| { |
| "$schema": "http://json-schema.org/draft-04/schema#", |
| "type": "object", |
| "description": "A Policy enables developers to configure fine-grained access control for Things.", |
| "title": "Policy", |
| "properties": { |
| "policyId": { |
| "type": "string", |
| "description": "Unique identifier representing the Policy, has to conform to the namespaced entity ID notation (see [Ditto documentation on namespaced entity IDs](https://www.eclipse.org/ditto/basic-namespaces-and-names.html#namespaced-id)).\n\nExamples for a valid Policy ID:\n * `org.eclipse.ditto:xdk_policy_53`\n * `foo:xdk_53`\n * `org.eclipse.vorto_42:xdk_policy`" |
| }, |
| "entries": { |
| "title": "PolicyEntries", |
| "type": "object", |
| "description": "PolicyEntries containing one PolicyEntry for each arbitrary `label` key.", |
| "properties": { |
| "additionalProperties": { |
| "title": "Label", |
| "type": "object", |
| "description": "Single Policy entry containing Subjects and Resources.", |
| "properties": { |
| "subjects": { |
| "title": "Subjects", |
| "type": "object", |
| "description": "Subjects defining who is addressed.", |
| "additionalProperties": { |
| "title": "SubjectEntry", |
| "type": "object", |
| "description": "Single (Authorization) Subject entry holding its type. The key is the actual subject identifier.", |
| "properties": { |
| "type": { |
| "type": "string", |
| "title": "SubjectType", |
| "description": "The type of the (Authorization) Subject. See [Policy documentation](../basic-policy.html#who-can-be-addressed) for allowed values." |
| } |
| } |
| } |
| }, |
| "resources": { |
| "title": "Resources", |
| "type": "object", |
| "description": "Resources containing one or many ResourceEntries.", |
| "additionalProperties": { |
| "title": "ResourceEntry", |
| "type": "object", |
| "description": "Single Resource entry defining permissions per effect. The keys must be in the format `type:path` with `type` being one of the following `thing`, `policy` or `message` resources. See [Policy documentation](../basic-policy.html#which-resources-can-be-controlled) for detailed information.", |
| "properties": { |
| "grant": { |
| "type": "array", |
| "items": { |
| "type": "string", |
| "description": "All subjects specified in this Policy entry are granted read/write permission on the resources specified in the path, and all subsequent paths, except they are revoked at a subsequent policy label.", |
| "enum": [ |
| "READ", |
| "WRITE" |
| ] |
| } |
| }, |
| "revoke": { |
| "type": "array", |
| "items": { |
| "type": "string", |
| "description": "All subjects specified in this Policy entry are prohibited to read/write on the resources specified in the path, and all subsequent paths, except they are granted again such permission at a subsequent policy label.", |
| "enum": [ |
| "READ", |
| "WRITE" |
| ] |
| } |
| } |
| } |
| } |
| } |
| } |
| } |
| } |
| } |
| } |
| } |
