# OpenFGA

> OpenFGA is a CNCF open source authorization system for fine-grained, relationship-based access control.

- [Introduction to OpenFGA](https://openfga.dev/docs/fga.md): Build relationship-based, role-based, and attribute-based access control at scale.
- [Authorization Concepts](https://openfga.dev/docs/authorization-concepts.md): Learn fine-grained authorization concepts: ReBAC, RBAC, ABAC, PBAC, and Google Zanzibar. Understand how OpenFGA models permissions for modern apps.
- [Concepts](https://openfga.dev/docs/concepts.md): Learning about FGA concepts
- [Configuration Language](https://openfga.dev/docs/configuration-language.md): Learning about the FGA configuration language and using it to build a representation of a system's authorization model
- [Getting Started](https://openfga.dev/docs/getting-started.md): OpenFGA tutorial and quickstart: install the server, configure an authorization model, write tuples, and run your first permission checks in minutes.
- [Setup OpenFGA](https://openfga.dev/docs/getting-started/setup-openfga/overview.md): Follow the guides below to set up an OpenFGA server.
- [Configuring OpenFGA](https://openfga.dev/docs/getting-started/setup-openfga/configure-openfga.md): Configuring an OpenFGA Server
- [OpenFGA Configuration Options](https://openfga.dev/docs/getting-started/setup-openfga/configuration.md): Configuring Options for the OpenFGA Server
- [🐳 Setup OpenFGA with Docker](https://openfga.dev/docs/getting-started/setup-openfga/docker.md): Setting up an OpenFGA server with Docker
- [☸️ Setup OpenFGA with Kubernetes](https://openfga.dev/docs/getting-started/setup-openfga/kubernetes.md): Setting up an OpenFGA server with Kubernetes
- [🛡️Setup Access Control](https://openfga.dev/docs/getting-started/setup-openfga/access-control.md): How to enable and setup the built-in access control OpenFGA server (experimental)
- [Using the OpenFGA Playground](https://openfga.dev/docs/getting-started/setup-openfga/playground.md): Setting up an OpenFGA server
- [Reporting Runtime Issues](https://openfga.dev/docs/getting-started/setup-openfga/reporting-runtime-issues.md): Information to gather when reporting OpenFGA runtime issues
- [Install SDK Client](https://openfga.dev/docs/getting-started/install-sdk.md): Installing SDK client
- [Create a Store](https://openfga.dev/docs/getting-started/create-store.md): Creating a store
- [Setup SDK Client for Store](https://openfga.dev/docs/getting-started/setup-sdk-client.md): Setting up an OpenFGA SDK client
- [Configure Authorization Model for a Store](https://openfga.dev/docs/getting-started/configure-model.md): Configuring authorization model for a store
- [Update Relationship Tuples](https://openfga.dev/docs/getting-started/update-tuples.md): Introduction to adding and deleting relationship tuples
- [Perform a Check](https://openfga.dev/docs/getting-started/perform-check.md): Checking if a user is authorized to perform an action on a resource
- [Perform a list objects call](https://openfga.dev/docs/getting-started/perform-list-objects.md): List all objects a user is authorized to perform a specified action for a given resource type
- [Perform a List Users call](https://openfga.dev/docs/getting-started/perform-list-users.md): List all users that have a certain relation with a particular object
- [Use the FGA CLI](https://openfga.dev/docs/getting-started/cli.md): Use the FGA CLI
- [Integrate Within a Framework](https://openfga.dev/docs/getting-started/framework.md): Integrating FGA within a framework, such as Fastify or Fiber
- [Immutable Authorization Models](https://openfga.dev/docs/getting-started/immutable-models.md): Learn how to take advantage of the immutable properties of Authorization Models
- [Best Practices of Managing Tuples and Invoking APIs](https://openfga.dev/docs/getting-started/tuples-api-best-practices.md): The following list outlines some guidelines and best practices for using OpenFGA:
- [Configure SDK Client Telemetry](https://openfga.dev/docs/getting-started/configure-telemetry.md): How to configure your SDK Client to collect telemetry using OpenTelemetry.
- [Modeling Guides](https://openfga.dev/docs/modeling/overview.md): Guides, concepts and examples that help you define an authorization model.
- [Get Started with Modeling](https://openfga.dev/docs/modeling/getting-started.md): An introduction to modeling
- [Direct Access](https://openfga.dev/docs/modeling/direct-access.md): Granting a user access to an object
- [User Groups](https://openfga.dev/docs/modeling/user-groups.md): Adding users to groups and granting group members access to an object
- [Roles and Permissions](https://openfga.dev/docs/modeling/roles-and-permissions.md): Modeling basic roles and permissions
- [Parent-Child Objects](https://openfga.dev/docs/modeling/parent-child.md): Indicate relationships between objects, and how users' relationships to one object can affect their relationship with another
- [Blocklists](https://openfga.dev/docs/modeling/blocklists.md): Preventing certain users from accessing objects
- [Public Access](https://openfga.dev/docs/modeling/public-access.md): Granting public access to an object
- [Multiple Restrictions](https://openfga.dev/docs/modeling/multiple-restrictions.md): Modeling system that requires multiple authorizations before allowing users to perform actions on particular objects
- [Custom Roles](https://openfga.dev/docs/modeling/custom-roles.md): Modeling custom and dynamically changing roles in your system
- [Conditions](https://openfga.dev/docs/modeling/conditions.md): Modeling relationships with Conditions
- [Use Token Claims As Contextual Tuples](https://openfga.dev/docs/modeling/token-claims-contextual-tuples.md): Using identity token claims to define contextual relations
- [Contextual and Time-Based Authorization](https://openfga.dev/docs/modeling/contextual-time-based-authorization.md): Checking relations that depends on certain dynamic or contextual data (such as time, location, ip address, weather) that have not been written
- [Authorization Through Organization Context](https://openfga.dev/docs/modeling/organization-context-authorization.md): Modeling authorization through organization context
- [Testing Models](https://openfga.dev/docs/modeling/testing.md): Test OpenFGA authorization models before deployment.
- [Store File Format](https://openfga.dev/docs/modeling/store-file-format.md): Store File Format (.fga.yaml)
- [Modular Models](https://openfga.dev/docs/modeling/modular-models.md): Modular Models
- [Authorization Model Building Blocks](https://openfga.dev/docs/modeling/building-blocks/overview.md): Guides on the building blocks of authorization models in OpenFGA.
- [Direct Relationships](https://openfga.dev/docs/modeling/building-blocks/direct-relationships.md): Modeling Concepts: Direct Relationships
- [Concentric Relationships](https://openfga.dev/docs/modeling/building-blocks/concentric-relationships.md): Modeling Concepts: Concentric Relationships
- [Object to Object Relationships](https://openfga.dev/docs/modeling/building-blocks/object-to-object-relationships.md): Modeling relationships between objects (e.g. folder parent of a document)
- [Usersets](https://openfga.dev/docs/modeling/building-blocks/usersets.md): Modeling with userset
- [Advanced Use-Cases](https://openfga.dev/docs/modeling/advanced/overview.md): Advanced use cases and patterns for authorization modeling
- [Modeling Google Drive permissions with OpenFGA](https://openfga.dev/docs/modeling/advanced/gdrive.md): Modeling Google Drive permissions
- [Modeling GitHub permissions with OpenFGA](https://openfga.dev/docs/modeling/advanced/github.md): Modeling GitHub permissions
- [Modeling Authorization for Slack with OpenFGA](https://openfga.dev/docs/modeling/advanced/slack.md): Modeling authorization for Slack
- [Modeling Authorization for an IoT Security System with OpenFGA](https://openfga.dev/docs/modeling/advanced/iot.md): Modeling fine-grained authorization for an IoT security camera system
- [Modeling Entitlements for a System with OpenFGA](https://openfga.dev/docs/modeling/advanced/entitlements.md): Modeling entitlements for a system
- [Model Migrations](https://openfga.dev/docs/modeling/migrating/overview.md): Guides focused on migrating models and relations in OpenFGA.
- [Migrating Relations](https://openfga.dev/docs/modeling/migrating/migrating-relations.md): Migrating relations
- [Model Migrations](https://openfga.dev/docs/modeling/migrating/migrating-models.md): Learn how to migrate OpenFGA authorization models, including adding, removing, and renaming types and relations.
- [Authorization for Agents](https://openfga.dev/docs/modeling/agents/overview.md): Authorization patterns for AI agents and automated processes: model agents as principals, secure RAG pipelines, and control MCP server tool access.
- [Modeling Agents as Principals](https://openfga.dev/docs/modeling/agents/agents-as-principals.md): Model agents as first-class principals in your authorization model so they inherit access through the same permission hierarchy as users
- [RAG Authorization](https://openfga.dev/docs/modeling/agents/rag-authorization.md): Retrieval-Augmented Generation (RAG) enhances LLM responses by retrieving relevant documents from a knowledge base. Without authorization checks, a user can ask a question and receive answers derived from documents they should not have access to. OpenFGA lets you enforce document-level permissions s…
- [Authorization for MCP Servers](https://openfga.dev/docs/modeling/agents/mcp-authorization.md): Authorize MCP server tools with OpenFGA: control which tools each user can invoke based on roles, group membership, and time-limited temporal grants.
- [Modeling Task-Based Authorization for Agents](https://openfga.dev/docs/modeling/agents/task-based-authorization.md): Modeling task-based authorization for agents
- [Interacting with the API](https://openfga.dev/docs/interacting/overview.md): Programmatically writing authorization related data and interact with the API
- [Managing User Access](https://openfga.dev/docs/interacting/managing-user-access.md): Granting a user access to a particular object
- [Managing Group Access](https://openfga.dev/docs/interacting/managing-group-access.md): Granting a group of users access to a particular object
- [Managing Group Membership](https://openfga.dev/docs/interacting/managing-group-membership.md): Updating a user's membership to a group by adding and removing them from it
- [Managing Relationships Between Objects](https://openfga.dev/docs/interacting/managing-relationships-between-objects.md): Granting a user access to a particular object through a relationship with another object
- [Contextual Tuples](https://openfga.dev/docs/interacting/contextual-tuples.md): Understanding and using contextual tuples
- [Query Consistency Modes](https://openfga.dev/docs/interacting/consistency.md): Query Consistency Modes
- [Relationship Queries: Check, Read, Expand, ListObjects and ListUsers](https://openfga.dev/docs/interacting/relationship-queries.md): An overview of how to use the Check, Read, Expand, and ListObject APIs
- [How to get tuple changes](https://openfga.dev/docs/interacting/read-tuple-changes.md): Getting tuple changes
- [Search With Permissions](https://openfga.dev/docs/interacting/search-with-permissions.md): Integrating FGA into your search
- [AuthZEN API (Experimental)](https://openfga.dev/docs/interacting/authzen.md): Using the AuthZEN interoperability API with OpenFGA
- [OpenFGA Best Practices](https://openfga.dev/docs/best-practices/overview.md): Overview of best practices when adopting OpenFGA
- [OpenFGA Adoption Patterns](https://openfga.dev/docs/best-practices/adoption-patterns.md): Describe different ways FGA can be adopted in an organization
- [Authorization Model Design Principles](https://openfga.dev/docs/best-practices/modeling-design-principles.md): Best practices for creating clear, performant, and maintainable authorization models.
- [Modeling ABAC with OpenFGA](https://openfga.dev/docs/best-practices/modeling-abac.md): Learn how to model Attribute-Based Access Control (ABAC) patterns using stored and dynamic attributes in OpenFGA.
- [Modeling Roles](https://openfga.dev/docs/best-practices/modeling-roles.md): Various ways of modeling static and dynamic roles in FGA - both coarse and fine-grained.
- [When to use OpenFGA as the 'source of truth' for authorization data](https://openfga.dev/docs/best-practices/source-of-truth.md): Deciding where to store the "source of truth" for authorization data
- [Running OpenFGA in Production](https://openfga.dev/docs/best-practices/running-in-production.md): Best Practices of Running OpenFGA in a Production Environment
- [OpenFGA by Industry](https://openfga.dev/docs/industries/overview.md): How healthcare, banking, e-commerce, HR, CRM, and LMS teams model fine-grained authorization with FGA.
- [Healthcare Authorization with OpenFGA](https://openfga.dev/docs/industries/healthcare.md): Model patients, providers, encounters, and HIPAA-regulated PHI access in OpenFGA. Care teams, facility hierarchy, and sensitive-field permissions for EHR.
- [Banking Authorization with OpenFGA](https://openfga.dev/docs/industries/banking.md): Model account managers, account owners, per-transaction limits, and delegation in FGA for banking, fintech, and PCI-DSS-regulated applications.
- [E-commerce Authorization with OpenFGA](https://openfga.dev/docs/industries/ecommerce.md): Model multi-store organizations, staff roles, products, orders, and refunds in FGA for Shopify-style and BigCommerce-style e-commerce platforms.
- [HR & HRIS Authorization with OpenFGA](https://openfga.dev/docs/industries/human-resources.md): Model employee records, manager hierarchies, payroll, benefits, and PII isolation in FGA for Workday-style HRIS, HR, and directory systems.
- [CRM Authorization with OpenFGA](https://openfga.dev/docs/industries/crm.md): Model accounts, contacts, leads, opportunities, and territory-based access in FGA for Salesforce-style and HubSpot-style CRM platforms.
- [LMS Authorization with OpenFGA](https://openfga.dev/docs/industries/lms.md): Model courses, classes, enrollments, content authorship, and grading workflows in FGA for Canvas-style and Moodle-style learning management systems.
- [ATS Authorization with OpenFGA](https://openfga.dev/docs/industries/applicant-tracking-system.md): Model jobs, candidates, applications, interviews, scorecards, and offer workflows in FGA for Greenhouse-style and Lever-style applicant tracking systems.
- [OpenFGA Use Cases](https://openfga.dev/docs/use-cases/overview.md): Production-ready OpenFGA patterns for AI agents, RAG, MCP servers, multi-tenant SaaS, and microservices authorization.
- [AI Agent Authorization](https://openfga.dev/docs/use-cases/ai-agent-authorization.md): Authorize AI agents with OpenFGA. Model agents as principals, delegate user permissions, and enforce least privilege for autonomous and copilot agents.
- [RAG Authorization](https://openfga.dev/docs/use-cases/rag-authorization.md): Enforce per-user permissions on retrieval-augmented generation. Filter retrieved documents through OpenFGA before they reach the model.
- [MCP Server Authorization](https://openfga.dev/docs/use-cases/mcp-server-authorization.md): Authorize Model Context Protocol (MCP) servers with OpenFGA. Per-tool, per-resource permission checks on every MCP request.
- [Multi-Tenant SaaS Authorization](https://openfga.dev/docs/use-cases/multi-tenant-saas.md): Authorize multi-tenant SaaS applications with OpenFGA. Strict tenant isolation, shared infrastructure, and cross-tenant sharing where you want it.
- [Microservices Authorization](https://openfga.dev/docs/use-cases/microservices-authorization.md): Centralize authorization across microservices with OpenFGA. One model, one store, one set of decisions — instead of a roles table per service.
- [OpenFGA in production](https://openfga.dev/docs/adopters/overview.md): Production OpenFGA case studies from Agicap, Docker, Grafana Labs, Headspace, OpenLane, Read AI, Vitrolife, Zuplo and other adopters running fine-grained authorization at scale.
- [Agicap: Fine-grained authorization for a European fintech platform](https://openfga.dev/docs/adopters/agicap.md): How European fintech Agicap runs OpenFGA in production for 8,000+ customers at 250 RPS with conditional ReBAC across every backend service.
- [Docker: Centralizing permissions with ReBAC](https://openfga.dev/docs/adopters/docker.md): How Docker migrated to OpenFGA with a parallel-run strategy and now uses ReBAC to centralize permissions across products.
- [Grafana Labs: From single-tenant engine to multi-tenant ReBAC](https://openfga.dev/docs/adopters/grafana.md): Why Grafana Labs replaced its single-tenant access control engine with OpenFGA to power multi-tenant Grafana Cloud and embedded OSS deployments.
- [Read AI: 5 billion tuples, 20ms p99 latency](https://openfga.dev/docs/adopters/read-ai.md): How Read AI runs OpenFGA at 5,200 requests per second with 20ms p99 latency over more than 5 billion relationship tuples.
- [Headspace: Authorizing an empathetic AI companion at consumer scale](https://openfga.dev/docs/adopters/headspace.md): How Headspace authorizes Ebb, its empathetic AI companion, with OpenFGA — driving end-to-end checks down from 10-15 seconds to 10-15 milliseconds.
- [Zuplo: Edge authorization across multiple data centers](https://openfga.dev/docs/adopters/zuplo.md): How API management platform Zuplo runs OpenFGA across multiple data centers with PostgreSQL global replication for edge authorization.
- [Openlane: Authorization at the data-access layer for compliance automation](https://openfga.dev/docs/adopters/openlane.md): How compliance-automation startup OpenLane wires OpenFGA into ent at the data-access layer, with overfetch + BatchCheck replacing slow ListObjects.
- [Vitrolife Group: Hybrid Entra + OpenFGA authorization for a .NET healthcare platform](https://openfga.dev/docs/adopters/vitrolife.md): How Vitrolife combines Microsoft Entra ID app roles with OpenFGA fine-grained ReBAC for a .NET 10 metadata platform serving IVF clinics worldwide.
- [Learn Authorization](https://openfga.dev/docs/learn/overview.md): Authorization concepts explained — Zanzibar, ReBAC, RBAC, ABAC, fine-grained authorization, and policy engines — with FGA examples.
- [What is Google Zanzibar?](https://openfga.dev/docs/learn/zanzibar.md): Zanzibar is a 2019 paper from Google describing the authorization system used by Google Drive, YouTube, Calendar, Cloud, and most other Google products. It is the source of the design pattern OpenFGA implements.
- [What is ReBAC?](https://openfga.dev/docs/learn/rebac.md): ReBAC models permissions as relationships between users and resources. Learn what ReBAC is, when to use it, and how OpenFGA implements it.
- [RBAC vs. ReBAC](https://openfga.dev/docs/learn/rbac-vs-rebac.md): RBAC assigns roles to users; ReBAC models relationships between users and resources. Learn when roles run out and ReBAC takes over.
- [ABAC vs. ReBAC](https://openfga.dev/docs/learn/abac-vs-rebac.md): ABAC decides on attributes; ReBAC decides on relationships. Learn which fits which problem — and how OpenFGA covers both via conditions.
- [What is Fine-Grained Authorization?](https://openfga.dev/docs/learn/fine-grained-authorization.md): Fine-grained authorization decides access at the resource and action level. Learn what FGA is, what it buys you, and how OpenFGA implements it.
- [Policy Engines vs. Relationship Engines](https://openfga.dev/docs/learn/policy-engine.md): Policy engines like OPA and Cedar evaluate rules over data. Relationship engines like OpenFGA store and query the graph. Here's when to use which.
- [List all stores](https://openfga.dev/docs/api/service/stores/list-all-stores.md): Returns a paginated list of OpenFGA stores and a continuation token to get additional stores. The continuation token is empty if there are no more stores.
- [Create a store](https://openfga.dev/docs/api/service/stores/create-a-store.md): Create a unique OpenFGA store which is used to store authorization models and relationship tuples.
- [Get a store](https://openfga.dev/docs/api/service/stores/get-a-store.md): Returns an OpenFGA store by its identifier
- [Delete a store](https://openfga.dev/docs/api/service/stores/delete-a-store.md): Delete an OpenFGA store. This does not delete the data associated with the store, like tuples or authorization models.
- [Get all authorization models](https://openfga.dev/docs/api/service/authorization-models/get-all-authorization-models.md): The ReadAuthorizationModels API returns all the authorization models for a certain store. OpenFGA's response contains an array of all authorization models, sorted in descending order of creation.
- [Create a new authorization model](https://openfga.dev/docs/api/service/authorization-models/create-a-new-authorization-model.md): The WriteAuthorizationModel API adds a new authorization model to a store. Each item in the `type_definitions` array is a type definition as specified in the field `type_definition`. The response returns the authorization model's ID in the `id` field.
- [Get an authorization model by its ID](https://openfga.dev/docs/api/service/authorization-models/get-an-authorization-model-by-its-id.md): The response returns the authorization model for the particular ID. Authorization Models in OpenFGA are [immutable](/docs/getting-started/immutable-models), new versions can be created, but existing ones cannot be deleted or modified.
- [Get all tuple changes](https://openfga.dev/docs/api/service/relationship-tuples/get-all-tuple-changes.md): The ReadChanges API returns a paginated list of tuple changes (additions and deletions) that occurred in a given store, sorted by ascending time. The response includes a continuation token that is used to get the next set of changes. If there are no changes after the provided continuation token, the…
- [Get stored relationship tuples](https://openfga.dev/docs/api/service/relationship-tuples/get-stored-relationship-tuples.md): The Read API returns the tuples from a certain store that match a query filter specified in the body of the request.  The API doesn't guarantee order by any field.  It is different from the `/stores/{store_id}/expand` API in that it only returns relationship tuples that are stored in the system and…
- [Add or delete tuples](https://openfga.dev/docs/api/service/relationship-tuples/add-or-delete-tuples.md): The Write API transactionally updates the tuples for a certain store. Tuples and type definitions allow OpenFGA to determine whether a relationship exists between an object and an user.
- [Check multiple authorizations in a single request](https://openfga.dev/docs/api/service/relationship-queries/check-multiple-authorizations-in-a-single-request.md): The `BatchCheck` API functions nearly identically to `Check`, but instead of checking a single user-object relationship BatchCheck accepts a list of relationships to check and returns a map containing `BatchCheckItem` response for each check it received.
- [Check user authorization](https://openfga.dev/docs/api/service/relationship-queries/check-user-authorization.md): The Check API returns whether a given user has a relationship with a given object in a given store.
- [Expand relationships in userset tree format](https://openfga.dev/docs/api/service/relationship-queries/expand-relationships-in-userset-tree-format.md): The Expand API returns all users and usersets that have certain relationship with an object in a certain store. This is different from the `/stores/{store_id}/read` API in that both users and computed usersets are returned.
- [List objects a user is related to](https://openfga.dev/docs/api/service/relationship-queries/list-objects-a-user-is-related-to.md): The ListObjects API returns a list of all the objects of the given type that the user has a relation with.  To arrive at a result, the API uses:
- [List all users with a relationship to an object](https://openfga.dev/docs/api/service/relationship-queries/list-all-users-with-a-relationship-to-an-object.md): The ListUsers API returns a list of all the users of a specific type that have a relation to a given object.
- [Stream all objects with a user relationship](https://openfga.dev/docs/api/service/relationship-queries/stream-all-objects-with-a-user-relationship.md): The Streamed ListObjects API is very similar to the the ListObjects API, with two differences:  1. Instead of collecting all objects before returning a response, it streams them to the client as they are collected.  2. The number of results returned is only limited by the execution timeout specified…
- [Get assertions for a model](https://openfga.dev/docs/api/service/assertions/get-assertions-for-a-model.md): The ReadAssertions API returns all the assertions stored for a given authorization model ID.
- [Upsert assertions for a model](https://openfga.dev/docs/api/service/assertions/upsert-assertions-for-a-model.md): The WriteAssertions API upserts new assertions for an authorization model id, or overwrite the existing ones. An assertion is an object that contains a tuple key, the expectation of whether a call to the Check API of that tuple key returns true or false, and optionally a list of contextual tuples.
- [[Experimental] Get AuthZEN PDP configuration and capabilities](https://openfga.dev/docs/api/service/authzenservice/[experimental]-get-authzen-pdp-configuration-and-capabilities.md): [Experimental] The GetConfiguration API returns metadata about the Policy Decision Point (PDP) including its name, version, supported endpoints, and capabilities. This endpoint follows the AuthZEN specification for PDP discovery.
- [[Experimental] Evaluate whether a subject can perform an action on a resource](https://openfga.dev/docs/api/service/authzenservice/[experimental]-evaluate-whether-a-subject-can-perform-an-action-on-a-resource.md): [Experimental] The Evaluation API determines whether a subject is authorized to perform an action on a resource. This endpoint implements the AuthZEN Access Evaluation API specification.
- [[Experimental] Check whether one or more users are authorized to access resources](https://openfga.dev/docs/api/service/authzenservice/[experimental]-check-whether-one-or-more-users-are-authorized-to-access-resources.md): [Experimental] The Evaluations API allows batch authorization checks in a single request. It supports request-level defaults for subject, action, resource, and context that can be overridden per evaluation item.
- [[Experimental] Search for actions a subject can perform on a resource](https://openfga.dev/docs/api/service/authzenservice/[experimental]-search-for-actions-a-subject-can-perform-on-a-resource.md): [Experimental] The ActionSearch API returns all actions (relations) that a subject can perform on a specific resource. This is useful for answering questions like "What can Anne do with this document?" or building dynamic UIs that show only the actions a user is permitted to perform.
- [[Experimental] Search for resources a subject has access to](https://openfga.dev/docs/api/service/authzenservice/[experimental]-search-for-resources-a-subject-has-access-to.md): [Experimental] The ResourceSearch API returns all resources of a given type that a subject has a specific action (relation) on. This is useful for answering questions like "What documents can Anne read?" or "What folders can Bob administer?"
- [[Experimental] Search for subjects with access to a resource](https://openfga.dev/docs/api/service/authzenservice/[experimental]-search-for-subjects-with-access-to-a-resource.md): [Experimental] The SubjectSearch API returns all subjects that have a specific action (relation) on a given resource. This is useful for answering questions like "Who can read this document?" or "Who can administer this folder?"

## OpenAPI Specs

- [apidocs.openapi](https://raw.githubusercontent.com/openfga/api/refs/heads/main/docs/openapiv3/apidocs.openapi.json)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.