decern — Python client

Website · Repository · Commands · Issues

Ask whether an action is allowed, and get an answer somebody can check afterwards. Standard library only — no requests, no httpx. Python ≥ 3.11.

uv add decern
# and a server to ask:
cargo install decern-server && decern-serve --trust-proxy

from decern import Client

c = Client("http://127.0.0.1:8080")  # optionally: token="…"

d = c.evaluate(
    subject={"type": "Principal", "id": "corp"},
    action="Read",  # or {"name": "Read"}
    resource={"type": "Resource", "id": "claim1"},
)

d.allowed   # True / False
d.reasons   # the policies that decided it, on allow
d.errors    # why not, on deny

When token is set it is sent as Authorization: Bearer on every request, for a deployment that requires bearer tokens on the evaluation endpoint.

Also on the client: c.pubkey() (the Ed25519 key id the log is signed with) and c.healthy(). A non-2xx response or transport failure raises DecernError with the HTTP status and body, so a denial is distinguishable from a misconfigured endpoint. context is advisory — the server overrides anything it derives itself (the clock, the accountable owner), so a caller cannot talk its way into a decision by supplying them.

What the server gives you

decern is an AuthZEN 1.0 authorization server whose safety rules are machine-checked over every input, and whose decisions land in an append-only, signed, hash-chained log before they are served — a decision that cannot be recorded is refused, and a third party can verify what was decided without trusting the operator:

decern verify --ledger <file> --pubkey <key>   # the chain and every signature
decern explain --ledger <file> --seq 12        # one decision, in full

Obtain the public key out of band; a key handed over by the party being audited establishes nothing.

Test

cd sdks/python && python -m unittest discover -v

Apache-2.0. Published from CI by OIDC with no stored credential.

License
- OSI Approved :: Apache Software License
Programming Language
- Python :: 3
Topic
- Security
Typing
- Typed

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

decern-0.3.1.tar.gz (5.5 kB view details)

Uploaded Aug 17, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

decern-0.3.1-py3-none-any.whl (4.6 kB view details)

Uploaded Aug 17, 2026 Python 3

File details

Details for the file decern-0.3.1.tar.gz.

File metadata

Download URL: decern-0.3.1.tar.gz
Upload date: Aug 17, 2026
Size: 5.5 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for decern-0.3.1.tar.gz
Algorithm	Hash digest
SHA256	`3e45dac530efbd793fd60d1e273b547d050d93fe3e3f197979be7e8a794829b0`
MD5	`f38f99a18d2dfc75d2af7a46b7826264`
BLAKE2b-256	`0f751df3e2d988473e9074d131b6c7bd0740ab2e7654db831fd9ba1a8e19629e`

See more details on using hashes here.

Provenance

The following attestation bundles were made for decern-0.3.1.tar.gz:

Publisher: publish-sdks.yml on anivar/decern

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: decern-0.3.1.tar.gz
- Subject digest: 3e45dac530efbd793fd60d1e273b547d050d93fe3e3f197979be7e8a794829b0
- Sigstore transparency entry: 2495054095
- Sigstore integration time: Aug 17, 2026
Source repository:
- Permalink: anivar/decern@58808c773bc598c85b322331765e68aeb4144217
- Branch / Tag: refs/tags/v0.3.1
- Owner: https://github.com/anivar
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: publish-sdks.yml@58808c773bc598c85b322331765e68aeb4144217
- Trigger Event: push