diff --git a/api-ref/src/docbkx/ch_identity-v3-ext.xml b/api-ref/src/docbkx/ch_identity-v3-ext.xml
index 84d1f9973..aff2c7d57 100644
--- a/api-ref/src/docbkx/ch_identity-v3-ext.xml
+++ b/api-ref/src/docbkx/ch_identity-v3-ext.xml
@@ -18,33 +18,111 @@
-
-OS-INHERIT extension (OS-INHERIT)
-
-
-
-
+
+OS-ENDPOINT-POLICY extension (OS-ENDPOINT-POLICY)
+
+
+
+
+
+
+OS-INHERIT extension (OS-INHERIT)
+
+
+
+
+
+
+ Key Distribution Server (KDS) extension (OS-KDS)
+
+
+
+
-
-Key Distribution Server (KDS) extension (OS-KDS)
-
-
-
-
-
OAuth extension (OS-OAUTH1)
-
+
-
+
Trust extension (OS-TRUST)
-
-
-
+
+
+
+
+ OS-ENDPOINT-POLICY extension (OS-ENDPOINT-POLICY)
+
+ Creates, verifies, and deletes associations between service
+ endpoints and policies. Such associations enable an endpoint to
+ request its policy.
+
+
+ To create, check, or delete an association, you reference a policy by its ID in
+ the Identity server.
+
+
+ The extension supports these associations:
+
+
+
+
+ A policy and endpoint association.
+
+
+
+
+ A policy and service-type endpoint in a region association.
+
+
+
+
+ A policy and service-type endpoint association.
+
+
+
+
+ This order reflects policies in their most to least-specific order.
+
+
+ When an endpoint requests the appropriate policy for itself, the
+ extension finds the policy by traversing the ordered sequence of
+ methods of association. The extension shows the policy for the
+ first association that it finds.
+
+
+ If the region of the endpoint has a parent, the extension examines
+ the region associations up the region tree in ascending order. For
+ region associations, the extension examines any parent regions in
+ ascending order. The extension does not combine polices.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ OS-INHERIT extension (OS-INHERIT)
@@ -382,3 +460,4 @@ Trust extension (OS-TRUST)
+
diff --git a/api-ref/src/wadls/identity-api/src/v3/common.ent b/api-ref/src/wadls/identity-api/src/v3/common.ent
index 35c0d2728..30d65925b 100644
--- a/api-ref/src/wadls/identity-api/src/v3/common.ent
+++ b/api-ref/src/wadls/identity-api/src/v3/common.ent
@@ -1411,6 +1411,36 @@
'>
+
+
+
+ The next relative link for the endpoint resource.
+
+
+'>
+
+
+
+ The previous relative link for the endpoint resource.
+
+
+'>
+
+
+
+ The self relative link for the endpoint resource.
+
+
+'>
@@ -1421,6 +1451,36 @@
'>
+
+
+
+ The next relative link for the endpoints resource.
+
+
+'>
+
+
+
+ The previous relative link for the endpoints resource.
+
+
+'>
+
+
+
+ The self relative link for the endpoints resource.
+
+
+'>
@@ -1754,6 +1814,16 @@
+
+
+
+ The policy rule set itself, as a serialized blob.
+
+
+'>
@@ -1815,6 +1885,22 @@
'>
+
+
+
+ The MIME media type of the serialized policy blob. From the
+ perspective of the Identity API, a policy blob can be based on any
+ technology. In OpenStack, the policy.json blob
+ (type="application/json") is the conventional
+ solution. However, you might want to use an alternative policy
+ engine that uses a different policy language type. For example,
+ type="application/xacml+xml".
+
+
+'>
diff --git a/api-ref/src/wadls/identity-api/src/v3/samples/OS-ENDPOINT-POLICY/policy-endpoint-associations-list-response.json b/api-ref/src/wadls/identity-api/src/v3/samples/OS-ENDPOINT-POLICY/policy-endpoint-associations-list-response.json
new file mode 100644
index 000000000..e626ff169
--- /dev/null
+++ b/api-ref/src/wadls/identity-api/src/v3/samples/OS-ENDPOINT-POLICY/policy-endpoint-associations-list-response.json
@@ -0,0 +1,29 @@
+{
+ "endpoints": [
+ {
+ "id": "1",
+ "interface": "public",
+ "links": {
+ "self": "http://identity:35357/v3/endpoints/1"
+ },
+ "region": "north",
+ "service_id": "9242e05f0c23467bbd1cf1f7a6e5e596",
+ "url": "http://identity:35357/"
+ },
+ {
+ "id": "1",
+ "interface": "internal",
+ "links": {
+ "self": "http://identity:35357/v3/endpoints/1"
+ },
+ "region": "south",
+ "service_id": "9242e05f0c23467bbd1cf1f7a6e5e596",
+ "url": "http://identity:35357/"
+ }
+ ],
+ "links": {
+ "next": null,
+ "previous": null,
+ "self": "http://identity:35357/v3/OS-ENDPOINT-POLICY/policies/13c92821e4c4476a878d3aae7444f52f/endpoints"
+ }
+}
diff --git a/api-ref/src/wadls/identity-api/src/v3/samples/OS-ENDPOINT-POLICY/policy-show-response.json b/api-ref/src/wadls/identity-api/src/v3/samples/OS-ENDPOINT-POLICY/policy-show-response.json
new file mode 100644
index 000000000..a25a038da
--- /dev/null
+++ b/api-ref/src/wadls/identity-api/src/v3/samples/OS-ENDPOINT-POLICY/policy-show-response.json
@@ -0,0 +1,14 @@
+{
+ "policy": {
+ "blob": {
+ "foobar_user": [
+ "role:compute-user"
+ ]
+ },
+ "id": "13c92821e4c4476a878d3aae7444f52f",
+ "links": {
+ "self": "http://identity:35357/v3/policies/13c92821e4c4476a878d3aae7444f52f"
+ },
+ "type": "application/json"
+ }
+}
diff --git a/api-ref/src/wadls/identity-api/src/v3/wadl/OS-ENDPOINT-POLICY-v3.wadl b/api-ref/src/wadls/identity-api/src/v3/wadl/OS-ENDPOINT-POLICY-v3.wadl
new file mode 100644
index 000000000..63c8a60bf
--- /dev/null
+++ b/api-ref/src/wadls/identity-api/src/v3/wadl/OS-ENDPOINT-POLICY-v3.wadl
@@ -0,0 +1,258 @@
+
+
+
+
+
+
+
+
+
+
+ %common;
+
+ %common_project;
+]>
+
+
+
+
+
+
+
+
+
+
+
+
+ &policy_idTemplateParameter;
+
+
+
+
+ &endpoint_idTemplateParameter;
+
+
+
+
+
+
+
+ &service_idTemplateParameter;
+
+
+
+
+
+
+ ®ion_idTemplateParameter;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Lists all the endpoints that are currently associated with a
+ policy through any of the association methods.
+
+
+
+
+
+
+
+ &endpointsObjectParameter;
+ &endpoint-idResponseParameter;
+ &endpoint-interfaceResponseParameter;
+ &endpoint-linksResponseParameter;
+ &endpoint-nextResponseParameter;
+ &endpoint-previousResponseParameter;
+ &endpoint-selfResponseParameter;
+ &endpoint-regionResponseParameter;
+ &endpoint-service_idResponseParameter;
+ &endpoint-urlResponseParameter;
+ &endpoints-linksResponseParameter;
+ &endpoints-nextResponseParameter;
+ &endpoints-previousResponseParameter;
+ &endpoints-selfResponseParameter;
+
+
+
+
+
+
+ Shows a policy for an endpoint.
+
+
+ The extension finds the policy by traversing the ordered
+ sequence of methods of association. The extension shows the
+ policy for the first association that it finds. If the region
+ of the endpoint has a parent, the extension examines the
+ region associations up the region tree in ascending order.
+
+
+
+
+
+
+
+ &policyObjectParameter;
+ &policy-blobResponseParameter;
+ &policy-idResponseParameter;
+ &policy-linksResponseParameter;
+ &policy-typeResponseParameter;
+
+
+
+
+
+
+ Checks whether a policy is associated with an endpoint.
+
+
+
+
+
+
+
+
+ Associates a policy and an endpoint.
+
+
+ If an association already exists between the endpoint and
+ another policy, this call replaces that association.
+
+
+
+
+
+
+
+ Verifies an association between a policy and an endpoint.
+
+
+ A &HEAD; version of this API is also supported.
+
+
+
+
+
+
+
+ Deletes an association between a policy and an endpoint.
+
+
+
+
+
+
+
+
+ Associates a policy and any endpoint of a service type.
+
+
+ If an association already exists between the endpoint of a
+ service type and another policy, this call replaces that
+ association.
+
+
+
+
+
+
+
+ Verifies an association between a policy and an endpoint of a
+ service type.
+
+
+ A &HEAD; version of this API is also supported.
+
+
+
+
+
+
+
+ Deletes an association between a policy and an endpoint of a
+ service type.
+
+
+
+
+
+
+
+
+ Associates a policy and an endpoint of a service type in a region.
+
+
+ If an association already exists between the service in a
+ region and another policy, this call replaces that
+ association.
+
+
+
+
+
+
+
+ Verifies an association between a policy and service-type
+ endpoint in a region.
+
+
+ A &HEAD; version of this API is also supported.
+
+
+
+
+
+
+
+ Deletes an association between a policy and service-type
+ endpoint in a region.
+
+
+
+
+
diff --git a/api-ref/src/wadls/identity-api/src/v3/wadl/OS-INHERIT-v3.wadl b/api-ref/src/wadls/identity-api/src/v3/wadl/OS-INHERIT-v3.wadl
index 413a8e1d8..1d186411f 100644
--- a/api-ref/src/wadls/identity-api/src/v3/wadl/OS-INHERIT-v3.wadl
+++ b/api-ref/src/wadls/identity-api/src/v3/wadl/OS-INHERIT-v3.wadl
@@ -5,7 +5,7 @@
-
+
diff --git a/api-ref/src/wadls/identity-api/src/v3/wadl/OS-KDS-v3.wadl b/api-ref/src/wadls/identity-api/src/v3/wadl/OS-KDS-v3.wadl
index f1df676b7..51acbbb6e 100644
--- a/api-ref/src/wadls/identity-api/src/v3/wadl/OS-KDS-v3.wadl
+++ b/api-ref/src/wadls/identity-api/src/v3/wadl/OS-KDS-v3.wadl
@@ -1,11 +1,11 @@
-
+
-
+
diff --git a/api-ref/src/wadls/identity-api/src/v3/wadl/OS-OAUTH1-v3.wadl b/api-ref/src/wadls/identity-api/src/v3/wadl/OS-OAUTH1-v3.wadl
index dc22454e2..78ea9f628 100644
--- a/api-ref/src/wadls/identity-api/src/v3/wadl/OS-OAUTH1-v3.wadl
+++ b/api-ref/src/wadls/identity-api/src/v3/wadl/OS-OAUTH1-v3.wadl
@@ -5,7 +5,7 @@
-
+