Docs
⌘K

JavaScript: Policies and audit

List, create, test and roll back project access policies, ask whether an action is allowed, and read or verify the tamper-evident audit log with @sovaria/sdk.

Updated Oct 16, 2026

Access policies are short rules in Sovaria's policy language that decide whether a caller may use a table, collection, bucket, channel or function. These methods manage them; run them as a team member, not from an app.

const spl = 'ALLOW IF "STAFF" IN ctx.actor.roles'
const result = await sovaria.policy.simulate(spl, { actor: { roles: ['STAFF'] }, action: 'UPDATE', resource: 'books' })
console.log(result)

await sovaria.policy.create({ policy_id: 'pol_staff_edit_books', org_id: orgId, name: 'staff edit books', spl_source: spl })

sovaria.policy

sovaria.policy.templates

Templates.

sovaria.policy.templates(): Promise<JsonObject>
Returns
Promise<JsonObject>
HTTP
GET /api/v1/policies/templates

sovaria.policy.list

List.

sovaria.policy.list(): Promise<JsonValue>
Returns
Promise<JsonValue>
HTTP
GET /api/v1/policies/

sovaria.policy.get

Get.

sovaria.policy.get(policyId: string): Promise<JsonObject>

Parameters

policyIdstringrequired
Returns
Promise<JsonObject>
HTTP
GET /api/v1/policies/{…}

sovaria.policy.create

Create.

sovaria.policy.create(payload: JsonObject): Promise<JsonObject>

Parameters

payloadJsonObjectrequired
policy_id (your unique id, e.g. pol_books_read), org_id, name and spl_source.
Returns
Promise<JsonObject>
HTTP
POST /api/v1/policies/

sovaria.policy.update

Update.

sovaria.policy.update(policyId: string, payload: JsonObject): Promise<JsonObject>

Parameters

policyIdstringrequired
payloadJsonObjectrequired
Returns
Promise<JsonObject>
HTTP
PUT /api/v1/policies/{…}

sovaria.policy.delete

Delete.

sovaria.policy.delete(policyId: string): Promise<JsonObject>

Parameters

policyIdstringrequired
Returns
Promise<JsonObject>
HTTP
DELETE /api/v1/policies/{…}

sovaria.policy.evaluate

Evaluate.

sovaria.policy.evaluate(policyId: string, context: JsonObject): Promise<JsonObject>

Parameters

policyIdstringrequired
contextJsonObjectrequired
Returns
Promise<JsonObject>
HTTP
POST /api/v1/policies/{…}/evaluate

sovaria.policy.check

Check.

sovaria.policy.check(
  payload: { orgId: string projectId: string action: string resource: string context?: JsonObject },
): Promise<JsonObject>

Parameters

payload{ orgId: string projectId: string action: string resource: string context?: JsonObject }required
orgId, projectId, action, resource and optional context.
Returns
Promise<JsonObject> — Whether it is allowed and which policy decided.
HTTP
POST /api/v1/policies/check

sovaria.policy.preflight

Preflight.

sovaria.policy.preflight(
  action: string,
  resource: string,
  context?: JsonObject = {},
): Promise<JsonObject>

Parameters

actionstringrequired
e.g. UPDATE.
resourcestringrequired
e.g. books.
contextJsonObjectoptionaldefault {}
Extra request context.
Returns
Promise<JsonObject>
  • check() for the client's current project.

sovaria.policy.history

History.

sovaria.policy.history(policyId: string): Promise<JsonValue>

Parameters

policyIdstringrequired
Returns
Promise<JsonValue>
HTTP
GET /api/v1/policies/{…}/history

sovaria.policy.rollback

Rollback.

sovaria.policy.rollback(policyId: string, version: number): Promise<JsonObject>

Parameters

policyIdstringrequired
Policy id.
versionnumberrequired
Version number from history().
Returns
Promise<JsonObject>
HTTP
POST /api/v1/policies/{…}/rollback

sovaria.policy.simulate

Simulate.

sovaria.policy.simulate(splSource: string, context?: JsonObject = {}): Promise<JsonObject>

Parameters

splSourcestringrequired
The rule to try (not saved).
contextJsonObjectoptionaldefault {}
The request to evaluate: actor, action, resource, …
Returns
Promise<JsonObject>
HTTP
POST /api/v1/policies/simulate

Audit log

sovaria.audit.append

Append.

sovaria.audit.append(payload: JsonObject): Promise<JsonObject>

Parameters

payloadJsonObjectrequired
Returns
Promise<JsonObject>
HTTP
POST /api/v1/audit/

sovaria.audit.list

List.

sovaria.audit.list(
  query?: { actor_id?: string event_type?: string source?: string resource_id?: string limit?: number offset?: number },
): Promise<JsonValue>

Parameters

query{ actor_id?: string event_type?: string source?: string resource_id?: string limit?: number offset?: number }optional
Returns
Promise<JsonValue>
HTTP
GET /api/v1/audit/

sovaria.audit.verify

Verify.

sovaria.audit.verify(): Promise<JsonObject>
Returns
Promise<JsonObject> — Whether the hash chain is intact — every entry links to the previous one, so edits are detectable.
HTTP
GET /api/v1/audit/verify

sovaria.audit.count

Count.

sovaria.audit.count(): Promise<JsonObject>
Returns
Promise<JsonObject>
HTTP
GET /api/v1/audit/count

Related

JavaScript SDKConnect your app
Something unclear or missing on this page?Tell us