Skip to main content

Rego Built-ins

Rego supports a wide range of built-in functions for different policy use cases. Built-ins available in this version of OPA are listed below.

Each built-in is listed with a column per place it can be used. OPA gives the release that introduced it, Wasm whether it is compiled into policies built for Wasm (SDK means it is not, and the host SDK has to provide it), and the remaining columns are other Rego implementations such as swift-opa and java-opa-sdk, showing the version support began in.

Implementation columns are read from the capabilities each project publishes, so they describe its released versions rather than its current development state. A cross means the built-in cannot be called there at all, and may mean it is implemented but not yet released. Use the filters below to narrow the list to the built-ins one implementation supports.

✗ Wasm Only✗ Swift Only✗ Java Only
CategoryNameOPAWasmSwiftJava
aggregatescount
n := count(collection)		v0.17.0✓0.0.10.1.0
aggregatesmax
n := max(collection)		v0.17.0✓0.0.10.1.0
aggregatesmin
n := min(collection)		v0.17.0✓0.0.10.1.0
aggregatesproduct
n := product(collection)		v0.17.0✓0.0.10.1.0
aggregatessort
n := sort(collection)		v0.17.0✓0.0.10.1.0
aggregatessum
n := sum(collection)		v0.17.0✓0.0.10.1.0
arrayarray.concat
z := array.concat(x, y)		v0.17.0✓0.0.10.1.0
arrayarray.flatten
flattened := array.flatten(arr)		v1.13.0✓✗0.3.0
arrayarray.reverse
rev := array.reverse(arr)		v0.36.0✓0.0.10.1.0
arrayarray.slice
slice := array.slice(arr, start, stop)		v0.17.0✓0.0.10.1.0
bitsbits.and
z := bits.and(x, y)		v0.18.0✓0.0.1✗
bitsbits.lsh
z := bits.lsh(x, s)		v0.18.0✓0.0.1✗
bitsbits.negate
z := bits.negate(x)		v0.18.0✓0.0.1✗
bitsbits.or
z := bits.or(x, y)		v0.18.0✓0.0.1✗
bitsbits.rsh
z := bits.rsh(x, s)		v0.18.0✓0.0.1✗
bitsbits.xor
z := bits.xor(x, y)		v0.18.0✓0.0.1✗
comparisonequal
x == y		v0.17.0✓0.0.10.1.0
comparisongt
x > y		v0.17.0✓0.0.10.1.0
comparisongte
x >= y		v0.17.0✓0.0.10.1.0
comparisonlt
x < y		v0.17.0✓0.0.10.1.0
comparisonlte
x <= y		v0.17.0✓0.0.10.1.0
comparisonneq
x != y		v0.17.0✓0.0.10.1.0
conversionsto_number
num := to_number(value)		v0.17.0✓0.0.10.1.0
cryptocrypto.hmac.equal
result := crypto.hmac.equal(mac1, mac2)		v0.52.0SDK0.0.10.4.0
cryptocrypto.hmac.md5
y := crypto.hmac.md5(x, key)		v0.36.0SDK0.0.10.4.0
cryptocrypto.hmac.sha1
y := crypto.hmac.sha1(x, key)		v0.36.0SDK0.0.10.4.0
cryptocrypto.hmac.sha256
y := crypto.hmac.sha256(x, key)		v0.36.0SDK0.0.10.4.0
cryptocrypto.hmac.sha512
y := crypto.hmac.sha512(x, key)		v0.36.0SDK0.0.10.4.0
cryptocrypto.md5
y := crypto.md5(x)		v0.17.0SDK0.0.10.4.0
cryptocrypto.parse_private_keys
output := crypto.parse_private_keys(keys)		v0.55.0SDK✗✗
cryptocrypto.sha1
y := crypto.sha1(x)		v0.17.0SDK0.0.10.4.0
cryptocrypto.sha256
y := crypto.sha256(x)		v0.17.0SDK0.0.10.4.0
cryptocrypto.x509.parse_and_verify_certificates
output := crypto.x509.parse_and_verify_certificates(certs)		v0.31.0SDK✗✗
cryptocrypto.x509.parse_and_verify_certificates_with_options
output := crypto.x509.parse_and_verify_certificates_with_options(certs, options)		v0.63.0SDK✗✗
cryptocrypto.x509.parse_certificate_request
output := crypto.x509.parse_certificate_request(csr)		v0.21.0SDK✗✗
cryptocrypto.x509.parse_certificates
output := crypto.x509.parse_certificates(certs)		v0.17.0SDK✗✗
cryptocrypto.x509.parse_keypair
output := crypto.x509.parse_keypair(cert, pem)		v0.53.0SDK✗✗
cryptocrypto.x509.parse_rsa_private_key
output := crypto.x509.parse_rsa_private_key(pem)		v0.33.0SDK✗✗
encodingbase64.decode
y := base64.decode(x)		v0.17.0✓0.0.10.1.0
encodingbase64.encode
y := base64.encode(x)		v0.17.0✓0.0.10.1.0
encodingbase64.is_valid
result := base64.is_valid(x)		v0.24.0✓0.0.10.1.0
encodingbase64url.decode
y := base64url.decode(x)		v0.17.0✓0.0.10.1.0
encodingbase64url.encode
y := base64url.encode(x)		v0.17.0✓0.0.10.1.0
encodingbase64url.encode_no_pad
y := base64url.encode_no_pad(x)		v0.25.0-rc2SDK0.0.10.1.0
encodinghex.decode
y := hex.decode(x)		v0.25.0-rc2SDK0.0.10.1.0
encodinghex.encode
y := hex.encode(x)		v0.25.0-rc2SDK0.0.10.1.0
encodingjson.is_valid
result := json.is_valid(x)		v0.25.0-rc1✓0.0.10.4.0
encodingjson.marshal
y := json.marshal(x)		v0.17.0✓0.0.10.4.0
encodingjson.marshal_with_options
y := json.marshal_with_options(x, opts)		v0.64.0SDK0.0.60.4.0
encodingjson.unmarshal
y := json.unmarshal(x)		v0.17.0✓0.0.10.4.0
encodingurlquery.decode
y := urlquery.decode(x)		v0.17.0SDK0.0.7✗
encodingurlquery.decode_object
object := urlquery.decode_object(x)		v0.24.0SDK0.0.7✗
encodingurlquery.encode
y := urlquery.encode(x)		v0.17.0SDK0.0.7✗
encodingurlquery.encode_object
y := urlquery.encode_object(object)		v0.17.0SDK0.0.7✗
encodingyaml.is_valid
result := yaml.is_valid(x)		v0.25.0-rc1SDK0.0.100.4.0
encodingyaml.marshal
y := yaml.marshal(x)		v0.17.0SDK0.0.100.4.0
encodingyaml.unmarshal
y := yaml.unmarshal(x)		v0.17.0SDK0.0.100.4.0
globglob.match
result := glob.match(pattern, delimiters, match)		v0.17.0✓✗✗
globglob.quote_meta
output := glob.quote_meta(pattern)		v0.17.0SDK✗✗
graphgraph.reachable
output := graph.reachable(graph, initial)		v0.20.0✓✗0.4.0
graphgraph.reachable_paths
output := graph.reachable_paths(graph, initial)		v0.37.0SDK✗0.4.0
graphwalk
walk(x, output)		v0.17.0✓0.0.10.4.0
graphqlgraphql.is_valid
output := graphql.is_valid(query, schema)		v0.41.0SDK✗✗
graphqlgraphql.parse
output := graphql.parse(query, schema)		v0.41.0SDK✗✗
graphqlgraphql.parse_and_verify
output := graphql.parse_and_verify(query, schema)		v0.41.0SDK✗✗
graphqlgraphql.parse_query
output := graphql.parse_query(query)		v0.41.0SDK✗✗
graphqlgraphql.parse_schema
output := graphql.parse_schema(schema)		v0.41.0SDK✗✗
graphqlgraphql.schema_is_valid
output := graphql.schema_is_valid(schema)		v0.46.0SDK✗✗
httphttp.send
response := http.send(request)		v0.17.0SDK✗✗
netnet.cidr_contains
result := net.cidr_contains(cidr, cidr_or_ip)		v0.17.0✓✗0.4.0
netnet.cidr_contains_matches
output := net.cidr_contains_matches(cidrs, cidrs_or_ips)		v0.19.0-rc1SDK✗0.4.0
netnet.cidr_expand
hosts := net.cidr_expand(cidr)		v0.17.0SDK✗0.4.0
netnet.cidr_intersects
result := net.cidr_intersects(cidr1, cidr2)		v0.17.0✓✗0.4.0
netnet.cidr_is_valid
result := net.cidr_is_valid(cidr)		v0.46.0SDK✗0.4.0
netnet.cidr_merge
output := net.cidr_merge(addrs)		v0.24.0SDK✗0.4.0
netnet.lookup_ip_addr
addrs := net.lookup_ip_addr(name)		v0.35.0SDK✗0.4.0
numbersabs
y := abs(x)		v0.17.0✓0.0.10.1.0
numbersceil
y := ceil(x)		v0.26.0✓0.0.10.1.0
numbersdiv
x / y		v0.17.0✓0.0.10.1.0
numbersfloor
y := floor(x)		v0.26.0✓0.0.10.1.0
numbersminus
x - y		v0.17.0✓0.0.10.1.0
numbersmul
x * y		v0.17.0✓0.0.10.1.0
numbersnumbers.range
range := numbers.range(a, b)		v0.22.0✓0.0.10.1.0
numbersnumbers.range_step
range := numbers.range_step(a, b, step)		v0.56.0SDK0.0.10.1.0
numbersplus
x + y		v0.17.0✓0.0.10.1.0
numbersrand.intn
y := rand.intn(str, n)		v0.31.0SDK0.0.10.1.0
numbersrem
x % y		v0.17.0✓0.0.10.1.0
numbersround
y := round(x)		v0.17.0✓0.0.10.1.0
objectjson.filter
filtered := json.filter(object, paths)		v0.17.0✓0.0.100.4.0
objectjson.match_schema
output := json.match_schema(document, schema)		v0.50.0SDK✗0.4.0
objectjson.patch
output := json.patch(target, patches)		v0.25.0SDK0.0.100.4.0
objectjson.remove
output := json.remove(object, paths)		v0.18.0✓0.0.100.4.0
objectjson.verify_schema
output := json.verify_schema(schema)		v0.50.0SDK✗0.4.0
objectobject.filter
filtered := object.filter(object, keys)		v0.17.2✓0.0.90.1.0
objectobject.get
value := object.get(object, key, default)		v0.17.0✓0.0.10.1.0
objectobject.keys
value := object.keys(object)		v0.47.0✓0.0.10.1.0
objectobject.remove
output := object.remove(object, keys)		v0.17.2✓0.0.90.1.0
objectobject.subset
result := object.subset(super, sub)		v0.42.0SDK0.0.90.1.0
objectobject.union
output := object.union(a, b)		v0.17.2✓0.0.10.1.0
objectobject.union_n
output := object.union_n(objects)		v0.37.0✓0.0.10.1.0
opaopa.runtime
output := opa.runtime()		v0.17.0SDK✗0.3.0
providers.awsproviders.aws.sign_req
signed_request := providers.aws.sign_req(request, aws_config, time_ns)		v0.47.0SDK✗0.4.0
regexregex.find_all_string_submatch_n
output := regex.find_all_string_submatch_n(pattern, value, number)		v0.17.0✓0.0.70.4.0
regexregex.find_n
output := regex.find_n(pattern, value, number)		v0.17.0SDK0.0.70.4.0
regexregex.globs_match
result := regex.globs_match(glob1, glob2)		v0.17.0SDK✗0.4.0
regexregex.is_valid
result := regex.is_valid(pattern)		v0.23.0✓0.0.70.4.0
regexregex.match
result := regex.match(pattern, value)		v0.23.0✓0.0.70.4.0
regexregex.replace
output := regex.replace(s, pattern, value)		v0.45.0SDK0.0.70.4.0
regexregex.split
output := regex.split(pattern, value)		v0.17.0SDK0.0.70.4.0
regexregex.template_match
result := regex.template_match(template, value, delimiter_start, delimiter_end)		v0.17.0SDK0.0.70.4.0
regorego.metadata.chain
chain := rego.metadata.chain()		v0.40.0SDK✗✗
regorego.metadata.rule
output := rego.metadata.rule()		v0.40.0SDK✗✗
regorego.parse_module
output := rego.parse_module(filename, rego)		v0.17.0SDK✗✗
semversemver.compare
result := semver.compare(a, b)		v0.22.0SDK0.0.30.4.0
semversemver.is_valid
result := semver.is_valid(vsn)		v0.22.0SDK0.0.30.4.0
setsand
x & y		v0.17.0✓0.0.10.1.0
setsintersection
y := intersection(xs)		v0.17.0✓0.0.10.1.0
setsminus
x - y		v0.17.0✓0.0.10.1.0
setsor
x | y		v0.17.0✓0.0.10.1.0
setsunion
y := union(xs)		v0.17.0✓0.0.10.1.0
stringsconcat
output := concat(delimiter, collection)		v0.17.0✓0.0.10.1.0
stringscontains
result := contains(haystack, needle)		v0.17.0✓0.0.10.1.0
stringsendswith
result := endswith(search, base)		v0.17.0✓0.0.10.1.0
stringsformat_int
output := format_int(number, base)		v0.17.0✓0.0.10.1.0
stringsindexof
output := indexof(haystack, needle)		v0.17.0✓0.0.10.1.0
stringsindexof_n
output := indexof_n(haystack, needle)		v0.37.0SDK0.0.10.1.0
stringslower
y := lower(x)		v0.17.0✓0.0.10.1.0
stringsreplace
y := replace(x, old, new)		v0.17.0✓0.0.10.1.0
stringssplit
ys := split(x, delimiter)		v0.17.0✓0.0.10.1.0
stringssprintf
output := sprintf(format, values)		v0.17.0SDK0.0.10.1.0
stringsstartswith
result := startswith(search, base)		v0.17.0✓0.0.10.1.0
stringsstrings.any_prefix_match
result := strings.any_prefix_match(search, base)		v0.44.0SDK0.0.50.1.0
stringsstrings.any_suffix_match
result := strings.any_suffix_match(search, base)		v0.44.0SDK0.0.50.1.0
stringsstrings.count
output := strings.count(search, substring)		v0.67.0SDK0.0.10.1.0
stringsstrings.render_template
result := strings.render_template(value, vars)		v0.59.0SDK0.0.5✗
stringsstrings.replace_n
output := strings.replace_n(patterns, value)		v0.17.0✓0.0.50.1.0
stringsstrings.reverse
y := strings.reverse(x)		v0.36.0✓0.0.10.1.0
stringsstrings.split_n
ys := strings.split_n(x, delimiter, n)		v1.19.0SDK✗✗
stringssubstring
output := substring(value, offset, length)		v0.17.0✓0.0.10.1.0
stringstrim
output := trim(value, cutset)		v0.17.0✓0.0.10.1.0
stringstrim_left
output := trim_left(value, cutset)		v0.17.0✓0.0.10.1.0
stringstrim_prefix
output := trim_prefix(value, prefix)		v0.17.0✓0.0.10.1.0
stringstrim_right
output := trim_right(value, cutset)		v0.17.0✓0.0.10.1.0
stringstrim_space
output := trim_space(value)		v0.17.0✓0.0.10.1.0
stringstrim_suffix
output := trim_suffix(value, suffix)		v0.17.0✓0.0.10.1.0
stringsupper
y := upper(x)		v0.17.0✓0.0.10.1.0
timetime.add_date
output := time.add_date(ns, years, months, days)		v0.19.0SDK0.0.20.1.0
timetime.clock
output := time.clock(x)		v0.17.0SDK0.0.30.1.0
timetime.date
date := time.date(x)		v0.17.0SDK0.0.30.1.0
timetime.diff
output := time.diff(ns1, ns2)		v0.28.0SDK0.0.30.1.0
timetime.format
formatted timestamp := time.format(x)		v0.48.0SDK0.0.30.1.0
timetime.now_ns
now := time.now_ns()		v0.17.0SDK0.0.10.1.0
timetime.parse_duration_ns
ns := time.parse_duration_ns(duration)		v0.17.0SDK0.0.30.1.0
timetime.parse_ns
ns := time.parse_ns(layout, value)		v0.17.0SDK0.0.30.1.0
timetime.parse_rfc3339_ns
ns := time.parse_rfc3339_ns(value)		v0.17.0SDK0.0.30.1.0
timetime.weekday
day := time.weekday(x)		v0.17.0SDK0.0.30.1.0
tokensio.jwt.decode
output := io.jwt.decode(jwt)		v0.17.0SDK✗0.1.0
tokensio.jwt.decode_verify
output := io.jwt.decode_verify(jwt, constraints)		v0.17.0SDK✗0.1.0
tokensio.jwt.verify_eddsa
result := io.jwt.verify_eddsa(jwt, certificate)		v1.8.0SDK✗0.4.0
tokensio.jwt.verify_es256
result := io.jwt.verify_es256(jwt, certificate)		v0.17.0SDK✗0.1.0
tokensio.jwt.verify_es384
result := io.jwt.verify_es384(jwt, certificate)		v0.20.0SDK✗0.1.0
tokensio.jwt.verify_es512
result := io.jwt.verify_es512(jwt, certificate)		v0.20.0SDK✗0.1.0
tokensio.jwt.verify_hs256
result := io.jwt.verify_hs256(jwt, secret)		v0.17.0SDK✗0.1.0
tokensio.jwt.verify_hs384
result := io.jwt.verify_hs384(jwt, secret)		v0.20.0SDK✗0.1.0
tokensio.jwt.verify_hs512
result := io.jwt.verify_hs512(jwt, secret)		v0.20.0SDK✗0.1.0
tokensio.jwt.verify_ps256
result := io.jwt.verify_ps256(jwt, certificate)		v0.17.0SDK✗0.1.0
tokensio.jwt.verify_ps384
result := io.jwt.verify_ps384(jwt, certificate)		v0.20.0SDK✗0.1.0
tokensio.jwt.verify_ps512
result := io.jwt.verify_ps512(jwt, certificate)		v0.20.0SDK✗0.1.0
tokensio.jwt.verify_rs256
result := io.jwt.verify_rs256(jwt, certificate)		v0.17.0SDK✗0.1.0
tokensio.jwt.verify_rs384
result := io.jwt.verify_rs384(jwt, certificate)		v0.20.0SDK✗0.1.0
tokensio.jwt.verify_rs512
result := io.jwt.verify_rs512(jwt, certificate)		v0.20.0SDK✗0.1.0
tokensignio.jwt.encode_sign
output := io.jwt.encode_sign(headers, payload, key)		v0.17.0SDK✗0.1.0
tokensignio.jwt.encode_sign_raw
output := io.jwt.encode_sign_raw(headers, payload, key)		v0.17.0SDK✗0.1.0
tracingtrace
result := trace(note)		v0.17.0SDK0.0.1✗
typesis_array
result := is_array(x)		v0.17.0✓0.0.10.1.0
typesis_boolean
result := is_boolean(x)		v0.17.0✓0.0.10.1.0
typesis_null
result := is_null(x)		v0.17.0✓0.0.10.1.0
typesis_number
result := is_number(x)		v0.17.0✓0.0.10.1.0
typesis_object
result := is_object(x)		v0.17.0✓0.0.10.1.0
typesis_set
result := is_set(x)		v0.17.0✓0.0.10.1.0
typesis_string
result := is_string(x)		v0.17.0✓0.0.10.1.0
typestype_name
type := type_name(x)		v0.17.0✓0.0.10.1.0
unitsunits.parse
y := units.parse(x)		v0.41.0SDK0.0.1✗
unitsunits.parse_bytes
y := units.parse_bytes(x)		v0.17.0SDK0.0.1✗
uriuri.is_valid
result := uri.is_valid(uri)		v1.16.0SDK✗0.4.0
uriuri.parse
output := uri.parse(uri)		v1.16.0SDK✗0.4.0
uuiduuid.parse
result := uuid.parse(uuid)		v0.57.0SDK0.0.10.4.0
uuiduuid.rfc4122
output := uuid.rfc4122(k)		v0.20.0SDK0.0.10.4.0