Create policy
Actions and resources are validated on write, so a typo cannot silently create a policy that grants nothing. A non-administrator cannot grant what it does not itself hold, and cannot grant wildcards.
Authorizations
A machine credential, qk_ followed by its secret. The first twelve
characters are an indexed prefix; the rest is compared in constant time
against a stored SHA-256 hash. A key reaches only the configurations it is
linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Body
allow, deny The kinds of principal a policy or a clearance grant may name. An audit
record may additionally carry anonymous or system.
user, api_key, role Response
Created.
Deny always wins, and the default with no policy is deny.
allow, deny The kinds of principal a policy or a clearance grant may name. An audit
record may additionally carry anonymous or system.
user, api_key, role Exact actions or namespace wildcards, for example kms:*. *
grants everything and only an administrator may write it.
Prefixed specifiers: container:<slug>, key:<uuid>,
classification:<slug>, audit:, system:, or *.