Custom access level specification

This page details the objects and attributes that are used to build the Common Expression Language (CEL) expressions for custom access levels. Examples are included.

To learn more about CEL, see the CEL language definition.

Objects

Access Context Manager provides four objects that contain access level attributes.

Objects
origin Contains attributes that identify the origin of the request.
request.auth Contains attributes that identify authentication and authorization aspects of the request.
request.time Contains time-based attributes that you can use to restrict access to resources based on the time of day, day of the week, or a specific date range.
levels Contains attributes to define dependency on other access levels.
device Contains attributes that describe the device the request originated from.
api Contains attributes related to the API call itself, distinct from the user, device, or network.

origin attributes

This section lists the attributes supported by the origin object.

Attributes
ip
Type string
Description

The IP address the request originated from. If the IP address cannot be determined, origin.ip evaluates to an error. We recommend that you use inIpRange to check if the origin IP address is in a specific IP address range instead of doing a string comparison.

Example: 

inIpRange(origin.ip, ["203.0.113.24"])

region_code
Type string
Description

The ISO 3166-1 alpha-2 code for the country or region where the request originated from. If the region code cannot be determined, origin.region_code evaluates to an error.

Example: 

origin.region_code == "GB"
origin.region_code in ["US", "FR", "JP"]

request.auth attributes

This section lists the attributes supported by the request.auth object.

Attributes
principal
Type string, list(string)
Description

The unique ID of the user who issued the request.

The value for request.auth.principal must be one or more unique user IDs. The UUIDs can be obtained using the Admin SDK Directory API.

The value must be in the following format: https://accounts.google.com/UUID

Where UUID is the UUID of a user.

Example: 

request.auth.principal == "https://accounts.google.com/1134924314572461055"
request.auth.principal in ["https://accounts.google.com/1134924314572461055", "https://accounts.google.com/3134824314572461115"]

claims.crd_str.pwd
Type boolean
Description

User authenticated with a password.

Example: 

request.auth.claims.crd_str.pwd == true

claims.crd_str.push
Type boolean
Description

User authenticated with a push notification to the mobile device.

Example: 

request.auth.claims.crd_str.push == true

claims.crd_str.sms
Type boolean
Description

User authenticated using a code sent to SMS or via a phone call.