using System.Collections.Generic;
using OpenFga.Sdk.Client;
using OpenFga.Sdk.Client.Model;
using OpenFga.Sdk.Configuration;
using OpenFga.Sdk.Model;
using Environment = System.Environment;
// FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region.
var fgaClient = new OpenFgaClient(new ClientConfiguration() {
ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL"),
StoreId = Environment.GetEnvironmentVariable("FGA_STORE_ID"),
AuthorizationModelId = Environment.GetEnvironmentVariable("FGA_MODEL_ID"),
Credentials = new Credentials() {
Method = CredentialsMethod.ClientCredentials,
Config = new CredentialsConfig() {
ApiTokenIssuer = Environment.GetEnvironmentVariable("FGA_API_TOKEN_ISSUER"),
ApiAudience = Environment.GetEnvironmentVariable("FGA_API_AUDIENCE"),
ClientId = Environment.GetEnvironmentVariable("FGA_CLIENT_ID"),
ClientSecret = Environment.GetEnvironmentVariable("FGA_CLIENT_SECRET"),
}
}
});
var body = new ClientBatchCheckRequest {
Checks = new List<ClientBatchCheckItem> {
new ClientBatchCheckItem {
User = "user:anne",
Relation = "reader",
Object = "document:budget",
CorrelationId = "budget-reader",
},
},
};
var options = new ClientBatchCheckOptions {
MaxBatchSize = 50,
MaxParallelRequests = 10,
};
var response = await fgaClient.BatchCheck(body, options);
import asyncio
import os
from openfga_sdk.client import OpenFgaClient, ClientConfiguration
from openfga_sdk.client.models import ClientBatchCheckItem, ClientBatchCheckRequest, ClientTuple
from openfga_sdk.models import RelationshipCondition
from openfga_sdk.credentials import Credentials, CredentialConfiguration
# FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region.
credentials = Credentials(
method='client_credentials',
configuration=CredentialConfiguration(
api_issuer=os.environ.get('FGA_API_TOKEN_ISSUER'),
api_audience=os.environ.get('FGA_API_AUDIENCE'),
client_id=os.environ.get('FGA_CLIENT_ID'),
client_secret=os.environ.get('FGA_CLIENT_SECRET'),
),
)
async def main():
configuration = ClientConfiguration(
api_url=os.environ.get('FGA_API_URL'),
store_id=os.environ.get('FGA_STORE_ID'),
authorization_model_id=os.environ.get('FGA_MODEL_ID'),
credentials=credentials,
)
async with OpenFgaClient(configuration) as fga_client:
body = ClientBatchCheckRequest(
checks=[
ClientBatchCheckItem(
user="user:anne",
relation="reader",
object="document:budget",
correlation_id="budget-reader",
)
],
)
options = {
}
response = await fga_client.batch_check(body, options)
asyncio.run(main())
import dev.openfga.sdk.api.client.OpenFgaClient;
import dev.openfga.sdk.api.configuration.ClientConfiguration;
import dev.openfga.sdk.api.configuration.ClientCredentials;
import dev.openfga.sdk.api.configuration.Credentials;
import dev.openfga.sdk.api.configuration.ClientCheckOptions;
import dev.openfga.sdk.api.configuration.ClientBatchCheckOptions;
import dev.openfga.sdk.api.configuration.ClientWriteOptions;
import dev.openfga.sdk.api.configuration.ClientListObjectsOptions;
import dev.openfga.sdk.api.configuration.ClientListUsersOptions;
import dev.openfga.sdk.api.client.model.*;
import dev.openfga.sdk.api.model.*;
import java.util.List;
import java.util.Map;
// FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region.
public class Example {
public static void main(String[] args) throws Exception {
var config = new ClientConfiguration()
.apiUrl(System.getenv("FGA_API_URL"))
.storeId(System.getenv("FGA_STORE_ID"))
.authorizationModelId(System.getenv("FGA_MODEL_ID"))
.credentials(new Credentials(new ClientCredentials()
.apiTokenIssuer(System.getenv("FGA_API_TOKEN_ISSUER"))
.apiAudience(System.getenv("FGA_API_AUDIENCE"))
.clientId(System.getenv("FGA_CLIENT_ID"))
.clientSecret(System.getenv("FGA_CLIENT_SECRET"))));
var fgaClient = new OpenFgaClient(config);
var body = new ClientBatchCheckRequest()
.checks(java.util.Arrays.asList(new ClientBatchCheckItem()
.user("user:anne")
.relation("reader")
._object("document:budget")
.correlationId("budget-reader")));
var options = new ClientBatchCheckOptions()
.maxBatchSize(50)
.maxParallelRequests(10);
var response = fgaClient.batchCheck(body, options).get();
}
}
# Set FGA_API_URL to your store region (https://api.us1.fga.dev, or eu1/au1).
# Set FGA_STORE_ID and obtain FGA_BEARER_TOKEN with the client credentials grant.
# See /integration/getting-your-api-keys; never put client secrets in source code.
curl -X POST "$FGA_API_URL/stores/$FGA_STORE_ID/batch-check" \
-H "authorization: Bearer $FGA_BEARER_TOKEN" \
-H "content-type: application/json" \
-d '{
"checks": [
{
"tuple_key": {
"user": "user:anne",
"relation": "reader",
"object": "document:budget"
},
"correlation_id": "budget-reader"
}
]
}'
{
"code": "internal_error",
"message": "Internal Server Error"
}
Relationship Queries
Check multiple authorizations in a single request
The BatchCheck API functions nearly identically to Check, but instead of checking a single user-object relationship BatchCheck accepts a list of relationships to check and returns a map containing BatchCheckItem response for each check it received.
An associated correlation_id is required for each check in the batch. This ID is used to correlate a check to the appropriate response. It is a string consisting of only alphanumeric characters or hyphens with a maximum length of 36 characters. This correlation_id is used to map the result of each check to the item which was checked, so it must be unique for each item in the batch. We recommend using a UUID or ULID as the correlation_id, but you can use whatever unique identifier you need as long as it matches this regex pattern: ^[\w\d-]{1,36}$
Note: The maximum number of checks that can be passed in a single BatchCheck request is 50. If BatchCheck is called using the SDK, the SDK can split the batch check requests for you.
For more details on how Check functions, review the Check docs.
Below is a possible response to the above request. Note that the result map’s keys are the correlation_id values from the checked items in the request:
using System.Collections.Generic;
using OpenFga.Sdk.Client;
using OpenFga.Sdk.Client.Model;
using OpenFga.Sdk.Configuration;
using OpenFga.Sdk.Model;
using Environment = System.Environment;
// FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region.
var fgaClient = new OpenFgaClient(new ClientConfiguration() {
ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL"),
StoreId = Environment.GetEnvironmentVariable("FGA_STORE_ID"),
AuthorizationModelId = Environment.GetEnvironmentVariable("FGA_MODEL_ID"),
Credentials = new Credentials() {
Method = CredentialsMethod.ClientCredentials,
Config = new CredentialsConfig() {
ApiTokenIssuer = Environment.GetEnvironmentVariable("FGA_API_TOKEN_ISSUER"),
ApiAudience = Environment.GetEnvironmentVariable("FGA_API_AUDIENCE"),
ClientId = Environment.GetEnvironmentVariable("FGA_CLIENT_ID"),
ClientSecret = Environment.GetEnvironmentVariable("FGA_CLIENT_SECRET"),
}
}
});
var body = new ClientBatchCheckRequest {
Checks = new List<ClientBatchCheckItem> {
new ClientBatchCheckItem {
User = "user:anne",
Relation = "reader",
Object = "document:budget",
CorrelationId = "budget-reader",
},
},
};
var options = new ClientBatchCheckOptions {
MaxBatchSize = 50,
MaxParallelRequests = 10,
};
var response = await fgaClient.BatchCheck(body, options);
import asyncio
import os
from openfga_sdk.client import OpenFgaClient, ClientConfiguration
from openfga_sdk.client.models import ClientBatchCheckItem, ClientBatchCheckRequest, ClientTuple
from openfga_sdk.models import RelationshipCondition
from openfga_sdk.credentials import Credentials, CredentialConfiguration
# FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region.
credentials = Credentials(
method='client_credentials',
configuration=CredentialConfiguration(
api_issuer=os.environ.get('FGA_API_TOKEN_ISSUER'),
api_audience=os.environ.get('FGA_API_AUDIENCE'),
client_id=os.environ.get('FGA_CLIENT_ID'),
client_secret=os.environ.get('FGA_CLIENT_SECRET'),
),
)
async def main():
configuration = ClientConfiguration(
api_url=os.environ.get('FGA_API_URL'),
store_id=os.environ.get('FGA_STORE_ID'),
authorization_model_id=os.environ.get('FGA_MODEL_ID'),
credentials=credentials,
)
async with OpenFgaClient(configuration) as fga_client:
body = ClientBatchCheckRequest(
checks=[
ClientBatchCheckItem(
user="user:anne",
relation="reader",
object="document:budget",
correlation_id="budget-reader",
)
],
)
options = {
}
response = await fga_client.batch_check(body, options)
asyncio.run(main())
import dev.openfga.sdk.api.client.OpenFgaClient;
import dev.openfga.sdk.api.configuration.ClientConfiguration;
import dev.openfga.sdk.api.configuration.ClientCredentials;
import dev.openfga.sdk.api.configuration.Credentials;
import dev.openfga.sdk.api.configuration.ClientCheckOptions;
import dev.openfga.sdk.api.configuration.ClientBatchCheckOptions;
import dev.openfga.sdk.api.configuration.ClientWriteOptions;
import dev.openfga.sdk.api.configuration.ClientListObjectsOptions;
import dev.openfga.sdk.api.configuration.ClientListUsersOptions;
import dev.openfga.sdk.api.client.model.*;
import dev.openfga.sdk.api.model.*;
import java.util.List;
import java.util.Map;
// FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region.
public class Example {
public static void main(String[] args) throws Exception {
var config = new ClientConfiguration()
.apiUrl(System.getenv("FGA_API_URL"))
.storeId(System.getenv("FGA_STORE_ID"))
.authorizationModelId(System.getenv("FGA_MODEL_ID"))
.credentials(new Credentials(new ClientCredentials()
.apiTokenIssuer(System.getenv("FGA_API_TOKEN_ISSUER"))
.apiAudience(System.getenv("FGA_API_AUDIENCE"))
.clientId(System.getenv("FGA_CLIENT_ID"))
.clientSecret(System.getenv("FGA_CLIENT_SECRET"))));
var fgaClient = new OpenFgaClient(config);
var body = new ClientBatchCheckRequest()
.checks(java.util.Arrays.asList(new ClientBatchCheckItem()
.user("user:anne")
.relation("reader")
._object("document:budget")
.correlationId("budget-reader")));
var options = new ClientBatchCheckOptions()
.maxBatchSize(50)
.maxParallelRequests(10);
var response = fgaClient.batchCheck(body, options).get();
}
}
# Set FGA_API_URL to your store region (https://api.us1.fga.dev, or eu1/au1).
# Set FGA_STORE_ID and obtain FGA_BEARER_TOKEN with the client credentials grant.
# See /integration/getting-your-api-keys; never put client secrets in source code.
curl -X POST "$FGA_API_URL/stores/$FGA_STORE_ID/batch-check" \
-H "authorization: Bearer $FGA_BEARER_TOKEN" \
-H "content-type: application/json" \
-d '{
"checks": [
{
"tuple_key": {
"user": "user:anne",
"relation": "reader",
"object": "document:budget"
},
"correlation_id": "budget-reader"
}
]
}'