--set=decision_logs.console=true
```

### 2. Create a sample OPA Policy

In another terminal, create a policy that allows root user all access and for all other users denies `PutObject`:

```sh
cat > example.rego <<EOF
package httpapi.authz

import input

default allow = false

# Allow the root user to perform any action.
allow {
 input.owner == true
}

* `allow_origins` - A list of origins that should be permitted to make cross-origin requests. E.g. `['https://example.org', 'https://www.example.org']`. You can use `['*']` to allow any origin.
* `allow_origin_regex` - A regex string to match against origins that should be permitted to make cross-origin requests. e.g. `'https://.*\.example\.org'`.

///

You can extend the OpenAPI schema for a *path operation* using the parameter `openapi_extra`.

### OpenAPI Extensions

This `openapi_extra` can be helpful, for example, to declare [OpenAPI Extensions](https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.0.3.md#specificationExtensions):

```Python hl_lines="6"
{!../../docs_src/path_operation_advanced_configuration/tutorial005.py!}

	configCmd := &cobra.Command{
		Use:   "ztunnel-config",
		Short: "Update or retrieve current Ztunnel configuration.",
		Long:  "A group of commands used to update or retrieve Ztunnel configuration from a Ztunnel instance.",
		Example: `  # Retrieve summary about workload configuration
  istioctl ztunnel-config workload

  # Retrieve summary about certificates
  istioctl ztunnel-config certificates`,
		Aliases: []string{"zc"},
	}

As all these methods are `async` methods, you need to "await" them.

For example, inside of an `async` *path operation function* you can get the contents with:

```Python
contents = await myfile.read()
```

If you are inside of a normal `def` *path operation function*, you can access the `UploadFile.file` directly, for example:

```Python
contents = myfile.file.read()
```

    assertThat(response.code).isEqualTo(0)
  }

  @Test fun defaultResponseBodyIsEmpty() {
    val response =
      Response.Builder()
        .request(
          Request.Builder()
            .url("https://example.com/")
            .build(),
        )
        .protocol(Protocol.HTTP_1_1)
        .code(200)
        .message("OK")
        .build()
    assertThat(response.body.contentType()).isNull()

      description: Please describe the issue you encountered.
    validations:
      required: true

  - type: textarea
    attributes:
      label: Example
      description: >
        Please provide a [Short, Self Contained, Correct (Compilable), Example](http://sscce.org/)
        demonstrating the bug.
      render: java
    validations:
      required: true

  - type: textarea
    attributes:

		Short: "Retrieves cluster configuration for the Envoy in the specified pod",
		Long:  `Retrieve information about cluster configuration for the Envoy instance in the specified pod.`,
		Example: `  # Retrieve summary about cluster configuration for a given pod from Envoy.
  istioctl proxy-config clusters <pod-name[.namespace]>

  # Retrieve summary about cluster configuration for a pod under a deployment from Envoy.

import java.lang.annotation.Retention;
import java.lang.annotation.Target;

/**
 * Annotates a "top-level" type-variable usage that takes its nullness from the type argument
 * supplied by the user of the class. For example, {@code Multiset.Entry.getElement()} returns
 * {@code @ParametricNullness E}, which means:
 *
 * <ul>
 *   <li>{@code getElement} on a {@code Multiset.Entry<@NonNull String>} returns {@code @NonNull
 *       String}.

The `TestClient` is based on <a href="https://www.python-httpx.org" class="external-link" target="_blank">HTTPX</a>, and luckily, we can use it directly to test the API.

## Example

For a simple example, let's consider a file structure similar to the one described in [Bigger Applications](../tutorial/bigger-applications.md){.internal-link target=_blank} and [Testing](../tutorial/testing.md){.internal-link target=_blank}: