HCL sample

sample.hcl

path "secret/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}
path "secret/super-secret" {
  capabilities = ["deny"]
}
path "secret/restricted" {
  capabilities = ["create"]
  allowed_parameters = {
    "foo" = []
    "bar" = ["zip", "zap"]
  }
}
path "secret/foo" {
  capabilities = ["create"]
  allowed_parameters = {
    "bar" = ["zip", "zap"]
    "*"   = []
  }
}
path "secret/foo" {
  capabilities = ["create"]
  denied_parameters = {
    "bar" = []
  }
}
path "secret/foo" {
  capabilities = ["create"]
  denied_parameters = {
    "bar" = ["zip", "zap"]
  }
}
path "secret/foo" {
  capabilities = ["create"]
  denied_parameters = {
    "*" = []
  }
}
path "secret/foo" {
  capabilities = ["create"]
  allowed_parameters = {
    "*" = ["foo-*"]
  }
}

sample.json

{
  "path": [
    {
      "secret/*": [
        {
          "capabilities": [
            "create",
            "read",
            "update",
            "delete",
            "list"
          ]
        }
      ]
    },
    {
      "secret/super-secret": [
        {
          "capabilities": [
            "deny"
          ]
        }
      ]
    },
    {
      "secret/restricted": [
        {
          "allowed_parameters": [
            {
              "bar": [
                "zip",
                "zap"
              ],
              "foo": []
            }
          ],
          "capabilities": [
            "create"
          ]
        }
      ]
    },
    {
      "secret/foo": [
        {
          "allowed_parameters": [
            {
              "*": [],
              "bar": [
                "zip",
                "zap"
              ]
            }
          ],
          "capabilities": [
            "create"
          ]
        }
      ]
    },
    {
      "secret/foo": [
        {
          "capabilities": [
            "create"
          ],
          "denied_parameters": [
            {
              "bar": []
            }
          ]
        }
      ]
    },
    {
      "secret/foo": [
        {
          "capabilities": [
            "create"
          ],
          "denied_parameters": [
            {
              "bar": [
                "zip",
                "zap"
              ]
            }
          ]
        }
      ]
    },
    {
      "secret/foo": [
        {
          "capabilities": [
            "create"
          ],
          "denied_parameters": [
            {
              "*": []
            }
          ]
        }
      ]
    },
    {
      "secret/foo": [
        {
          "allowed_parameters": [
            {
              "*": [
                "foo-*"
              ]
            }
          ],
          "capabilities": [
            "create"
          ]
        }
      ]
    }
  ]
}