Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.strait.dev/llms.txt

Use this file to discover all available pages before exploring further.

Strait supports layered authorization for user actors:
  1. Role permissions (project roles)
  2. Role inheritance (parent_role_id chains)
  3. Resource policies (direct user grant on a specific resource)
  4. Tag policies (grant by resource tag match)
API keys continue to use scope-based authorization.

​
Core Endpoints

​
Roles

  • POST /v1/roles
  • GET /v1/roles
  • GET /v1/roles/{roleID}
  • PATCH /v1/roles/{roleID}
  • DELETE /v1/roles/{roleID}
  • POST /v1/seed-roles

​
Members

  • POST /v1/members
  • POST /v1/members/bulk
  • GET /v1/members
  • DELETE /v1/members/{userID}

​
Role Lineage Introspection

  • GET /v1/roles/{roleID}?include_lineage=true

​
Resource Policies

  • POST /v1/resource-policies
  • GET /v1/resource-policies (cursor pagination)
  • DELETE /v1/resource-policies/{policyID}

​
Tag Policies

  • POST /v1/tag-policies
  • GET /v1/tag-policies (cursor pagination)
  • DELETE /v1/tag-policies/{policyID}

​
Permission Resolution Order

For user actors, requirePermission() resolves access in this order:
  1. Role/inherited role permissions
  2. Resource policy permissions for (resource_type, resource_id, user_id)
  3. Tag policy permissions for matching resource tags

​
Notes

  • RBAC mutations are rate-limited with stricter control-plane limits.
  • Permission cache is auto-invalidated when memberships/policies change.
  • Audit events are emitted for RBAC control-plane mutations.
See also: