Request Syntax URI Request Parameters Request Body Response Syntax Response Elements Errors Examples See Also

GetIngestedDocumentAcl

Retrieves the ingested access control list (ACL) for a specific document in a knowledge base. Use this operation to inspect the allow and deny lists that were ingested for a document to troubleshoot access control issues. To use this operation, you must have the bedrock:GetIngestedDocumentAcl permission.

Request Syntax


POST /knowledgebases/knowledgeBaseId/datasources/dataSourceId/get-ingested-document-acl HTTP/1.1
Content-type: application/json

{
   "documentId": "string"
}

URI Request Parameters

The request uses the following URI parameters.

dataSourceId

The unique identifier of the data source that contains the document.

Length Constraints: Minimum length of 0. Maximum length of 10.

Pattern: [0-9a-zA-Z]+

Required: Yes

knowledgeBaseId

The unique identifier of the knowledge base that contains the document.

Length Constraints: Minimum length of 10. Maximum length of 2048.

Pattern: [0-9a-zA-Z]{10}$|^arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:knowledge-base/[0-9a-zA-Z]{10}

Required: Yes

Request Body

The request accepts the following data in JSON format.

documentId

The unique identifier of the document to retrieve the ingested access control list (ACL) for.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 1825.

Pattern: \P{C}*

Required: Yes

Response Syntax


HTTP/1.1 200
Content-type: application/json

{
   "documentAcl": { 
      "allowList": { 
         "conditions": [ 
            { 
               "conditionOperator": "string",
               "groups": [ 
                  { 
                     "id": "string",
                     "type": "string"
                  }
               ],
               "users": [ 
                  { 
                     "id": "string",
                     "type": "string"
                  }
               ]
            }
         ],
         "memberRelation": "string"
      },
      "denyList": { 
         "conditions": [ 
            { 
               "conditionOperator": "string",
               "groups": [ 
                  { 
                     "id": "string",
                     "type": "string"
                  }
               ],
               "users": [ 
                  { 
                     "id": "string",
                     "type": "string"
                  }
               ]
            }
         ],
         "memberRelation": "string"
      }
   }
}

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

documentAcl

The ingested document access control list (ACL) containing allow and deny membership information.

Type: DocumentAcl object

Errors

For information about the errors that are common to all actions, see Common Error Types.

AccessDeniedException

The request is denied because of missing access permissions. Check your permissions and retry your request.

HTTP Status Code: 403

InternalServerException

An internal server error occurred. Retry your request.

reason: The reason for the exception. If the reason is BEDROCK_MODEL_INVOCATION_SERVICE_UNAVAILABLE, the model invocation service is unavailable. Retry your request.

HTTP Status Code: 500

ResourceNotFoundException

The specified resource Amazon Resource Name (ARN) was not found. Check the Amazon Resource Name (ARN) and try your request again.

HTTP Status Code: 404

ThrottlingException

The number of requests exceeds the limit. Resubmit your request later.

HTTP Status Code: 429

ValidationException

Input validation failed. Check your request parameters and retry the request.

HTTP Status Code: 400

Examples

Retrieve the ingested ACL for a document

The following example retrieves the full ingested access control list (ACL) for a document, including both allow and deny membership lists.

Sample Request


POST /knowledgebases/KB12345678/datasources/DS12345678/get-ingested-document-acl HTTP/1.1
Content-type: application/json

{
    "documentId": "doc-001"
}