Graph-based entitlement enforcement

1 . A system for enforcing attribute level entitlements within a super-graph, the system comprising: a plurality of data providers that each store a graph comprising data products, wherein each data product includes entities and attributes describing the data product; an entitlement policy data repository that stores pre-enforcement entitlement policies and post-enforcement entitlement policies; a computing system implementing, via one or more processors, an entitlements enforcement plugin for an application programming interface (API) gateway of a graph API to: receive, from a client device, a graph query API call comprising a schema specifying a query operation to be performed, wherein the schema indicates a first entity associated with a first data provider to be queried and a second entity associated with a second data provider to be queried, the first entity comprising a first attribute and a second attribute; parse the schema to identify entitlement keywords, wherein the entitlement keywords indicate which of the pre-enforcement entitlement policies and post-enforcement entitlement policies to retrieve; retrieve, from the entity policy data repository, based on the client device and the entitlement keywords, a pre-enforcement entitlement policy to be applied to the schema prior to the graph query API call being provided to the graph API; responsive to applying the pre-enforcement entitlement policy to the schema to generate an entitled schema indicating that the client device is authorized to query the first entity and lacks authorization to query the second entity, provide an updated graph query API call comprising the entitled schema to the graph API; receive a response payload comprising first data associated with the first attribute and second data associated with the second attribute; retrieve, from the entitlement policy data repository, based on the client device and the entitlement keywords, a post-enforcement entitlement policy to be applied to the response payload prior to the response payload being provided to the client device; responsive to applying the post-enforcement entitlement policy to the response payload to generate an updated response payload comprising the first data, provide, to the client device, a response to the graph query API call comprising the updated response payload, wherein the post-enforcement entitlement policy prevents the second data from being provided to the client device.

2 . A method implemented by one or more processors of a computing system, the method comprising:

receiving, from a client device, at an application programming interface (API) gateway, a graph query API call comprising a schema specifying a query operation to be performed;

retrieving, based on the client device and the schema, a first entitlement policy to be applied to the graph query API call and a second entitlement policy to be applied to a response to the graph query API call;

providing, based on the first entitlement policy, an updated graph query API call comprising an entitled schema to a graph API via the API gateway, wherein the entitled schema authorizes querying of a first entity and prevents querying of a second entity;

receiving, at the API gateway, a response payload from the graph API comprising first data associated with a first attribute of the first entity and second data associated with a second attribute of the first entity; and

providing, based on the second entitlement policy, as the response to the graph query API call, to the client device, an updated response payload comprising the first data associated with the first attribute, wherein the second entitlement policy prevents the second data from being included in the updated response payload.

3 . The method of claim 2 , further comprising:

parsing the schema to identify schema keywords, wherein the schema keywords comprise text representing the query operation, the first entity and the second entity, and the first attribute and the second attribute; and

determining entitlement keywords corresponding to the schema keywords, wherein the first entitlement policy and the second entitlement policy are selected based on the entitlement keywords.

4 . The method of claim 2 , further comprising:

retrieving a list of entitlement keywords;

computing, for each schema keyword identified from the schema, a semantic similarity score between the schema keyword and each entitlement keyword from the list of entitlement keywords; and

selecting the first entitlement policy and the second entitlement policy based on the semantic similarity score of one or more schema keywords being greater than or equal to a threshold semantic similarity score.

5 . The method of claim 2 , further comprising:

determining, based on the schema, that the query operation includes a first sub-query directed to a first entity graph associated with the first entity and a second sub-query directed to a second entity graph associated with the second entity, wherein the first entitlement policy is applied to at least one of the first sub-query or the second sub-query.

6 . The method of claim 2 , further comprising:

determining, based on the schema, that the second attribute is represented by text corresponding to an entitlement keyword, wherein the second entitlement policy is applied to the second data based on the entitlement keyword.

7 . The method of claim 2 , wherein the client device is associated with an authorized account with the computing system, the method further comprises:

selecting at least one of the first entitlement policy or the second entitlement policy based on the authorized account.

8 . The method of claim 7 , wherein the authorized account is associated with a first user having first data access authorizations and a second user having second data access authorizations, wherein the first entitlement policy and the second entitlement policy are selected based on the first data access authorizations of the first user and the second data access authorizations of the second user.

9 . The method of claim 2 , further comprising:

receiving, from a plurality of client devices, at the API gateway, a plurality of graph query API calls including the graph query API call; and

determining, based on the schema, that the query operation requests secure information, wherein at least one of the first entitlement policy or the second entitlement policy is selected based on the query operations requesting the secure information.

10 . The method of claim 9 , further comprising:

preventing, based on the query operation requesting the secure information, the graph query API call from being provided to the graph API prior to application of the first entitlement policy; or

preventing, based on at least one of the first data or the second data including the secure information, the response to the graph query API call from being provided to the client device prior to application of the second entitlement policy.

11 . The method of claim 9 , further comprising:

providing, to the API gateway, each other graph query API call from the plurality of graph query API calls excluding the graph query API call, wherein the first entitlement policy is prevented from being applied to each other graph query API call.

12 . The method of claim 2 , further comprising:

applying the second entitlement policy to the response payload to generate the updated response payload, wherein the second data is prevented from being included in the updated response payload by obfuscating or removing the second data.

13 . The method of claim 2 , further comprising:

extracting, from a header of the graph query API call, a device identifier for the client device;

determining a device type of the client device based on the device identifier; and

selecting at least one of the first entitlement policy or the second entitlement policy based on the device type.

14 . The method of claim 2 , further comprising:

receiving, from the client device, at the API gateway, a graph API call comprising a separate schema specifying one or more non-query operations to be performed; and

preventing the graph API call from being provided to the graph API based on the separate schema specifying the one or more non-query operations to be performed.

15 . The method of claim 2 , wherein the entitled schema further authorizes a third entity to be queried, wherein providing the updated graph query API call comprises:

providing, via the graph API, a first sub-query to a first data provider associated with the first entity and a second sub-query to a second data provider associated with the third entity, wherein the query operation specifies the first sub-query for the first entity and the second sub-query for the third entity.

16 . The method of claim 15 , wherein receiving the response payload comprises:

creating a super-graph based on a first sub-graph, received from the first data provider, storing data associated with the first entity and a second sub-graph, received from the second data provider, storing data associated with the third entity, wherein the first data is retrieved from the super-graph.

17 . The method of claim 2 , further comprising:

receiving, from a data provider associated with the first entity, prior to receiving the graph query API call, a data provider schema specifying entities and attributes stored by a first sub-graph of the data provider; and

determining that the schema included in the graph query API call is formatted based on the data provider schema.

18 . The method of claim 2 , further comprising:

applying the second entitlement policy to the second attribute to prevent the second data from being included in the updated response payload based on an attribute type of the second attribute.

19 . The method of claim 2 , further comprising:

executing an entitlements enforcement plugin to the API gateway, wherein the entitlements enforcement plugin causes the first entitlement policy and the second entitlement policy to be applied.

20 . One or more non-transitory computer-readable media storing computer program instructions that, when executed by one or more processors, effectuate operations comprising:

receiving, from a client device, at an application programming interface (API) gateway, a graph query API call comprising a schema specifying a query operation to be performed;

retrieving, based on the client device and the schema, a first entitlement policy to be applied to the graph query API call and a second entitlement policy to be applied to a response to the graph query API call;

providing, based on the first entitlement policy, an updated graph query API call comprising entitled schema to a graph API via the API gateway, wherein the entitled schema authorizes querying of a first entity and prevents querying of a second entity;

receiving, at the API gateway, a response payload from the graph API comprising first data associated with a first attribute of the first entity and second data associated with a second attribute of the first entity; and

providing, based on the second entitlement policy, as the response to the graph query API call, to the client device, an updated response payload comprising the first data associated with the first attribute, wherein the second entitlement policy prevents the second data from being included in the updated response payload.