Skip to content
StratumStratum Docs

Simulate an authorization decision (dry-run).

POST
/v1/iam/simulate
Code sample: Shell / cURL
curl --request POST \
  --url https://stratum.example.com/v1/iam/simulate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "principalId": "example", "action": "example", "resourceArn": "example", "context": { "organizationId": "example", "projectId": "example", "tags": { "additionalProperty": "example" }, "sourceIp": "example", "currentTime": "2026-04-15T12:00:00Z", "mfaPresent": true } }'

Answers “would principalId be allowed action on the resource named by resourceArn?” without performing the action, and returns the policy/statement that determined the outcome (the fired forbids on a deny, the fired permits on an allow). Runs the exact overlay the live authorizer uses, so the simulated answer matches production. The ARN carries one scope segment; supply context.organizationId/projectId/ tags to fill the resource’s other ancestry + tags for accurate org-scoped and tag-conditional evaluation. Gated iam:SimulatePolicy at the resource’s owning scope.

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
principalId
required

The identity to test — a user (u-…) or service account (sa-…).

string
action
required

A catalog action, e.g. compute:StartInstance.

string
resourceArn

ARN of the target resource. Optional: omit it — or name the install resource (arn:stratum:<service>::install:install/install) — to simulate an install/service-wide action (one whose catalog resourceTypes is empty, e.g. iam:ListUsers). Those evaluate against identity policies + role bindings only, with no resource-policy overlay.

string
context

Optional resource ancestry + tags the ARN can’t carry, plus request signals.

object
organizationId
string
projectId
string
tags
object
key
additional properties
string
sourceIp

Caller IP to simulate request.sourceIp conditions.

string
currentTime

RFC3339 wall-clock to simulate request.currentTime windows; defaults to now.

string format: date-time
mfaPresent

Whether to simulate an MFA-authenticated session for request.mfaPresent conditions.

boolean

Example generated

{
  "principalId": "example",
  "action": "example",
  "resourceArn": "example",
  "context": {
    "organizationId": "example",
    "projectId": "example",
    "tags": {
      "additionalProperty": "example"
    },
    "sourceIp": "example",
    "currentTime": "2026-04-15T12:00:00Z",
    "mfaPresent": true
  }
}

Responses

Section titled “Responses”

200

Section titled “200”

The simulated decision + its determining policies.

Media typeapplication/json
object
decision
required
string
Allowed values: allow deny
reason
required

Human-readable explanation of the decision.

string
determining
required

The policies that determined the decision — the fired forbids on a deny, the fired permits on an allow, empty on an implicit deny (no matching permit).

Array<object>
object
policyId
required

Raw engine policy id.

string
kind
required
string
Allowed values: policy-attachment custom-role-binding role-binding resource-policy builtin
ref
required

The authored source — an att-…/rb-… id, a resource key, or a builtin policy name.

string
statementIndex
required

0-based deciding-statement index, or -1 when the source has no statement list.

integer
effect
required
string
Allowed values: permit forbid

Example 

{
  "decision": "allow",
  "determining": [
    {
      "kind": "policy-attachment",
      "effect": "permit"
    }
  ]
}

400

Section titled “400”

Bad request.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

401

Section titled “401”

Missing or invalid token.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

Headers

Section titled “Headers”
WWW-Authenticate
string

403

Section titled “403”

Authenticated but not authorized.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}