AuthZenService
[Experimental] Search for actions a subject can perform on a resource
[Experimental] The ActionSearch API returns all actions (relations) that a subject can perform on a specific resource. This is useful for answering questions like “What can Anne do with this document?” or building dynamic UIs that show only the actions a user is permitted to perform.
Examples
Find all actions a user can perform on a document
{
"subject": {"type": "user", "id": "anne"},
"resource": {"type": "document", "id": "roadmap"}
}
Response:
{
"results": [
{"name": "can_read"},
{"name": "can_write"},
{"name": "can_share"}
],
"page": {"count": 3}
}
Search with ABAC context for time-based permissions
{
"subject": {"type": "user", "id": "bob"},
"resource": {"type": "report", "id": "quarterly-financials"},
"context": {
"current_time": "2024-01-15T14:30:00Z",
"user_department": "finance"
}
}
Paginated action search
{
"subject": {"type": "user", "id": "admin"},
"resource": {"type": "system", "id": "production"},
"page": {"limit": 50}
}
POST
/
stores
/
{store_id}
/
access
/
v1
/
search
/
action
curl
# HTTP only: no named client or generated low-level operation in the audited SDK versions.
# Set FGA_API_URL to the URL of your OpenFGA server.
# Set FGA_STORE_ID to your store ID.
# These examples use a server with authentication disabled.
# For authenticated servers, see /docs/getting-started/setup-sdk-client.
curl -X POST "$FGA_API_URL/stores/$FGA_STORE_ID/access/v1/search/action" \
-H "content-type: application/json" \
-d '{
"subject": {
"type": "user",
"id": "anne"
},
"resource": {
"type": "document",
"id": "budget"
}
}'{
"page": {
"count": 123,
"next_token": "<string>",
"total": 123
},
"results": [
{
"name": "can_read",
"properties": {}
}
]
}{
"code": "validation_error",
"message": "Generic validation error"
}{
"code": "unauthenticated",
"message": "unauthenticated"
}{
"code": "forbidden",
"message": "the principal is not authorized to perform the action"
}{
"code": "undefined_endpoint",
"message": "Endpoint not enabled"
}{
"code": "10",
"message": "transaction conflict"
}{
"code": "throttled_timeout_error",
"message": "timeout due to throttling on complex request"
}{
"code": "internal_error",
"message": "Internal Server Error"
}Path Parameters
Body
application/json
Last modified on September 28, 2026
Was this page helpful?
⌘I
curl
# HTTP only: no named client or generated low-level operation in the audited SDK versions.
# Set FGA_API_URL to the URL of your OpenFGA server.
# Set FGA_STORE_ID to your store ID.
# These examples use a server with authentication disabled.
# For authenticated servers, see /docs/getting-started/setup-sdk-client.
curl -X POST "$FGA_API_URL/stores/$FGA_STORE_ID/access/v1/search/action" \
-H "content-type: application/json" \
-d '{
"subject": {
"type": "user",
"id": "anne"
},
"resource": {
"type": "document",
"id": "budget"
}
}'{
"page": {
"count": 123,
"next_token": "<string>",
"total": 123
},
"results": [
{
"name": "can_read",
"properties": {}
}
]
}{
"code": "validation_error",
"message": "Generic validation error"
}{
"code": "unauthenticated",
"message": "unauthenticated"
}{
"code": "forbidden",
"message": "the principal is not authorized to perform the action"
}{
"code": "undefined_endpoint",
"message": "Endpoint not enabled"
}{
"code": "10",
"message": "transaction conflict"
}{
"code": "throttled_timeout_error",
"message": "timeout due to throttling on complex request"
}{
"code": "internal_error",
"message": "Internal Server Error"
}