Facts a rule can read

A rule reads facts about the request by path: a word starting with $, then dots. $auth.user_id is the caller’s id. This page is the complete list. If a path points at something that doesn’t exist (a column the record doesn’t have, $record on a create), the value is missing, which behaves like null: comparisons with it are false (see Values and paths).

​

$auth: who is calling

Custom attributes you marked “include in the access token” appear in $auth.claims, for example $auth.claims.plan. See Token profiles and Attributes.

​

$record: the row

Available on get, update and delete (the existing row). On list it describes each candidate row. On create there is no record yet: use $input.

​

$input: what is being sent

Use it to constrain values: allow only certain statuses, cap a quantity, forbid setting an owner other than yourself.

​

$request: the request

​

$credential: the API key

​

$env

The environment’s name (development, production…). Rarely needed; useful for a rule you share across environments but want looser in development.

​

$object: storage rules only

​

$event: subscription conditions

In a subscription’s Only when…, you can also read the event envelope as $input.event.…. See Events.

​

$now

The current time (UTC). Compare it with a date column:

• Compare values: $record.publish_at is at most $now

​

Quick reference: which exist where