AuthZenService

[Experimental] Get AuthZEN PDP configuration and capabilities

[Experimental] The GetConfiguration API returns metadata about the Policy Decision Point (PDP) including its name, version, supported endpoints, and capabilities. This endpoint follows the AuthZEN specification for PDP discovery.

Following the AuthZEN spec’s multi-tenant pattern, OpenFGA provides a per-store discovery endpoint at /.well-known/authzen-configuration/{store_id}. This returns absolute endpoint URLs specific to that store.

Example Response

{
  "policy_decision_point": "https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV",
  "access_evaluation_endpoint": "https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/evaluation",
  "access_evaluations_endpoint": "https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/evaluations",
  "search_subject_endpoint": "https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/subject",
  "search_resource_endpoint": "https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/resource",
  "search_action_endpoint": "https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/action"
}

GET

.well-known

authzen-configuration

{store_id}

curl

# HTTP only: no named client or generated low-level operation in the audited SDK versions.
# Set FGA_API_URL to the URL of your OpenFGA server.
# Set FGA_STORE_ID to your store ID.
# These examples use a server with authentication disabled.
# For authenticated servers, see /docs/getting-started/setup-sdk-client.

curl -X GET "$FGA_API_URL/.well-known/authzen-configuration/$FGA_STORE_ID"

{
  "access_evaluation_endpoint": "<string>",
  "policy_decision_point": "<string>",
  "access_evaluations_endpoint": "<string>",
  "capabilities": [
    "<string>"
  ],
  "search_action_endpoint": "<string>",
  "search_resource_endpoint": "<string>",
  "search_subject_endpoint": "<string>",
  "signed_metadata": "<string>"
}

{
  "code": "validation_error",
  "message": "Generic validation error"
}

{
  "code": "unauthenticated",
  "message": "unauthenticated"
}

{
  "code": "forbidden",
  "message": "the principal is not authorized to perform the action"
}

{
  "code": "undefined_endpoint",
  "message": "Endpoint not enabled"
}

{
  "code": "10",
  "message": "transaction conflict"
}

{
  "code": "throttled_timeout_error",
  "message": "timeout due to throttling on complex request"
}

{
  "code": "internal_error",
  "message": "Internal Server Error"
}

Path Parameters

store_id

string

required

The store ID for which to retrieve configuration. Following the AuthZEN spec's multi-tenant pattern, each store has its own discovery endpoint.

Response

A successful response.

access_evaluation_endpoint

string

required

REQUIRED. The access evaluation endpoint URL.

policy_decision_point

string

required

REQUIRED. The PDP identifier URL (HTTPS, no query or fragment).

access_evaluations_endpoint

string

OPTIONAL. The batch evaluations endpoint URL.

capabilities

string[]

OPTIONAL. Supported capabilities as URN strings.

search_action_endpoint

string

OPTIONAL. The action search endpoint URL.

search_resource_endpoint

string

OPTIONAL. The resource search endpoint URL.

search_subject_endpoint

string

OPTIONAL. The subject search endpoint URL.

signed_metadata

string

OPTIONAL. Signed metadata JWT per AuthZEN metadata specification.

Last modified on September 28, 2026

⌘I

curl

# HTTP only: no named client or generated low-level operation in the audited SDK versions.
# Set FGA_API_URL to the URL of your OpenFGA server.
# Set FGA_STORE_ID to your store ID.
# These examples use a server with authentication disabled.
# For authenticated servers, see /docs/getting-started/setup-sdk-client.

curl -X GET "$FGA_API_URL/.well-known/authzen-configuration/$FGA_STORE_ID"

{
  "access_evaluation_endpoint": "<string>",
  "policy_decision_point": "<string>",
  "access_evaluations_endpoint": "<string>",
  "capabilities": [
    "<string>"
  ],
  "search_action_endpoint": "<string>",
  "search_resource_endpoint": "<string>",
  "search_subject_endpoint": "<string>",
  "signed_metadata": "<string>"
}

{
  "code": "validation_error",
  "message": "Generic validation error"
}

{
  "code": "unauthenticated",
  "message": "unauthenticated"
}

{
  "code": "forbidden",
  "message": "the principal is not authorized to perform the action"
}

{
  "code": "undefined_endpoint",
  "message": "Endpoint not enabled"
}

{
  "code": "10",
  "message": "transaction conflict"
}

{
  "code": "throttled_timeout_error",
  "message": "timeout due to throttling on complex request"
}

{
  "code": "internal_error",
  "message": "Internal Server Error"
}

Stores

Authorization Models

Relationship Tuples

Relationship Queries

Assertions

AuthZenService

[Experimental] Get AuthZEN PDP configuration and capabilities

Example Response

Path Parameters

Response