check_ingested_document_acl¶
Operation¶
async
¶
check_ingested_document_acl(input: CheckIngestedDocumentAclInput, plugins: list[Plugin] | None = None) -> CheckIngestedDocumentAclOutput
Checks whether a user has access to a specific document by verifying
against the ingested access control list (ACL) in a knowledge base. Use
this operation to validate that document-level access control is working
as expected after ingestion. To use this operation, you must have the
bedrock:CheckIngestedDocumentAcl permission.
Parameters:
| Name | Type | Description | Default |
|---|---|---|---|
input
|
CheckIngestedDocumentAclInput
|
An instance of |
required |
plugins
|
list[Plugin] | None
|
A list of callables that modify the configuration dynamically. Changes made by these plugins only apply for the duration of the operation execution and will not affect any other operation invocations. |
None
|
Returns:
| Type | Description |
|---|---|
CheckIngestedDocumentAclOutput
|
An instance of |
Input¶
dataclass
¶
Dataclass for CheckIngestedDocumentAclInput structure.
Attributes¶
class-attribute
instance-attribute
¶
data_source_id: str | None = None
The unique identifier of the data source that contains the document.
class-attribute
instance-attribute
¶
document_id: str | None = None
The unique identifier of the document to check access for.
class-attribute
instance-attribute
¶
knowledge_base_id: str | None = None
The unique identifier of the knowledge base that contains the document.
class-attribute
instance-attribute
¶
user_context: UserContext | None = field(repr=False, default=None)
The context object containing identity information for access control filtering, including user ID and optional group memberships used to evaluate the document access control list (ACL).
Output¶
dataclass
¶
Dataclass for CheckIngestedDocumentAclOutput structure.
Attributes¶
instance-attribute
¶
has_access: bool
Specifies whether the user has access to the document based on the
ingested access control list (ACL). Returns true if the user is
allowed access, and false otherwise.
class-attribute
instance-attribute
¶
response_metadata: ResponseMetadata = field(default=EMPTY_RESPONSE_METADATA, repr=False, compare=False)
Metadata about the response that produced this output. Use this to recover the request identifiers a service's support team needs in order to investigate a call. Members of the metadata are individually optional.