PingOne Platform APIs

Decision Evaluation

The PingOne policy decision service provides an action for runtime evaluation of decision requests against a given policy decision resource.

The runtime evaluation endpoint is the integration point into custom applications. It provides the connection for the application to use values from the policy decision service.

Assigning admin roles and permissions to this service

Admin role assignments determine access to PingOne APIs. When assigning admin roles to this service, refer to PingOne Permissions by Service for the service-specific permissions.

You can also choose to assign admin roles based on particular service resources. Refer to PingOne Permissions by Resource when assigning admin roles per service resources.

Admin assignments to roles are set by:

Refer to Roles Management for more information.

Policy decision evaluation request data model

Property Type Required Mutable Description

parameters

Object

Required

Mutable

An object that specifies the evaluation parameters required by the policy. Each parameter value must be a string. For structured data, flatten the path into a dot-notation key if the policy has a matching request resolver attribute configured. Otherwise, stringify the value as JSON. Refer to Evaluate a Decision Request for an example of each.

userContext.user.id

UUID

Optional

Mutable

A string that specifies the user’s unique identifier.

Policy decision evaluation response data model

Property Type Required Mutable Description

authorizationVersion.id

UUID

Optional

Mutable

A string that specifies the ID of the authorization version deployed to this endpoint. Versioning allows independent development and deployment of policies. If omitted, the endpoint always uses the latest policy version available from the policy editor service.

id

UUID

Required

Mutable

A string that specifies the resource’s unique identifier.

correlationId

UUID

Optional

Mutable

A string that specifies the decision evaluation correlation ID.

decision

String

Required

Mutable

A string that specifies the decision result. Options are PERMIT, DENY, NOT_APPLICABLE, and INDETERMINATE.

elapsedMicroseconds

Integer

Optional

Mutable

An integer that specifies the evaluation duration in microseconds.

status.code

String

Optional

Mutable

A string that specifies the status. Options are OKAY, MISSING_ATTRIBUTE, TYPE_CONVERSION_ERROR, PROCESSING_ERROR, and TIMEOUT.

status.message

String

Optional

Mutable

A string that specifies the description of the error.

statements.id

UUID

Required

Mutable

A string that specifies the statement’s unique identifier.

statements.name

String

Required

Mutable

A string that specifies the statement name.

statements.code

UUID

Optional

Mutable

A string that specifies the the statement code. Options are ANSWER.

statements.payload

Object

Optional

Mutable

An object that specifies statement payload.

timestamp

String

Optional

Mutable

A string that specifies the time the evaluation was executed.
Link Description

profile

A string that specifies the URL for the decision request’s associated profile.

authorizationVersion.href

A string that specifies the URL for the authorization version endpoint.

authorizationVersion.profile

A string that specifies the URL for the authorization version profile.

policy.href

A string that specifies the URL for the policy endpoint.

policy.profile

A string that specifies the URL for the policy profile.

statements.href

A string that specifies the URL for the statements endpoint.

statements.profile

A string that specifies the URL for the statements profile.

Bulk policy decision evaluation request data model

Property Type Required Mutable Description

decisionRequests

Array

Required

Mutable

An array of Decision Request models.

parameters

Object

Required

Mutable

An object that specifies the evaluation parameters required by the policy.

userContext.environment.id

UUID

Optional

Mutable

A string that specifies the environment’s unique identifier.

userContext.user.id

UUID

Optional

Mutable

A string that specifies the user’s unique identifier.

Policy decision authorization events generated

Refer to Audit Reporting Events for the events generated.

The decision event format returned by a DECISION_ENDPOINT.DECISION_REQUEST_EVALUATED event uses terse keys to reduce storage requirements. The following table explains the meaning of each key returned in the decision event response.

Key Description

enm

The name of the endpoint against which the decision request was evaluated.

eid

The ID of the endpoint against which the decision request was evaluated.

pid

The ID of the PingOne Authorize Policy that was deployed to the endpoint at the time the decision request was evaluated.

ver

The ID of the version that was deployed to the endpoint at the time the decision request was evaluated.

dec

The overall decision produced.

sce

The JSON object describing the scenario (the decisions produced by individual policies and rules that contributed to the overall decision).

sce.P

The list of the IDs of the policies and rules that produced the decision PERMIT.

sce.D

The list of the IDs of the policies and rules that produced the decision DENY.

sce.I

The list of the IDs of the policies and rules that produced the decision INDETERMINATE.

idx

The index of the decision request within the batch. Only present for bulk requests.

exe

The time taken to evaluate the decision request (in microseconds).

svc

The JSON array giving the names and values of PingOne Authorize Services that were invoked as part of the decision request evaluation.

svc.n

The service name.

svc.v

The service value.

Response codes

Code Message

200

Successful operation.

400

The request could not be completed.

401

You do not have access to this resource.

403

You do not have permissions or are not licensed to make this request.

404

The requested resource was not found.

Policy decision evaluation errors

In addition to the general error codes, policy decision evaluation operations can return the following errors:

HTTP status Top‑level code Detail code When it happens and what the response contains

400

INVALID_REQUEST

None

Message: The request could not be completed. The request was malformed or invalid.

When and details

When: A POST evaluate request has a missing or non-deserializable body, such as a parameters value that is not a string or a userContext.user.id value that is an empty string, or bulk decision requests are not enabled for the environment

Details: None. A decisionEndpointID path value that cannot be parsed as a UUID returns the same top‑level code with the message text The request could not be completed. One or more validation errors were in the request.

400

INVALID_REQUEST

REQUIRED_VALUE

Message: The request could not be completed. The request was malformed or invalid.

When and details

When: A POST evaluate request provides a userContext object without a user object, or a user object without an id

Details: The target is userContext; the message is userContext requires a user when the user object is missing, or user requires an id when the id is missing.

400

INVALID_REQUEST

SIZE_LIMIT_EXCEEDED

Message: The request could not be completed. The request was malformed or invalid.

When and details

When: A bulk POST evaluate request omits the decisionRequests array or provides an empty array

Details: The target is decisionRequests; the message is Bulk request must have at least one decision request.

400

INVALID_DATA

SIZE_LIMIT_EXCEEDED

Message: The request could not be completed. One or more validation errors were in the request.

When and details

When: A bulk POST evaluate request contains more decisionRequests entries than the environment’s maximum batch size (20)

Details: The target is decisionRequests; the message is Bulk request exceeds the maximum allowed size with an innerError maximumValue entry giving the configured limit.

401

ACCESS_FAILED

INVALID_TOKEN

Message: The request could not be completed. You do not have access to this resource.

When and details

When: The bearer token is missing, invalid, or expired

Details: The authorization token is either missing or invalid, or it has expired.

403

ACCESS_FAILED

None

Message: The actor attempting to perform the request is not authorized.

When and details

When: The actor lacks the authz:authorize:decisionendpoint permission

Details: None

404

NOT_FOUND

None

Message: The request could not be completed. The requested resource was not found.

When and details

When: The decisionEndpointID does not identify a decision endpoint in the environment, or the endpoint’s policy version has no stored deployment package

Details: None

500

UNEXPECTED_ERROR

None

Message: There was an unexpected error with the service. Please try again later.

When and details

When: The evaluation fails unexpectedly, for example the deployment package cannot be loaded or deserialized

Details: None