Mock RBAC and ABAC API

MOCK DATA

Generate explainable mock RBAC/ABAC decisions or evaluate one request against an explicit vendor-neutral fixture policy.

Generated test data for fixtures and development

Base URL: /api/access-control
Category: Developer Tools
Capabilities: 2 routes Seedable
Last updated: July 29, 2026

GET /api/access-control Generate explainable fictional access decisions Returns a list

Live requestRuns against the public API

No key required

GET/api/access-control?model=abac&role=editor&outcome=allow&asOf=2026-07-10T12%3A00%3A00.000Z&count=10&seed=42

Request parameters

modeldefault any

Pin RBAC or ABAC, or allow either fixture model.

roledefault any

Pin the synthetic subject role, or allow any.

resourcedefault any

Pin the requested resource type, or allow any.

actiondefault any

Pin the requested action, or allow any.

tenantStatedefault any

Pin active or suspended tenant context, or allow either.

ownsResource

Require resource ownership context to be true or false.

outcomedefault any

Return only combinations whose evaluated verdict matches this outcome.

windowDaysdefault 30

Elapsed decision-history window before asOf.

asOf

Replay anchor; defaults to the request clock and is echoed.

Advanced response options7 options

countdefault 10

How many records to generate (1–100).

seed

Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed).

fields

Return only these fields (comma-separated). Mutually exclusive with 'exclude'.

exclude

Return all fields except these (comma-separated).

formatdefault json

Response format: json envelope, ndjson (one record per line) or csv.

prettydefault false

Pretty-print the JSON response.

unwrapdefault false

Drop the envelope: return the raw array/object without data/meta wrapper.

Response

Example parameters are ready. Send the request to inspect the live response.

Route reference

Code, request parameters, response fields and verified examples 16 params · 10 fields · 2 examples

Code samples Ready-to-copy requests in 4 languages

curl JavaScript Python PHP

curl "https://randomapi.dev/api/access-control?model=abac&role=editor&outcome=allow&count=10&seed=42&asOf=2026-07-10T12%3A00%3A00.000Z"

const res = await fetch("https://randomapi.dev/api/access-control?model=abac&role=editor&outcome=allow&count=10&seed=42&asOf=2026-07-10T12%3A00%3A00.000Z");
const { data, meta } = await res.json();

import requests

data = requests.get("https://randomapi.dev/api/access-control?model=abac&role=editor&outcome=allow&count=10&seed=42&asOf=2026-07-10T12%3A00%3A00.000Z").json()["data"]

$json = json_decode(file_get_contents(
  "https://randomapi.dev/api/access-control?model=abac&role=editor&outcome=allow&count=10&seed=42&asOf=2026-07-10T12%3A00%3A00.000Z"
), true);
$data = $json["data"];

Parameters Route-specific request inputs 9

Parameter	Type	Default & allowed	Description
`model`	enum	default: any allowed: rbac \| abac \| any example: abac	Pin RBAC or ABAC, or allow either fixture model.
`role`	enum	default: any allowed: owner \| admin \| editor \| billing \| viewer \| any example: editor	Pin the synthetic subject role, or allow any.
`resource`	enum	default: any allowed: document \| project \| invoice \| deployment \| secret \| any example: document	Pin the requested resource type, or allow any.
`action`	enum	default: any allowed: read \| create \| update \| delete \| approve \| manage \| any example: delete	Pin the requested action, or allow any.
`tenantState`	enum	default: any allowed: active \| suspended \| any example: active	Pin active or suspended tenant context, or allow either.
`ownsResource`	boolean	example: true	Require resource ownership context to be true or false.
`outcome`	enum	default: any allowed: allow \| deny \| any example: allow	Return only combinations whose evaluated verdict matches this outcome.
`windowDays`	int	default: 30 allowed: 1 – 90 example: 14	Elapsed decision-history window before asOf.
`asOf`	date	example: 2026-07-10T12:00:00.000Z	Replay anchor; defaults to the request clock and is echoed.

model enum

Pin RBAC or ABAC, or allow either fixture model.

default: any

allowed: rbac | abac | any

example: model=abac

role enum

Pin the synthetic subject role, or allow any.

default: any

example: role=editor

resource enum

Pin the requested resource type, or allow any.

default: any

example: resource=document

action enum

Pin the requested action, or allow any.

default: any

example: action=delete

tenantState enum

Pin active or suspended tenant context, or allow either.

default: any

allowed: active | suspended | any

example: tenantState=active

ownsResource boolean

Require resource ownership context to be true or false.

example: ownsResource=true

outcome enum

Return only combinations whose evaluated verdict matches this outcome.

default: any

allowed: allow | deny | any

example: outcome=allow

windowDays int

Elapsed decision-history window before asOf.

default: 30

allowed: 1 – 90

example: windowDays=14

asOf date

Replay anchor; defaults to the request clock and is echoed.

example: asOf=2026-07-10T12:00:00.000Z

Universal parameters Shared response and formatting options 7

Parameter	Type	Default & allowed	Description
`count`	int	default: 10 allowed: 1 – 100 example: 3	How many records to generate (1–100).
`seed`	int	example: 42	Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed).
`fields`	list	example: id,model	Return only these fields (comma-separated). Mutually exclusive with 'exclude'.
`exclude`	list	example: evaluatedAt	Return all fields except these (comma-separated).
`format`	enum	default: json allowed: json \| ndjson \| csv example: csv	Response format: json envelope, ndjson (one record per line) or csv.
`pretty`	boolean	default: false example: true	Pretty-print the JSON response.
`unwrap`	boolean	default: false example: true	Drop the envelope: return the raw array/object without data/meta wrapper.

count int

How many records to generate (1–100).

default: 10

allowed: 1 – 100

example: count=3

seed int

Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed).

example: seed=42

fields list

Return only these fields (comma-separated). Mutually exclusive with 'exclude'.

example: fields=id,model

exclude list

Return all fields except these (comma-separated).

example: exclude=evaluatedAt

format enum

Response format: json envelope, ndjson (one record per line) or csv.

default: json

allowed: json | ndjson | csv

example: format=csv

pretty boolean

Pretty-print the JSON response.

default: false

example: pretty=true

unwrap boolean

Drop the envelope: return the raw array/object without data/meta wrapper.

default: false

example: unwrap=true

Response schema Fields returned in each record 10

Field	Type	Description	Example
`id`	string	Distinct fictional decision ID.	decision_fixture_0_a12b34c56d78
`model`	string	rbac \| abac fixture policy model.	rbac
`subject`	object	Synthetic subject ID and role.	{"id":"subject_fixture_1","role":"editor"}
`resource`	object	Synthetic resource ID, type and ownership context.	{"id":"document_fixture_1","type":"document","ownedBySubject":true}
`action`	string	Requested fixture action.	update
`tenantState`	string	active \| suspended context.	active
`outcome`	string	allow \| deny, derived from the documented fixture policy.	allow
`reasonCode`	string	Stable explanation code matching the verdict.	role_permission
`matchedRules`	object[]	Bounded policy rules that explain the verdict.	[{"id":"role-editor","effect":"allow","description":"Role editor grants update on document."}]
`evaluatedAt`	string (ISO 8601)	Decision time at or before the replay anchor.	2026-07-10T12:00:00.000Z

id string

Distinct fictional decision ID.

example: decision_fixture_0_a12b34c56d78

model string

rbac | abac fixture policy model.

example: rbac

subject object

Synthetic subject ID and role.

example: {"id":"subject_fixture_1","role":"editor"}

resource object

Synthetic resource ID, type and ownership context.

example: {"id":"document_fixture_1","type":"document","ownedBySubject":true}

action string

Requested fixture action.

example: update

tenantState string

active | suspended context.

example: active

outcome string

allow | deny, derived from the documented fixture policy.

example: allow

reasonCode string

Stable explanation code matching the verdict.

example: role_permission

matchedRules object[]

Bounded policy rules that explain the verdict.

example: [{"id":"role-editor","effect":"allow","description":"Role editor grants update on document."}]

evaluatedAt string (ISO 8601)

Decision time at or before the replay anchor.

example: 2026-07-10T12:00:00.000Z

Documented examples

Build-generated requests and complete responses 2

Allowed editor decisions /api/access-control?model=abac&role=editor&outcome=allow&count=10&seed=42&asOf=2026-07-10T12%3A00%3A00.000Z

GET /api/access-control?model=abac&role=editor&outcome=allow&count=10&seed=42&asOf=2026-07-10T12%3A00%3A00.000Z

{
  "data": [
    {
      "id": "decision_fixture_0_958016cfb6a5",
      "model": "abac",
      "subject": {
        "id": "subject_fixture_0_958016cfb6a5",
        "role": "editor"
      },
      "resource": {
        "id": "project_fixture_0_958016cfb6a5",
        "type": "project",
        "ownedBySubject": false
      },
      "action": "read",
      "tenantState": "active",
      "outcome": "allow",
      "reasonCode": "role_permission",
      "matchedRules": [
        {
          "id": "role-editor",
          "effect": "allow",
          "description": "Role editor grants read on project."
        }
      ],
      "evaluatedAt": "2026-06-30T19:37:32.660Z"
    },
    {
      "id": "decision_fixture_1_78f248abeccb",
      "model": "abac",
      "subject": {
        "id": "subject_fixture_1_78f248abeccb",
        "role": "editor"
      },
      "resource": {
        "id": "document_fixture_1_78f248abeccb",
        "type": "document",
        "ownedBySubject": false
      },
      "action": "read",
    …
    "generatedAt": "2026-07-29T08:13:22.000Z"
  }
}

Suspended-tenant denials /api/access-control?tenantState=suspended&outcome=deny&count=8&seed=17&asOf=2026-07-10T12%3A00%3A00.000Z

GET /api/access-control?tenantState=suspended&outcome=deny&count=8&seed=17&asOf=2026-07-10T12%3A00%3A00.000Z

{
  "data": [
    {
      "id": "decision_fixture_0_755abf24f732",
      "model": "abac",
      "subject": {
        "id": "subject_fixture_0_755abf24f732",
        "role": "owner"
      },
      "resource": {
        "id": "document_fixture_0_755abf24f732",
        "type": "document",
        "ownedBySubject": false
      },
      "action": "approve",
      "tenantState": "suspended",
      "outcome": "deny",
      "reasonCode": "tenant_suspended",
      "matchedRules": [
        {
          "id": "tenant-active-required",
          "effect": "deny",
          "description": "Suspended tenants deny every fixture action."
        }
      ],
      "evaluatedAt": "2026-06-25T18:54:54.698Z"
    },
    {
      "id": "decision_fixture_1_cb87eea1d421",
      "model": "abac",
      "subject": {
        "id": "subject_fixture_1_cb87eea1d421",
        "role": "editor"
      },
      "resource": {
        "id": "deployment_fixture_1_cb87eea1d421",
        "type": "deployment",
        "ownedBySubject": true
      },
      "action": "approve",
    …
    "generatedAt": "2026-07-29T08:13:22.000Z"
  }
}

GET /api/access-control/evaluate Evaluate one request against the documented fixture policy Computed answer

Live requestRuns against the public API

No key required

GET

/api/access-control/evaluate?model=abac&role=editor&resource=document&action=delete&ownsResource=true&asOf=2026-07-10T12%3A00%3A00.000Z

Request parameters

modeldefault rbac

Use the documented RBAC or ABAC fixture model.

rolerequired

Synthetic subject role.

resourcerequired

Synthetic resource type.

actionrequired

Action to evaluate.

tenantStatedefault active

Active or suspended tenant context.

ownsResourcedefault false

Whether the synthetic subject owns this resource.

asOf

Decision timestamp; defaults to request time and is echoed.

Advanced response options4 options

fields

Return only these fields (comma-separated). Mutually exclusive with 'exclude'.

exclude

Return all fields except these (comma-separated).

prettydefault false

Pretty-print the JSON response.

unwrapdefault false

Drop the envelope: return the raw array/object without data/meta wrapper.

Response

Example parameters are ready. Send the request to inspect the live response.

Route reference

Code, request parameters, response fields and verified examples 11 params · 10 fields · 2 examples

Code samples Ready-to-copy requests in 4 languages

curl JavaScript Python PHP

curl "https://randomapi.dev/api/access-control/evaluate?model=abac&role=editor&resource=document&action=delete&ownsResource=true&asOf=2026-07-10T12%3A00%3A00.000Z"

const res = await fetch("https://randomapi.dev/api/access-control/evaluate?model=abac&role=editor&resource=document&action=delete&ownsResource=true&asOf=2026-07-10T12%3A00%3A00.000Z");
const { data, meta } = await res.json();

import requests

data = requests.get("https://randomapi.dev/api/access-control/evaluate?model=abac&role=editor&resource=document&action=delete&ownsResource=true&asOf=2026-07-10T12%3A00%3A00.000Z").json()["data"]

$json = json_decode(file_get_contents(
  "https://randomapi.dev/api/access-control/evaluate?model=abac&role=editor&resource=document&action=delete&ownsResource=true&asOf=2026-07-10T12%3A00%3A00.000Z"
), true);
$data = $json["data"];

Parameters Route-specific request inputs 7

Parameter	Type	Default & allowed	Description
`model`	enum	default: rbac allowed: rbac \| abac example: abac	Use the documented RBAC or ABAC fixture model.
`role` required	enum	allowed: owner \| admin \| editor \| billing \| viewer example: editor	Synthetic subject role.
`resource` required	enum	allowed: document \| project \| invoice \| deployment \| secret example: document	Synthetic resource type.
`action` required	enum	allowed: read \| create \| update \| delete \| approve \| manage example: delete	Action to evaluate.
`tenantState`	enum	default: active allowed: active \| suspended example: active	Active or suspended tenant context.
`ownsResource`	boolean	default: false example: true	Whether the synthetic subject owns this resource.
`asOf`	date	example: 2026-07-10T12:00:00.000Z	Decision timestamp; defaults to request time and is echoed.

model enum

Use the documented RBAC or ABAC fixture model.

default: rbac

allowed: rbac | abac

example: model=abac

role enum required

Synthetic subject role.

allowed: owner | admin | editor | billing | viewer

example: role=editor

resource enum required

Synthetic resource type.

allowed: document | project | invoice | deployment | secret

example: resource=document

action enum required

Action to evaluate.

example: action=delete

tenantState enum

Active or suspended tenant context.

default: active

allowed: active | suspended

example: tenantState=active

ownsResource boolean

Whether the synthetic subject owns this resource.

default: false

example: ownsResource=true

asOf date

Decision timestamp; defaults to request time and is echoed.

example: asOf=2026-07-10T12:00:00.000Z

Universal parameters Shared response and formatting options 4

Parameter	Type	Default & allowed	Description
`fields`	list	example: id,model	Return only these fields (comma-separated). Mutually exclusive with 'exclude'.
`exclude`	list	example: evaluatedAt	Return all fields except these (comma-separated).
`pretty`	boolean	default: false example: true	Pretty-print the JSON response.
`unwrap`	boolean	default: false example: true	Drop the envelope: return the raw array/object without data/meta wrapper.

fields list

Return only these fields (comma-separated). Mutually exclusive with 'exclude'.

example: fields=id,model

exclude list

Return all fields except these (comma-separated).

example: exclude=evaluatedAt

pretty boolean

Pretty-print the JSON response.

default: false

example: pretty=true

unwrap boolean

Drop the envelope: return the raw array/object without data/meta wrapper.

default: false

example: unwrap=true

Response schema Fields returned in each record 10

Field	Type	Description	Example
`id`	string	Distinct fictional decision ID.	decision_fixture_0_a12b34c56d78
`model`	string	rbac \| abac fixture policy model.	rbac
`subject`	object	Synthetic subject ID and role.	{"id":"subject_fixture_1","role":"editor"}
`resource`	object	Synthetic resource ID, type and ownership context.	{"id":"document_fixture_1","type":"document","ownedBySubject":true}
`action`	string	Requested fixture action.	update
`tenantState`	string	active \| suspended context.	active
`outcome`	string	allow \| deny, derived from the documented fixture policy.	allow
`reasonCode`	string	Stable explanation code matching the verdict.	role_permission
`matchedRules`	object[]	Bounded policy rules that explain the verdict.	[{"id":"role-editor","effect":"allow","description":"Role editor grants update on document."}]
`evaluatedAt`	string (ISO 8601)	Decision time at or before the replay anchor.	2026-07-10T12:00:00.000Z

id string

Distinct fictional decision ID.

example: decision_fixture_0_a12b34c56d78

model string

rbac | abac fixture policy model.

example: rbac

subject object

Synthetic subject ID and role.

example: {"id":"subject_fixture_1","role":"editor"}

resource object

Synthetic resource ID, type and ownership context.

example: {"id":"document_fixture_1","type":"document","ownedBySubject":true}

action string

Requested fixture action.

example: update

tenantState string

active | suspended context.

example: active

outcome string

allow | deny, derived from the documented fixture policy.

example: allow

reasonCode string

Stable explanation code matching the verdict.

example: role_permission

matchedRules object[]

Bounded policy rules that explain the verdict.

example: [{"id":"role-editor","effect":"allow","description":"Role editor grants update on document."}]

evaluatedAt string (ISO 8601)

Decision time at or before the replay anchor.

example: 2026-07-10T12:00:00.000Z

Documented examples

Build-generated requests and complete responses 2

ABAC-owned delete

 /api/access-control/evaluate?model=abac&role=editor&resource=document&action=delete&ownsResource=true&asOf=2026-07-10T12%3A00%3A00.000Z

GET /api/access-control/evaluate?model=abac&role=editor&resource=document&action=delete&ownsResource=true&asOf=2026-07-10T12%3A00%3A00.000Z

{
  "data": {
    "id": "decision_fixture_ef15e625",
    "model": "abac",
    "subject": {
      "id": "subject_fixture_ef15e625",
      "role": "editor"
    },
    "resource": {
      "id": "document_fixture_ef15e625",
      "type": "document",
      "ownedBySubject": true
    },
    "action": "delete",
    "tenantState": "active",
    "outcome": "allow",
    "reasonCode": "owner_condition",
    "matchedRules": [
      {
        "id": "editor-owned-delete",
        "effect": "allow",
        "description": "ABAC permits editors to delete their own document or project."
      }
    ],
    "evaluatedAt": "2026-07-10T12:00:00.000Z"
  },
  "meta": {
    "endpoint": "access-control",
    "route": "/evaluate",
    "params": {
      "model": "abac",
      "role": "editor",
      "resource": "document",
      "action": "delete",
      "tenantState": "active",
      "ownsResource": true,
      "asOf": "2026-07-10T12:00:00.000Z"
    },
    "generatedAt": "2026-07-29T08:13:22.000Z"
  }
}

Suspended owner denial

 /api/access-control/evaluate?model=rbac&role=owner&resource=project&action=manage&tenantState=suspended&asOf=2026-07-10T12%3A00%3A00.000Z

GET /api/access-control/evaluate?model=rbac&role=owner&resource=project&action=manage&tenantState=suspended&asOf=2026-07-10T12%3A00%3A00.000Z

{
  "data": {
    "id": "decision_fixture_1212defc",
    "model": "rbac",
    "subject": {
      "id": "subject_fixture_1212defc",
      "role": "owner"
    },
    "resource": {
      "id": "project_fixture_1212defc",
      "type": "project",
      "ownedBySubject": false
    },
    "action": "manage",
    "tenantState": "suspended",
    "outcome": "deny",
    "reasonCode": "tenant_suspended",
    "matchedRules": [
      {
        "id": "tenant-active-required",
        "effect": "deny",
        "description": "Suspended tenants deny every fixture action."
      }
    ],
    "evaluatedAt": "2026-07-10T12:00:00.000Z"
  },
  "meta": {
    "endpoint": "access-control",
    "route": "/evaluate",
    "params": {
      "model": "rbac",
      "role": "owner",
      "resource": "project",
      "action": "manage",
      "tenantState": "suspended",
      "ownsResource": false,
      "asOf": "2026-07-10T12:00:00.000Z"
    },
    "generatedAt": "2026-07-29T08:13:22.000Z"
  }
}

About this API

Coverage, behavior and common use cases

Coverage & behavior

Provides fictional access-control decisions for permission tables, denial messages and authorization audit interfaces. The complete fixture policy is deliberately small:

a suspended tenant denies every action;
a secret denies every non-owner/non-admin role;
owner and admin allow every resource/action while the tenant is active;
viewer allows read on every non-secret resource;
billing allows read, approve and manage on invoices only;
editor allows read, create and update on documents/projects, plus read on deployments;
the ABAC model additionally lets an editor delete a document/project they own;
every other combination follows default deny.

Explicit tenant/secret denials run before allows. Generated decisions select only combinations that satisfy every requested filter—including outcome; impossible combinations return 400 with all resolved filter values instead of falsifying a verdict.

This endpoint is mock test data, not security guidance and not an authorization service. The /evaluate policy verdict is deterministic from its explicit policy inputs and needs no seed; its evaluatedAt timestamp defaults to the request clock when asOf is omitted, and the resolved anchor is echoed for replay.

Use it for

Populate role, permission and access-decision administration screens
Test allow, default-deny, suspended-tenant and secret-resource branches
Create explainable authorization audit fixtures without production identities

Frequently asked questions

Practical answers about this endpoint 3

Is this a production authorization service?

No. It is a deliberately small, vendor-neutral fixture policy for tests and demos, with every rule documented on this page.

Does an explicit denial override role permissions?

Yes. Suspended tenants and restricted secret resources are evaluated before allow rules; everything else defaults to deny when no allow matches.

Can generated records be filtered by outcome?

Yes. The generator selects only policy inputs that truly produce the requested allow or deny verdict, and rejects impossible pinned combinations.

Useful next tools in the catalog

Fake Authentication Session API MOCK DATA

Generate coherent fake authentication sessions and login attempts with exact expiry, revocation, MFA, risk and outcome states.

Fake Audit Log API MOCK DATA

Generate coherent fake audit records for authentication, CRUD and permission changes — safely seeded, filterable and bounded by time.

Mock Feature Flag Data API MOCK DATA

Generate coherent mock feature-flag configurations and rollout evaluations with lifecycle states, weighted variants and safe contexts.

Random User Data API MOCK DATA

Complete fake people — name, age-consistent birth date, email, phone, job and address — with working filters for gender, age range and email domain.

Mock Pagination API MOCK DATA

Deterministic offset and opaque-cursor pagination fixtures with exact totals, stable sorting and no duplicated or skipped records.

GET /api/access-control Generate explainable fictional access decisions Returns a list

Request parameters

Response

Route reference

Documented examples

GET /api/access-control/evaluate Evaluate one request against the documented fixture policy Computed answer

Request parameters

Response

Route reference

Documented examples

About this API

Coverage & behavior

Use it for

Frequently asked questions

Related APIs