> ## Documentation Index > Fetch the complete documentation index at: https://docs.fga.dev/llms.txt > Use this file to discover all available pages before exploring further. # Upsert assertions for an authorization model ID > The WriteAssertions API will upsert new assertions for an authorization model id, or overwrite the existing ones. An assertion is an object that contains a tuple key, and the expectation of whether a call to the Check API of that tuple key will return true or false. ## OpenAPI ````yaml oas/fga-api-oas.json PUT /stores/{store_id}/assertions/{authorization_model_id} openapi: 3.0.3 info: contact: name: Auth0 url: https://docs.fga.dev/support description: >- Auth0 Fine-Grained Authorization (FGA) enables developers to design authorization models, from coarse grained to fine grained, in a way that's centralized, flexible, fast, scalable, and easy to use. title: Auth0 Fine-Grained Authorization (FGA) version: '1' servers: - url: https://api.us1.fga.dev description: United States - url: https://api.eu1.fga.dev description: Europe - url: https://api.au1.fga.dev description: Australia security: [] tags: - name: Auth0FGAService paths: /stores/{store_id}/assertions/{authorization_model_id}: put: tags: - Assertions summary: Upsert assertions for an authorization model ID description: >- The WriteAssertions API will upsert new assertions for an authorization model id, or overwrite the existing ones. An assertion is an object that contains a tuple key, and the expectation of whether a call to the Check API of that tuple key will return true or false. operationId: WriteAssertions parameters: - in: path name: store_id required: true schema: type: string - in: path name: authorization_model_id required: true schema: type: string requestBody: content: application/json: schema: properties: assertions: items: $ref: '#/components/schemas/Assertion' maxItems: 100 type: array required: - assertions type: object required: true responses: '204': description: A successful response. '400': content: application/json: schema: $ref: >- #/components/schemas/errormessages.ValidationErrorMessageResponse description: Request failed due to invalid input. '401': content: application/json: schema: $ref: '#/components/schemas/AuthenticationErrorMessageResponse' description: Request failed due to authentication errors. '403': content: application/json: schema: $ref: '#/components/schemas/AuthenticationErrorMessageResponse' description: Request failed due to forbidden permission. '404': content: application/json: schema: $ref: >- #/components/schemas/errormessages.PathUnknownErrorMessageResponse description: Request failed due to incorrect path. '409': content: application/json: schema: $ref: '#/components/schemas/errormessages.AbortedMessageResponse' description: Request was aborted due a transaction conflict. '422': content: application/json: schema: $ref: >- #/components/schemas/errormessages.UnprocessableContentMessageResponse description: Request timeout due to throttling on complex query. '429': content: application/json: schema: $ref: '#/components/schemas/ResourceExhaustedErrorMessageResponse' description: Request failed due to too many requests. '500': content: application/json: schema: $ref: >- #/components/schemas/errormessages.InternalErrorMessageResponse description: Request failed due to internal server error. security: - ClientCredentials: - write:assertions x-codeSamples: - lang: javascript label: Node.js source: >- const { CredentialsMethod, OpenFgaClient, ConsistencyPreference } = require('@openfga/sdk'); const fgaClient = new OpenFgaClient({ apiUrl: process.env.FGA_API_URL, // https://api.us1.fga.dev, or your store's eu1/au1 region storeId: process.env.FGA_STORE_ID, authorizationModelId: process.env.FGA_MODEL_ID, credentials: { method: CredentialsMethod.ClientCredentials, config: { apiTokenIssuer: process.env.FGA_API_TOKEN_ISSUER, // auth.fga.dev apiAudience: process.env.FGA_API_AUDIENCE, // URL for your store's region clientId: process.env.FGA_CLIENT_ID, clientSecret: process.env.FGA_CLIENT_SECRET, }, }, }); async function main() { const body = [ { "user": "user:anne", "relation": "reader", "object": "document:budget", "expectation": true } ]; await fgaClient.writeAssertions(body); } main().catch((error) => { console.error(error); process.exitCode = 1; }); - lang: go label: Go source: >- package main import ( "context" "os" . "github.com/openfga/go-sdk/client" "github.com/openfga/go-sdk/credentials" ) // Configure FGA_API_URL and FGA_API_AUDIENCE for your store's us1/eu1/au1 region. // Set FGA_STORE_ID, FGA_MODEL_ID, FGA_API_TOKEN_ISSUER, FGA_CLIENT_ID, and FGA_CLIENT_SECRET. func main() { fgaClient, err := NewSdkClient(&ClientConfiguration{ ApiUrl: os.Getenv("FGA_API_URL"), StoreId: os.Getenv("FGA_STORE_ID"), AuthorizationModelId: os.Getenv("FGA_MODEL_ID"), Credentials: &credentials.Credentials{ Method: credentials.CredentialsMethodClientCredentials, Config: &credentials.Config{ ClientCredentialsApiTokenIssuer: os.Getenv("FGA_API_TOKEN_ISSUER"), ClientCredentialsApiAudience: os.Getenv("FGA_API_AUDIENCE"), ClientCredentialsClientId: os.Getenv("FGA_CLIENT_ID"), ClientCredentialsClientSecret: os.Getenv("FGA_CLIENT_SECRET"), }, }, }) if err != nil { panic(err) } body := ClientWriteAssertionsRequest{ { User: "user:anne", Relation: "reader", Object: "document:budget", Expectation: true, }, } _, err = fgaClient.WriteAssertions(context.Background()).Body(body).Execute() if err != nil { panic(err) } } - lang: csharp label: .NET source: >- using System.Collections.Generic; using OpenFga.Sdk.Client; using OpenFga.Sdk.Client.Model; using OpenFga.Sdk.Configuration; using OpenFga.Sdk.Model; using Environment = System.Environment; // FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region. var fgaClient = new OpenFgaClient(new ClientConfiguration() { ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL"), StoreId = Environment.GetEnvironmentVariable("FGA_STORE_ID"), AuthorizationModelId = Environment.GetEnvironmentVariable("FGA_MODEL_ID"), Credentials = new Credentials() { Method = CredentialsMethod.ClientCredentials, Config = new CredentialsConfig() { ApiTokenIssuer = Environment.GetEnvironmentVariable("FGA_API_TOKEN_ISSUER"), ApiAudience = Environment.GetEnvironmentVariable("FGA_API_AUDIENCE"), ClientId = Environment.GetEnvironmentVariable("FGA_CLIENT_ID"), ClientSecret = Environment.GetEnvironmentVariable("FGA_CLIENT_SECRET"), } } }); var body = new List { new ClientAssertion { User = "user:anne", Relation = "reader", Object = "document:budget", Expectation = true, } }; await fgaClient.WriteAssertions(body); - lang: python label: Python source: >- import asyncio import os from openfga_sdk.client import OpenFgaClient, ClientConfiguration from openfga_sdk.client.models import ClientCheckRequest, ClientTuple from openfga_sdk.models import RelationshipCondition from openfga_sdk.credentials import Credentials, CredentialConfiguration # FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region. credentials = Credentials( method='client_credentials', configuration=CredentialConfiguration( api_issuer=os.environ.get('FGA_API_TOKEN_ISSUER'), api_audience=os.environ.get('FGA_API_AUDIENCE'), client_id=os.environ.get('FGA_CLIENT_ID'), client_secret=os.environ.get('FGA_CLIENT_SECRET'), ), ) from openfga_sdk.client.models import ClientAssertion async def main(): configuration = ClientConfiguration( api_url=os.environ.get('FGA_API_URL'), store_id=os.environ.get('FGA_STORE_ID'), authorization_model_id=os.environ.get('FGA_MODEL_ID'), credentials=credentials, ) async with OpenFgaClient(configuration) as fga_client: body = [ClientAssertion( user="user:anne", relation="reader", object="document:budget", expectation=True, )] await fga_client.write_assertions(body=body) asyncio.run(main()) - lang: java label: Java source: >- import dev.openfga.sdk.api.client.OpenFgaClient; import dev.openfga.sdk.api.configuration.ClientConfiguration; import dev.openfga.sdk.api.configuration.ClientCredentials; import dev.openfga.sdk.api.configuration.Credentials; import dev.openfga.sdk.api.configuration.ClientCheckOptions; import dev.openfga.sdk.api.configuration.ClientBatchCheckOptions; import dev.openfga.sdk.api.configuration.ClientWriteOptions; import dev.openfga.sdk.api.configuration.ClientListObjectsOptions; import dev.openfga.sdk.api.configuration.ClientListUsersOptions; import dev.openfga.sdk.api.client.model.*; import dev.openfga.sdk.api.model.*; import java.util.List; import java.util.Map; // FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region. public class Example { public static void main(String[] args) throws Exception { var config = new ClientConfiguration() .apiUrl(System.getenv("FGA_API_URL")) .storeId(System.getenv("FGA_STORE_ID")) .authorizationModelId(System.getenv("FGA_MODEL_ID")) .credentials(new Credentials(new ClientCredentials() .apiTokenIssuer(System.getenv("FGA_API_TOKEN_ISSUER")) .apiAudience(System.getenv("FGA_API_AUDIENCE")) .clientId(System.getenv("FGA_CLIENT_ID")) .clientSecret(System.getenv("FGA_CLIENT_SECRET")))); var fgaClient = new OpenFgaClient(config); var body = List.of( new ClientAssertion() .user("user:anne") .relation("reader") ._object("document:budget") .expectation(true) ); fgaClient.writeAssertions(body).get(); } } - lang: bash label: curl source: >- # Set FGA_API_URL to your store region (https://api.us1.fga.dev, or eu1/au1). # Set FGA_STORE_ID and obtain FGA_BEARER_TOKEN with the client credentials grant. # See /integration/getting-your-api-keys; never put client secrets in source code. # Set FGA_MODEL_ID to the authorization model ID. curl -X PUT "$FGA_API_URL/stores/$FGA_STORE_ID/assertions/$FGA_MODEL_ID" \ -H "authorization: Bearer $FGA_BEARER_TOKEN" \ -H "content-type: application/json" \ -d '{ "assertions": [ { "tuple_key": { "user": "user:anne", "relation": "reader", "object": "document:budget" }, "expectation": true } ] }' components: schemas: Assertion: properties: context: description: >- Additional request context that will be used to evaluate any ABAC conditions encountered in the query evaluation. example: view_count: 100 type: object contextual_tuples: items: $ref: '#/components/schemas/TupleKey' maxItems: 20 type: array expectation: type: boolean tuple_key: $ref: '#/components/schemas/AssertionTupleKey' required: - tuple_key - expectation type: object errormessages.ValidationErrorMessageResponse: example: code: validation_error message: Generic validation error properties: code: $ref: '#/components/schemas/errormessages.ErrorCode' message: type: string type: object AuthenticationErrorMessageResponse: example: code: unauthorized_principal message: Missing permissions to perform operation properties: code: $ref: '#/components/schemas/errormessages.AuthErrorCode' message: type: string type: object errormessages.PathUnknownErrorMessageResponse: example: code: undefined_endpoint message: Endpoint not enabled properties: code: $ref: '#/components/schemas/errormessages.NotFoundErrorCode' message: type: string type: object errormessages.AbortedMessageResponse: example: code: '10' message: transaction conflict properties: code: type: string message: type: string type: object errormessages.UnprocessableContentMessageResponse: example: code: throttled_timeout_error message: timeout due to throttling on complex request properties: code: $ref: '#/components/schemas/errormessages.UnprocessableContentErrorCode' message: type: string type: object ResourceExhaustedErrorMessageResponse: example: code: rate_limit_exceeded message: Rate Limit exceeded properties: code: $ref: '#/components/schemas/ResourceExhaustedErrorCode' message: type: string type: object errormessages.InternalErrorMessageResponse: example: code: internal_error message: Internal Server Error properties: code: $ref: '#/components/schemas/errormessages.InternalErrorCode' message: type: string type: object TupleKey: properties: condition: $ref: '#/components/schemas/RelationshipCondition' object: example: document:2021-budget maxLength: 256 type: string relation: example: reader maxLength: 50 type: string user: example: user:anne maxLength: 512 type: string required: - user - relation - object type: object AssertionTupleKey: properties: object: example: document:2021-budget maxLength: 256 type: string relation: example: reader maxLength: 50 type: string user: example: user:anne maxLength: 512 type: string required: - object - relation - user type: object errormessages.ErrorCode: default: no_error description: |- - no_error: no error - validation_error: generic validation error. - authorization_model_not_found: authorization model not found. - authorization_model_resolution_too_complex: too many rewrite rules to be resolved. - invalid_write_input: invalid write input. - cannot_allow_duplicate_tuples_in_one_request: duplicate tuples in one request. - cannot_allow_duplicate_types_in_one_request: duplicate types in one request. - cannot_allow_multiple_references_to_one_relation: cannot use a relation to define itself. - invalid_continuation_token: invalid continuation token. - invalid_tuple_set: invalid tuple set. - invalid_check_input: invalid check input. - invalid_expand_input: invalid expand input. - unsupported_user_set: unsupported user set. - invalid_object_format: invalid object format. - token_issuer_already_registered: token issuers already registered. - write_failed_due_to_invalid_input: write request failed due to invalid input. - authorization_model_assertions_not_found: no assertions found for authorization model. - latest_authorization_model_not_found: latest authorization model not found. - type_not_found: type not found. - relation_not_found: relation not found. - empty_relation_definition: empty relation definition. - invalid_user: invalid user. - invalid_token_issuer: invalid token issuer. - invalid_tuple: invalid tuple. - unknown_relation: unknown relation. - store_id_invalid_length: store id has invalid length. - issuer_url_invalid_uri: issuer url has invalid URI. - issuer_url_required_absolute_path: issuer url is not absolute path. - assertions_too_many_items: assertions have too many items. - id_too_long: ID is too long. - invalid_environment: invalid environment is specified. - authorization_model_id_too_long: authorization model id is too long. - tuple_key_value_not_specified: tuple key value is not specified. - tuple_keys_too_many_or_too_few_items: tuple keys have too few or too many items. - page_size_invalid: page size is outside of acceptable range. - param_missing_value: params value is missing. - difference_base_missing_value: difference's base value is missing. - subtract_base_missing_value: subtract base value is missing. - object_too_long: object length is too long. - relation_too_long: relation length is too long. - type_definitions_too_few_items: type definitions do not have enough item. - type_invalid_length: type length is invalid. - type_invalid_pattern: type does not match expected pattern. - relations_too_few_items: relations have too few items. - relations_too_long: relations' length is too long. - relations_invalid_pattern: relations do not match expected pattern. - object_invalid_pattern: object does not match expected pattern. - query_string_type_continuation_token_mismatch: type in the query string and the continuation token don't match. - invalid_contextual_tuple: Invalid contextual tuple. - duplicate_contextual_tuple: Duplicate contextual tuple. enum: - no_error - validation_error - authorization_model_not_found - authorization_model_resolution_too_complex - invalid_write_input - cannot_allow_duplicate_tuples_in_one_request - cannot_allow_duplicate_types_in_one_request - cannot_allow_multiple_references_to_one_relation - invalid_continuation_token - invalid_tuple_set - invalid_check_input - invalid_expand_input - unsupported_user_set - invalid_object_format - token_issuer_already_registered - write_failed_due_to_invalid_input - authorization_model_assertions_not_found - latest_authorization_model_not_found - type_not_found - relation_not_found - empty_relation_definition - invalid_user - invalid_token_issuer - invalid_tuple - unknown_relation - store_id_invalid_length - issuer_url_invalid_uri - issuer_url_required_absolute_path - assertions_too_many_items - id_too_long - invalid_environment - authorization_model_id_too_long - tuple_key_value_not_specified - tuple_keys_too_many_or_too_few_items - page_size_invalid - param_missing_value - difference_base_missing_value - subtract_base_missing_value - object_too_long - relation_too_long - type_definitions_too_few_items - type_invalid_length - type_invalid_pattern - relations_too_few_items - relations_too_long - relations_invalid_pattern - object_invalid_pattern - query_string_type_continuation_token_mismatch - invalid_contextual_tuple - duplicate_contextual_tuple title: ErrorCodeEnums type: string errormessages.AuthErrorCode: default: no_auth_error description: |- - no_auth_error: no error - auth_failure: generic authentication error. Details available via message field. - auth_failed_invalid_subject: authentication failure due to invalid subject. - auth_failed_invalid_audience: authentication failure due to invalid audience. - auth_failed_invalid_issuer: authentication failure due to invalid issuer. - invalid_claims: authentication failure due to invalid claims. - auth_failed_invalid_bearer_token: authentication failure due to invalid bearer token. - missing_customer_in_bearer_token: authentication failure with customer id missing in bearer token. - missing_store_in_bearer_token: authentication failure with store id missing in bearer token. - store_mismatch_in_bearer_token: authentication failure due to store mismatch from bearer token. - customer_mismatch_in_bearer_token: authentication failure due to customer id in the request being different from the customer id in the bearer token. - bearer_token_missing: bearer token missing in request. - unauthenticated: unauthenticated. - insufficient_permissions: insufficient permissions. - unauthorized_principal: authentication denial due to unauthorized principal. enum: - no_auth_error - auth_failure - auth_failed_invalid_subject - auth_failed_invalid_audience - auth_failed_invalid_issuer - invalid_claims - auth_failed_invalid_bearer_token - missing_customer_in_bearer_token - missing_store_in_bearer_token - store_mismatch_in_bearer_token - customer_mismatch_in_bearer_token - bearer_token_missing - unauthenticated - insufficient_permissions - unauthorized_principal title: AuthErrorCodeEnums type: string errormessages.NotFoundErrorCode: default: no_not_found_error description: |- - no_not_found_error: no error - undefined_endpoint: undefined endpoint. - store_id_not_found: store ID not found - resource_not_found: generic not found. - unimplemented: method is unimplemented enum: - no_not_found_error - undefined_endpoint - store_id_not_found - resource_not_found - unimplemented title: NotFoundErrorCodeEnums type: string errormessages.UnprocessableContentErrorCode: default: no_throttled_error_code enum: - no_throttled_error_code - throttled_timeout_error title: |- - no_throttled_error_code: no error - throttled_timeout_error: 3500 level errors are timeout due to throttling type: string ResourceExhaustedErrorCode: default: no_resource_exhausted_error description: |- - no_resource_exhausted_error: no error - rate_limit_exceeded: operation failed due to exceeding rate limit. - auth_rate_limit_exceeded: rate limit error during authentication. enum: - no_resource_exhausted_error - rate_limit_exceeded - auth_rate_limit_exceeded title: ResourceExhaustedErrorCodeEnums type: string errormessages.InternalErrorCode: default: no_internal_error description: |- - no_internal_error: no error - internal_error: generic internal error. - auth_internal_error: internal error due to authentication error. - auth_failed_error_fetching_well_known_jwks: authentication failure due to internal error in fetching well-known/jwks.json. - cancelled: internal error - request being cancelled. - deadline_exceeded: internal error - deadline exceeded. - already_exists: internal error - already exists. - resource_exhausted: internal error - resource exhausted. - failed_precondition: internal error - failed precondition. - aborted: internal error - aborted. - out_of_range: internal error - out of range. - unavailable: internal error - unavailable. - data_loss: internal error - data loss. enum: - no_internal_error - internal_error - auth_internal_error - auth_failed_error_fetching_well_known_jwks - cancelled - deadline_exceeded - already_exists - resource_exhausted - failed_precondition - aborted - out_of_range - unavailable - data_loss title: InternalErrorCodeEnums type: string RelationshipCondition: properties: context: description: >- Additional context/data to persist along with the condition. The keys must match the parameters defined by the condition, and the value types must match the parameter type definitions. type: object name: description: >- A reference (by name) of the relationship condition defined in the authorization model. example: condition1 maxLength: 256 type: string required: - name type: object securitySchemes: ClientCredentials: flows: clientCredentials: scopes: check:tuples: Allows checking tuples create:stores: Allows creation of stores delete:stores: Allows deletion of stores expand:tuples: Allows expanding tuples list:objects: Allows reading results of list objects list:users: Allows reading results of list users read:assertions: Allows reading assertions read:authorization_models: Allows reading authorization models read:changes: Allows reading changes read:expansions: Allows reading index expansions read:indexes: Allows reading permission indexes read:stores: Allows reading of stores read:tuples: Allows reading tuples search:logs: Allows searching store logs write:assertions: Allows updating assertions write:authorization_models: Allows writing authorization models write:tuples: Allows writing tuples tokenUrl: https://auth.fga.dev/oauth/token type: oauth2 ````