Request Syntax URI Request Parameters Request Body Response Syntax Response Elements Errors Examples See Also

CheckIngestedDocumentAcl

Checks whether a user has access to a specific document by verifying against the ingested access control list (ACL) in a knowledge base. Use this operation to validate that document-level access control is working as expected after ingestion. To use this operation, you must have the bedrock:CheckIngestedDocumentAcl permission.

Request Syntax


POST /knowledgebases/knowledgeBaseId/datasources/dataSourceId/check-ingested-document-acl HTTP/1.1
Content-type: application/json

{
   "documentId": "string",
   "userContext": { 
      "userId": "string"
   }
}

URI Request Parameters

The request uses the following URI parameters.

dataSourceId

The unique identifier of the data source that contains the document.

Length Constraints: Minimum length of 0. Maximum length of 10.

Pattern: [0-9a-zA-Z]+

Required: Yes

knowledgeBaseId

The unique identifier of the knowledge base that contains the document.

Length Constraints: Minimum length of 10. Maximum length of 2048.

Pattern: [0-9a-zA-Z]{10}$|^arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:knowledge-base/[0-9a-zA-Z]{10}

Required: Yes

Request Body

The request accepts the following data in JSON format.

documentId

The unique identifier of the document to check access for.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 1825.

Pattern: \P{C}*

Required: Yes

userContext

The context object containing identity information for access control filtering, including user ID and optional group memberships used to evaluate the document access control list (ACL).

Type: UserContext object

Required: Yes

Response Syntax


HTTP/1.1 200
Content-type: application/json

{
   "hasAccess": boolean
}

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

hasAccess

Specifies whether the user has access to the document based on the ingested access control list (ACL). Returns true if the user is allowed access, and false otherwise.

Type: Boolean

Errors

For information about the errors that are common to all actions, see Common Error Types.

AccessDeniedException

The request is denied because of missing access permissions. Check your permissions and retry your request.

HTTP Status Code: 403

InternalServerException

An internal server error occurred. Retry your request.

reason: The reason for the exception. If the reason is BEDROCK_MODEL_INVOCATION_SERVICE_UNAVAILABLE, the model invocation service is unavailable. Retry your request.

HTTP Status Code: 500

ResourceNotFoundException

The specified resource Amazon Resource Name (ARN) was not found. Check the Amazon Resource Name (ARN) and try your request again.

HTTP Status Code: 404

ThrottlingException

The number of requests exceeds the limit. Resubmit your request later.

HTTP Status Code: 429

ValidationException

Input validation failed. Check your request parameters and retry the request.

HTTP Status Code: 400

Examples

Check if a user has access to a document

The following example checks whether a specific user has access to a document in a knowledge base based on the ingested ACL.

Sample Request


POST /knowledgebases/KB12345678/datasources/DS12345678/check-ingested-document-acl HTTP/1.1
Content-type: application/json

{
    "documentId": "doc-001",
    "userContext": {
        "userId": "user@example.com",
        "userGroups": [
            {
                "id": "engineering",
                "type": "KNOWLEDGE_BASE"
            }
        ]
    }
}