33 resources found
Set Up IndyKite Environment: Project, Application, and Credentials
Create the foundational IndyKite environment components required before using any IndyKite product. This includes creating a project, application, application agent, credentials, and token introspect configuration.
Ingest Data into the IndyKite Knowledge Graph (IKG)
Add nodes (entities) and relationships to the IndyKite Knowledge Graph using the Capture API. This is the foundation for all graph-based queries and authorization.
ContX IQ: Query License Numbers a Person Can Access
Query the IndyKite Knowledge Graph (IKG) to retrieve all vehicle license numbers that a specific person is authorized to view based on their contractual relationships.
ContX IQ: Retrieve Payment Methods for Contracted Vehicle Users
Query the IndyKite Knowledge Graph to list all payment methods belonging to people who have active contracts for vehicles. This demonstrates linking an Application to graph data and querying through authorized relationships.
ContX IQ: Grant Unrestricted READ Access to a Node Category
Create a policy that allows any authenticated request to READ all nodes of a specific type (e.g., all LicenseNumber nodes) without requiring relationship-based authorization.
ContX IQ: Create Nodes and Relationships via Authorized Write Query
Demonstrates how to create new Contract nodes and relationships (COVERS, ACCEPTED) through an authorized ContX IQ write query. The Application can only create contracts for vehicles owned by companies it has agreements with.
ContX IQ: Upsert Relationships Between Existing Nodes
Create or update (upsert) relationships between existing nodes in the graph. This example demonstrates using the allowed_upserts.relationships policy directive to authorize ACCEPTED relationships between Person and Contract nodes.
ContX IQ: Delete Nodes and Their Relationships via Authorized Query
Demonstrates authorized node deletion in the IndyKite Knowledge Graph. When a node is deleted, all its relationships are automatically removed. This example shows deleting Contract nodes for a specific Person.
ContX IQ: Loyalty Program - Retrieve Payment Method from License Plate
Real-world loyalty program scenario: Given a vehicle's license plate number, retrieve the credit card associated with an authorized user. Demonstrates multi-condition authorization with consent validation and loyalty plan membership checks.
KBAC: Relationship-Based Authorization with authZEN API
Create a Knowledge-Based Access Control (KBAC) policy and execute authZEN-compliant authorization queries. This example demonstrates evaluation (can X do Y to Z?) and search operations (who can? what can? which resources?).
KBAC: Batch Authorization with Multiple Evaluations (Boxcarring)
Evaluate multiple authorization decisions in a single API call using the authZEN Access Evaluations endpoint. This pattern, known as 'boxcarring', reduces network overhead when checking many permissions at once.
KBAC: Step-Up Authentication Advice in Authorization Responses
Demonstrates authZEN 'advice' - when authorization is denied due to insufficient authentication level, the response includes guidance on what authentication step-up is needed to gain access.
Token Introspect: Link External Identity Tokens to Graph Nodes
Configure Token Introspect to validate external identity tokens (e.g., Auth0, Okta) and automatically link them to Person nodes in the knowledge graph via _SAME_AS relationships.
ContX IQ: Connect System Nodes (_Application) to Business Data
Learn how to link auto-generated system nodes (_Application, _AppAgent) to your business data in the knowledge graph. This is essential for using the Application as an authorized subject in ContX IQ queries.
ContX IQ: Complete CRUD Workflow with _Application as Subject
Comprehensive example showing how an Application can read resources, create relationships to those resources, and then create new nodes. Demonstrates progressive authorization as the graph structure changes.
ContX IQ: Role-Based Access Control with User Tokens and Organizations
Advanced scenario using user access tokens as subjects for role-based authorization. Members can read Events, Admins can create Events. Demonstrates Token Introspect integration with ContX IQ policies.
ContX IQ: User Consent Management - Grant and Revoke Payment Access
Demonstrates user-controlled consent workflows where a Person can authorize a Company to access their payment method, and later revoke that access. Uses user tokens as subjects for self-service data governance.
ContX IQ: Step-Up Authentication Based on auth_time Claim
Enforce re-authentication for sensitive operations by checking the token's auth_time claim. If the user authenticated more than one hour ago, return an advice requesting fresh authentication.
ContX IQ: Step-Up Authentication Based on Token Issue Time (iat Claim)
Enforce token freshness by checking the iat (issued at) claim. If the token was issued more than one hour ago, return an advice requesting a new token. Different from auth_time - this checks token age, not authentication age.
ContX IQ: Query External Data Sources via Data Resolver
Demonstrates fetching data from external systems (APIs, databases) during ContX IQ query execution. The External Data Resolver retrieves information not stored in the IKG, combining graph data with real-time external lookups.
Outbound Events: Configure Kafka Event Streaming
Set up real-time event streaming from IndyKite to Kafka (Confluent). Receive notifications when graph data changes, configurations are modified, or specific actions occur.
Outbound Events: Stream Graph Data Changes to Kafka
Configure event streaming for Knowledge Graph changes. Receive real-time notifications when specific node types are created, updated, or deleted. Filter by node labels and properties.
Outbound Events: Stream to Azure Event Grid
Configure event streaming to Azure Event Grid for serverless event processing. Trigger Azure Functions, Logic Apps, or other Azure services when graph data changes.
Outbound Events: Stream to Azure Service Bus
Configure event streaming to Azure Service Bus for enterprise messaging patterns. Enable reliable message delivery with queues and topics for decoupled, scalable architectures.
ContX IQ: Manage Node Property Metadata
Add, update, and query metadata on node properties. Metadata provides additional context like timestamps, sources, confidence scores, or audit information for individual property values.
ContX IQ: Delete Node Properties and Relationship Properties
Demonstrates granular delete operations: delete entire nodes, specific properties from nodes, and specific properties from relationships. Useful for data cleanup, GDPR right-to-erasure, and selective data removal.
ContX IQ: Application as Service - Create Person Linked to Multiple Nodes
Demonstrates service-to-service data creation where an Application (not a user) creates new Person nodes and links them to existing Country and Company nodes. Common pattern for system integrations and automated data pipelines.
ContX IQ: Wildcard Property Retrieval - Fetch All Properties
Use wildcard syntax to retrieve all properties of a node or relationship without explicitly listing each one. Simplifies queries when you need complete data snapshots or don't know all property names in advance.
ContX IQ: Retrieve All Directly Connected Nodes for a User
Query all nodes that have a direct relationship with a specified User node, regardless of relationship type or direction. Useful for user profile views, data export, or understanding a user's complete data footprint.
ContX IQ: Filter Data Using IN Array Operator with User Subject
Query Contract nodes using the IN operator to filter by array values in policy conditions. Demonstrates how to check if a value exists within an array property during authorization.
ContX IQ: Aggregate Data Using WHERE, WITH, and COUNT Operators
Demonstrates advanced Cypher query patterns including WHERE filtering, WITH for intermediate results, and COUNT for aggregation. Returns Person data with contract counts.
ContX IQ: Check Resource Availability Using OPTIONAL MATCH and CASE Expression
Demonstrates OPTIONAL MATCH for pattern matching that doesn't fail when no match exists, combined with CASE expressions for conditional logic. Example: Check if a subdomain is available for registration.
MCP Server: Initialize Sessions and Execute Tools via HTTP
Demonstrates how to interact with the IndyKite MCP (Model Context Protocol) server using HTTP requests. Covers session initialization, listing resources and tools, and executing authorization queries through MCP tools.