Product Tour

Website

Formal Documentation

API Reference

Console

Support

Refresh Webhook Token

`Any` contains an arbitrary serialized protocol buffer message along with a
URL that describes the type of the serialized message.

Protobuf library provides support to pack/unpack Any values in the form
of utility functions or additional generated methods of the Any type.

Example 1: Pack and unpack a message in C++.

    Foo foo = ...;
    Any any;
    any.PackFrom(foo);
    ...
    if (any.UnpackTo(&foo)) {
      ...
    }

Example 2: Pack and unpack a message in Java.

    Foo foo = ...;
    Any any = Any.pack(foo);
    ...
    if (any.is(Foo.class)) {
      foo = any.unpack(Foo.class);
    }
    // or ...
    if (any.isSameTypeAs(Foo.getDefaultInstance())) {
      foo = any.unpack(Foo.getDefaultInstance());
    }

Example 3: Pack and unpack a message in Python.

    foo = Foo(...)
    any = Any()
    any.Pack(foo)
    ...
    if any.Is(Foo.DESCRIPTOR):
      any.Unpack(foo)
      ...

Example 4: Pack and unpack a message in Go

     foo := &pb.Foo{...}
     any, err := anypb.New(foo)
     if err != nil {
       ...
     }
     ...
     foo := &pb.Foo{}
     if err := any.UnmarshalTo(foo); err != nil {
       ...
     }

The pack methods provided by protobuf library will by default use
'type.googleapis.com/full.type.name' as the type URL and the unpack
methods only use the fully qualified type name after the last '/'
in the type URL, for example "foo.bar.com/x/y.z" will yield type
name "y.z".

JSON

The JSON representation of an `Any` value uses the regular
representation of the deserialized, embedded message, with an
additional field `@type` which contains the type URL. Example:

    package google.profile;
    message Person {
      string first_name = 1;
      string last_name = 2;
    }

    {
      "@type": "type.googleapis.com/google.profile.Person",
      "firstName": <string>,
      "lastName": <string>
    }

If the embedded message type is well-known and has a custom JSON
representation, that representation will be embedded adding a field
`value` which holds the custom JSON in addition to the `@type`
field. Example (for message [google.protobuf.Duration][]):

    {
      "@type": "type.googleapis.com/google.protobuf.Duration",
      "value": "1.212s"
    }

A URL/resource name that uniquely identifies the type of the serialized
protocol buffer message. This string must contain at least
one "/" character. The last segment of the URL's path must represent
the fully qualified name of the type (as in
`path/google.protobuf.Duration`). The name should be in a canonical form
(e.g., leading "." is not accepted).

In practice, teams usually precompile into the binary all types that they
expect it to use in the context of Any. However, for URLs which use the
scheme `http`, `https`, or no scheme, one can optionally set up a type
server that maps type URLs to message definitions as follows:

* If no scheme is provided, `https` is assumed.
* An HTTP GET on the URL must yield a [google.protobuf.Type][]
  value in binary format, or produce an error.
* Applications are allowed to cache lookup results based on the
  URL, or have them precompiled into a binary to avoid any
  lookup. Therefore, binary compatibility needs to be preserved
  on changes to types. (Use versioned type names to manage
  breaking changes.)

Note: this functionality is not currently available in the official
protobuf release, and it is not used for type URLs beginning with
type.googleapis.com.

Schemes other than `http`, `https` (or the empty scheme) might be
used with implementation specific semantics.

ApiKeyAuth

Getting started with Formal

What is the technical architecture of Formal?

Formal's Architecture

Formal's Terminology

Introduction

Native users

How customers can deploy and manage Formal Connector?

What is the recommended infrastructure to run Formal Connector?

Recommended infrastructure

How customers can configure their Formal Connector?

Configuration

How can you setup TLS configuration on your Connectors?

TLS Configuration

What are the environment variables configurable on the Connectors?

Environment variables

What is required to run Formal Connectors?

Requirements

Deploy Formal Connector via Terraform

Formal Postgres Sidecar enables your team to streamline access and control of Postgres databases.

Formal Postgres Sidecar

Formal S3 Sidecar enables your team to streamline access and control for any AWS S3 buckets.

Formal S3 Sidecar

Formal SSH Sidecar enables your team to streamline access and control for any instances that support an SSH connection or the AWS SSM protocol (like EC2 or AWS Fargate).

Formal SSH Sidecar

Formal HTTP Sidecar enables your team to streamline access and control for any external or internal API.

Formal HTTP Sidecar

Formal Snowflake Sidecar enables you to protect Snowflake computing data warehouse.

Formal Snowflake Sidecar

Formal Dynamo Sidecar is designed to protect your DynamoDB databases.

Formal Dynamo Sidecar

Formal Kubernetes Sidecar enables your team to streamline access and control for any Kubernetes cluster.

Formal Kubernetes Sidecar

What are the versions of Formal Sidecars?

Sidecars versions

How to deploy and manage Formal Satellites?

Deploy Formal Satellites with the right environment

Deployment

Learn how to configure user permissions for Formal applications using Open Policy Agent.

Application Permission System

Formal has a Chrome Extension to propagate identity on web applications.

Chrome Extension

Formal has a Desktop App to 10x developer experience.

Commands available on Formal Desktop App installed via the App Store.

App Store

Commands available on Formal Desktop App installed outside of the App Store.

Non App Store

You can provision Formal Resources using Terraform with the [Formal Terraform Provider](https://registry.terraform.io/providers/formalco/formal/2.0.4).

Using Terraform

When a policy is triggered, Formal has built a notification system to keep you informed.

How to receive alert of triggered policies?

Formal allows you to assign specific data domains to designated teams or users within your organization.

How to assign data domains to specific teams or users?

Formal allows you to use your own encryption key for data encryption.

How to encrypt data with a custom encryption key?

Formal offers three distinct methods for configuring the password of a native user.

Different methods for setting native users' passwords

Formal gives security and data teams end-to-end visibility on data consumption on BI applications and internal dashboards.

How to extract user identity from BI applications?

Formal Sidecars support IAM RDS Authentication for connecting to RDS instances, offering a secure alternative to password authentication.

How to set up IAM RDS Authentication to connect to a Sidecar?

Formal supports the masking of JSON Object.

How to mask data in JSON Object?

Formal Desktop App supports DNS filtering, enabling you to enforce that users cannot connect directly to databases.

How to enforce MFA Sessions on Formal Sidecars?

Formal Connector is a single proxy that can forward requests to any technology.

How to migrate from Formal Sidecar to Formal Connector?

Formal enables your teams to find, understand and trust your data.

Discovery

Observability

How users can access Formal Sidecars using Formal credentials?

Access

Logs

How can you monitor Users sessions in real-time?

Sessions

Api Keys

Resources

Sidecars

Spaces

Users

Groups

Satellites

How to manage Formal Policy Data Loaders?

Policy Data Loaders

How to integrate your SSO provider with Formal?

How to synchronize your organization's directory with Formal?

Directory Sync

Termination Protection

How does Formal integrate with your cloud provider?

Cloud Account

How does Formal integrate with BI applications?

BI Applications

How does Formal manage the encryption keys used to encrypt data?

Encryption Keys

How to export your Formal logs to your SIEM?

SIEM

Datahub

How Formal helps you evaluate impact of database migration?

Github

How to connect your Slack workspace to Formal?

Slack

Create Satellite

Delete Satellite

Get Satellite's API Key

Get Satellite

List Satellites

Update Satellite

Cancel a session

Get a session

Get session transcript

List of sessions

Create Resource

Delete Resource

Get Resource

List Resources

Update Resource

Create Sidecar

Create a link between a Resource and a Sidecar

Create Resource Link

Delete Sidecar

Delete the link between a resource and a sidecar

Delete Resource Link

Get Sidecar Api Key

Get Sidecar

Get a link between a Resource and a Sidecar

Get Resource Link

List all Resources linked to a Sidecar by Sidecar id

List Resource Link

List Sidecars

Update Sidecar

Get Aggregation

Get Log

Get SSH Data

Get SSH Events

List Logs

List Logs V2

List Logs V3

Create Datahub Integration

Delete Datahub Integration

Get Datahub Integration

Update Datahub Integration

Create Group

Delete Group

Get Group

Link Users to Group

List Groups

Unlink Users from Group

Update Group

Create Integration MFA

Delete Integration MFA

Get Integration MFA

List Integration MFAs

Create Data Domain

Create Inventory Object

Create Inventory Tag

Delete Data Domain

Delete Inventory Object

Delete Inventory Tag

Get Data Domain

Get Inventory

Get Inventory Flat

Get Inventory Hierarchical

Get Inventory Object

List Data Domains

List Inventory Metrics

List Inventory Tags

Update Column

Update Data Domain

Update Inventory Object Tags

Create Native User

Create a link between a Native User and an Identity

Create Native User Link

Delete Native User

Delete a link between a Native User and an Identity

Delete Native User Link

Get Native User

Get a link between a Native User and an Identity

Get Native User Link

List Native Users

Update Native User

Update a link between a Native User and an Identity

Update Native User Link

Create Policy

Delete Policy

Dry Run Policies

Evaluate Policy Validity

Get Policy

Generate a Policy based on a name and description

API Documentation

Satellite Service

Session Service

Resource Service

Sidecar Service

Audit Service

Datahub Service

Group Service

Integration MFA Service

Inventory Service

Native User Service

Policy Service

Refresh Webhook Token

Authorizations

Body

Response