PingOne Platform APIs

Decision Endpoints

The PingOne policy decision service provides operations to create, read, update and delete decision policy versions in PingOne.

Assigning admin roles and permissions to this service

Admin role assignments determine access to PingOne APIs. When assigning admin roles to this service, refer to PingOne Permissions by Service for the service-specific permissions.

You can also choose to assign admin roles based on particular service resources. Refer to PingOne Permissions by Resource when assigning admin roles per service resources.

Admin assignments to roles are set by:

Refer to Roles Management for more information.

Policy decision service data model

Property Type Required Mutable Description

alternateId

UUID

Optional

Mutable

A string that specifies alternative unique identifier for the endpoint, which provides a method for locating the resource by a known, fixed identifier.

authorizationVersion.id

UUID

Optional

Mutable

A string that specifies the ID of the Authorization Version deployed to this endpoint. Versioning allows independent development and deployment of policies. If omitted, the endpoint always uses the latest policy version available from the policy editor service.

authorizationVersion.href

String

Optional

Mutable

A string that specifies the request URL for the authorization version endpoint.

authorizationVersion.title

String

Optional

Mutable

A string that specifies the title for the authorization version response.

authorizationVersion.type

String

Optional

Mutable

A string that specifies the content type for the authorization version response.

description

String

Required

Mutable

A string that specifies the description of the policy decision resource.

id

UUID

Required

Mutable

A string that specifies the resource’s unique identifier.

name

String

Required

Mutable

A string that specifies the policy decision resource name.

owned

Boolean

Optional

Mutable

A boolean that when true restricts modifications of the endpoint to PingOne-owned clients.

policyId

UUID

Optional

Mutable

A string that specifies the ID of the root policy configured for this endpoint. If omitted, the policy editor service decides on a suitable default.

recentDecisions.href

String

Optional

Mutable

A string that specifies the request URL for the recent decisions endpoint.

recentDecisions.title

String

Optional

Mutable

A string that specifies the title for the recent decisions response.

recentDecisions.type

String

Optional

Mutable

A string that specifies the content type for the recent decisions response.

recordRecentRequests

Boolean

Required

Mutable

A boolean that specifies whether to record a limited history of recent decision requests and responses, which can be queried through a separate API.

Policy decision management events generated

Refer to Audit Reporting Events for the events generated.

Response codes

Code Message

200

Successful operation.

201

Successfully created.

204

Successfully removed. No content.

400

The request could not be completed.

401

You do not have access to this resource.

403

You do not have permissions or are not licensed to make this request.

404

The requested resource was not found.

Policy decision endpoints errors

In addition to the general error codes, policy decision endpoint operations can return the following errors:

HTTP status Top‑level code Detail code When it happens and what the response contains

400

INVALID_DATA

EMPTY_VALUE

Message: Validation Error : [<property> <message>]

When and details

When: A POST /decisionEndpoints or PUT /decisionEndpoints/{decisionEndpointID} request omits the required name property or provides a blank value

Details: must not be empty for an omitted or blank name, for example Validation Error : [name must not be empty]

400

INVALID_DATA

UNIQUENESS_VIOLATION

Message: A resource with the specified name already exists. (for a duplicate alternateId: A resource with the specified alternateId already exists.)

When and details

When: A POST /decisionEndpoints or PUT /decisionEndpoints/{decisionEndpointID} request specifies a name that already exists in the environment, or an alternateId that is already in use

Details: The target is name; the message is The name '<endpointName>' is already in use. with innerError existingId and name values identifying the existing endpoint. No detail is returned for a duplicate alternateId.

400

INVALID_DATA

INVALID_VALUE

Message: The request could not be completed. One or more validation errors were in the request. or, for a changed policy reference, Cannot update policy id

When and details

When: A POST or PUT /decisionEndpoints request provides a name longer than 256 characters, a PUT request changes the endpoint’s policy reference, or an alternateId-prefixed endpoint reference (for example aam.<moduleId>) contains a value that is not a valid module ID

Details: Decision Endpoint name exceeds maximum length of 256 for an over-long name, or Invalid Module ID: <alternateId> for an invalid module ID. No detail is returned for a changed policy reference

400

INVALID_REQUEST

None

Message: The request could not be completed. The request was malformed or invalid. or, for an invalid deployment package, Invalid Deployment Package

When and details

When: A POST or PUT /decisionEndpoints request has a missing or non-deserializable body, a deploymentPackage value that is not a valid deployment package, or a deploymentPackage is supplied by a client that is not allowed to push deployment packages

Details: None

400

REQUEST_FAILED

CONSTRAINT_VIOLATION

Message: The request violates a constraint imposed by the service.

When and details

When: A POST /decisionEndpoints request would exceed the maximum number of decision endpoints for the environment (30, or 105 when the modules feature is enabled)

Details: The target is Decision Endpoint; the message is Cannot create new Decision Endpoint as the number of Decision Endpoints would exceed platform limits.

401

ACCESS_FAILED

None

Message: The request could not be completed. You do not have access to this resource. for an environment access failure, Client is not entitled to create this endpoint for an owned-endpoint creation attempt, or Client is only entitled to modify Recent Decisions on this endpoint for an owned-endpoint modification beyond its recent-decisions setting

When and details

When: The actor lacks access to the environment, or a client that is not entitled to create or modify PingOne-owned endpoints sends owned: true (or modifies an owned endpoint beyond its recent-decisions setting)

Details: None

403

ACCESS_FAILED

None

Message: The actor attempting to perform the request is not authorized.

When and details

When: The actor lacks the authz:create:decisionendpoint permission (POST), the authz:read:decisionendpoint permission (GET decision endpoint operations), the authz:read:recentdecisions permission (GET recent decision operations), the authz:update:decisionendpoint permission (PUT), or the authz:delete:decisionendpoint permission (DELETE)

Details: None

404

NOT_FOUND

None

Message: The request could not be completed. The requested resource was not found.

When and details

When: The decisionEndpointID or recentDecisionId does not identify a resource in the environment, recent decision recording is not enabled on the endpoint, or the authorizationVersionID does not identify an authorization version

Details: For a GET …​/recentDecisions request on an endpoint with recordRecentRequests set to false, the message is Recording of recent decisions is not enabled on this endpoint.

500

UNEXPECTED_ERROR

None

Message: There was an unexpected error with the service. Please try again later.

When and details

When: The operation fails unexpectedly, for example the policy configuration cannot be read from the policy editor service or the deployment package cannot be deserialized

Details: None