", "y", "z"], "arr": [1, 2, 3], "obj": { "newArr": [5, 5, 5] }, "defaultObj": { "key": "value" } } ```