Skip to main content

Call the back-end API

The Quickstart provides a helpful tool for generating curl requests to the API, and it automatically generates the necessary JWT for authentication and authorization. This will allow you to see Aserto in action. We'll test the same scenarios that we used for the Evaluator.

From the Quickstart screen, scroll down to Step 3, Test the demo app and click the Test demo app button.

How to use the testing modal​

The testing modal will open. On the left you can select a User, Resource, and an HTTP Method. Below in the Request box, there is a curl command for issuing the request, which contains a valid JWT for the selected user. Clicking the "Copy as cURL" button will copy the command so that you can paste and execute in your terminal.

On the right you can see the incoming and outgoing relations for the selected User. This is helpful for determining what the expected behavior should be. Select Morty Smith and you can see that he has owner, writer, or reader relations from various resources.

Test requests​

Now you can try the same scenarios that we tested previously in the Evaluator, only this time going through the API.

Scenario 1 - can Rick read the citadel channel?​

  • For User, select Rick Sanchez.
  • For Channel, select citadel.
  • For Operation, select GET.
  • Click the Copy as cURL button and paste into a terminal window.

You should see this response showing that the call has succeeded and the user had the required permissions.

Scenario 2 - can Rick delete the general channel?​

  • For User, select Rick Sanchez.
  • For Channel, select general.
  • For Operation, select DELETE.
  • Click the Copy as cURL button and paste into a terminal window.

You should see the response, indicating the operation was allowed:

Hello from DELETE /channel/smiths.general

Scenario 3 - can Morty write the citadel channel?​

  • For User, select Morty Smith.
  • For Channel, select citadel.
  • For Operation, select PUT.
  • Click the Copy as cURL button and paste into a terminal window.

You should see the response, indicating the operation was allowed:

Hello from PUT /channel/smiths.citadel

Scenario 4 - can Morty write the general channel?​

  • For User, select Morty Smith.
  • For Channel, select general.
  • For Operation, select PUT.
  • Click the Copy as cURL button and paste into a terminal window.

You should see this reponse indicating the call failed due to the user not having the required permissions.

Forbidden by policy rebac.check

Scenario 5 - can Morty write the gossip channel?​

  • For User, select Morty Smith.
  • For Channel, select gossip.
  • For Operation, select PUT.
  • Click the Copy as cURL button and paste into a terminal window.

You should see the response, indicating that the operation was allowed:

Hello from PUT /channel/smiths.gossip

Explore

Now that you have learned how to use the Test App, try different users and resource combinations. Refer to the relationships browser to understand what actions the user should be able to perform depending on the resource.

Congratulations

You have now completed the Slack Quickstart!

As a next step, check out the code for the back-end API that you downloaded, and learn how to use the slack policy to provide relationship-based access control for your application.