AuthZenService
[Experimental] Search for resources a subject has access to
[Experimental] The ResourceSearch API returns all resources of a given type that a subject has a specific action (relation) on. This is useful for answering questions like “What documents can Anne read?” or “What folders can Bob administer?”
The resource type filter is required. Results support pagination for large result sets.
Examples
Find all documents a user can read
{
"subject": {"type": "user", "id": "anne"},
"action": {"name": "can_read"},
"resource": {"type": "document"}
}
Response:
{
"results": [
{"type": "document", "id": "roadmap"},
{"type": "document", "id": "budget-2024"},
{"type": "document", "id": "team-roster"}
],
"page": {"count": 3}
}
Find folders a user can administer with pagination
{
"subject": {"type": "user", "id": "bob"},
"action": {"name": "can_admin"},
"resource": {"type": "folder"},
"page": {"limit": 25}
}
Search with ABAC context
{
"subject": {"type": "user", "id": "anne"},
"action": {"name": "can_read"},
"resource": {"type": "document"},
"context": {
"current_time": "2024-01-15T10:00:00Z",
"ip_address": "192.168.1.100"
}
}
POST
/
stores
/
{store_id}
/
access
/
v1
/
search
/
resource
curl
# HTTP only: no named client or generated low-level operation in the audited SDK versions.
# Set FGA_API_URL to the URL of your OpenFGA server.
# Set FGA_STORE_ID to your store ID.
# These examples use a server with authentication disabled.
# For authenticated servers, see /docs/getting-started/setup-sdk-client.
curl -X POST "$FGA_API_URL/stores/$FGA_STORE_ID/access/v1/search/resource" \
-H "content-type: application/json" \
-d '{
"subject": {
"type": "user",
"id": "anne"
},
"action": {
"name": "reader"
},
"resource": {
"type": "document"
}
}'{
"page": {
"count": 123,
"next_token": "<string>",
"total": 123
},
"results": [
{
"id": "roadmap",
"type": "document",
"properties": {}
}
]
}{
"code": "validation_error",
"message": "Generic validation error"
}{
"code": "unauthenticated",
"message": "unauthenticated"
}{
"code": "forbidden",
"message": "the principal is not authorized to perform the action"
}{
"code": "undefined_endpoint",
"message": "Endpoint not enabled"
}{
"code": "10",
"message": "transaction conflict"
}{
"code": "throttled_timeout_error",
"message": "timeout due to throttling on complex request"
}{
"code": "internal_error",
"message": "Internal Server Error"
}Path Parameters
Body
application/json
Last modified on September 28, 2026
Was this page helpful?
⌘I
curl
# HTTP only: no named client or generated low-level operation in the audited SDK versions.
# Set FGA_API_URL to the URL of your OpenFGA server.
# Set FGA_STORE_ID to your store ID.
# These examples use a server with authentication disabled.
# For authenticated servers, see /docs/getting-started/setup-sdk-client.
curl -X POST "$FGA_API_URL/stores/$FGA_STORE_ID/access/v1/search/resource" \
-H "content-type: application/json" \
-d '{
"subject": {
"type": "user",
"id": "anne"
},
"action": {
"name": "reader"
},
"resource": {
"type": "document"
}
}'{
"page": {
"count": 123,
"next_token": "<string>",
"total": 123
},
"results": [
{
"id": "roadmap",
"type": "document",
"properties": {}
}
]
}{
"code": "validation_error",
"message": "Generic validation error"
}{
"code": "unauthenticated",
"message": "unauthenticated"
}{
"code": "forbidden",
"message": "the principal is not authorized to perform the action"
}{
"code": "undefined_endpoint",
"message": "Endpoint not enabled"
}{
"code": "10",
"message": "transaction conflict"
}{
"code": "throttled_timeout_error",
"message": "timeout due to throttling on complex request"
}{
"code": "internal_error",
"message": "Internal Server Error"
}