> ## Documentation Index > Fetch the complete documentation index at: https://docs.fga.dev/llms.txt > Use this file to discover all available pages before exploring further. # Check whether a user is authorized to access an object > The Check API returns whether a given user has a relationship with a given object in a given store. The `user` field of the request can be a specific target, such as `user:anne`, or a userset (set of users) such as `group:marketing#member` or a type-bound public access `user:*`. To arrive at a result, the API uses: an authorization model, explicit tuples written through the Write API, contextual tuples present in the request, and implicit tuples that exist by virtue of applying set theory (such as `document:2021-budget#viewer@document:2021-budget#viewer`; the set of users who are viewers of `document:2021-budget` are the set of users who are the viewers of `document:2021-budget`). A `contextual_tuples` object may also be included in the body of the request. This object contains one field `tuple_keys`, which is an array of tuple keys. Each of these tuples may have an associated `condition`. You may also provide an `authorization_model_id` in the body. This will be used to assert that the input `tuple_key` is valid for the model specified. If not specified, the assertion will be made against the latest authorization model ID. It is strongly recommended to specify authorization model id for better performance. You may also provide a `context` object that will be used to evaluate the conditioned tuples in the system. It is strongly recommended to provide a value for all the input parameters of all the conditions, to ensure that all tuples be evaluated correctly. By default, the Check API caches results for a short time to optimize performance. You may specify a value of `HIGHER_CONSISTENCY` for the optional `consistency` parameter in the body to inform the server that higher consistency is preferred at the expense of increased latency. Consideration should be given to the increased latency if requesting higher consistency. The response will return whether the relationship exists in the field `allowed`. Some exceptions apply, but in general, if a Check API responds with `{allowed: true}`, then you can expect the equivalent ListObjects query to return the object, and viceversa. For example, if `Check(user:anne, reader, document:2021-budget)` responds with `{allowed: true}`, then `ListObjects(user:anne, reader, document)` may include `document:2021-budget` in the response. ## Examples ### Querying with contextual tuples In order to check if user `user:anne` of type `user` has a `reader` relationship with object `document:2021-budget` given the following contextual tuple ```json { "user": "user:anne", "relation": "member", "object": "time_slot:office_hours" } ``` the Check API can be used with the following request body: ```json { "tuple_key": { "user": "user:anne", "relation": "reader", "object": "document:2021-budget" }, "contextual_tuples": { "tuple_keys": [ { "user": "user:anne", "relation": "member", "object": "time_slot:office_hours" } ] }, "authorization_model_id": "01G50QVV17PECNVAHX1GG4Y5NC" } ``` ### Querying usersets Some Checks will always return `true`, even without any tuples. For example, for the following authorization model ```python model schema 1.1 type user type document relations define reader: [user] ``` the following query ```json { "tuple_key": { "user": "document:2021-budget#reader", "relation": "reader", "object": "document:2021-budget" } } ``` will always return `{ "allowed": true }`. This is because usersets are self-defining: the userset `document:2021-budget#reader` will always have the `reader` relation with `document:2021-budget`. ### Querying usersets with difference in the model A Check for a userset can yield results that must be treated carefully if the model involves difference. For example, for the following authorization model ```python model schema 1.1 type user type group relations define member: [user] type document relations define blocked: [user] define reader: [group#member] but not blocked ``` the following query ```json { "tuple_key": { "user": "group:finance#member", "relation": "reader", "object": "document:2021-budget" }, "contextual_tuples": { "tuple_keys": [ { "user": "user:anne", "relation": "member", "object": "group:finance" }, { "user": "group:finance#member", "relation": "reader", "object": "document:2021-budget" }, { "user": "user:anne", "relation": "blocked", "object": "document:2021-budget" } ] }, } ``` will return `{ "allowed": true }`, even though a specific user of the userset `group:finance#member` does not have the `reader` relationship with the given object. ### Requesting higher consistency By default, the Check API caches results for a short time to optimize performance. You may request higher consistency to inform the server that higher consistency should be preferred at the expense of increased latency. Care should be taken when requesting higher consistency due to the increased latency. ```json { "tuple_key": { "user": "group:finance#member", "relation": "reader", "object": "document:2021-budget" }, "consistency": "HIGHER_CONSISTENCY" } ``` ## OpenAPI ````yaml oas/fga-api-oas.json POST /stores/{store_id}/check openapi: 3.0.3 info: contact: name: Auth0 url: https://docs.fga.dev/support description: >- Auth0 Fine-Grained Authorization (FGA) enables developers to design authorization models, from coarse grained to fine grained, in a way that's centralized, flexible, fast, scalable, and easy to use. title: Auth0 Fine-Grained Authorization (FGA) version: '1' servers: - url: https://api.us1.fga.dev description: United States - url: https://api.eu1.fga.dev description: Europe - url: https://api.au1.fga.dev description: Australia security: [] tags: - name: Auth0FGAService paths: /stores/{store_id}/check: post: tags: - Relationship Queries summary: Check whether a user is authorized to access an object description: > The Check API returns whether a given user has a relationship with a given object in a given store. The `user` field of the request can be a specific target, such as `user:anne`, or a userset (set of users) such as `group:marketing#member` or a type-bound public access `user:*`. To arrive at a result, the API uses: an authorization model, explicit tuples written through the Write API, contextual tuples present in the request, and implicit tuples that exist by virtue of applying set theory (such as `document:2021-budget#viewer@document:2021-budget#viewer`; the set of users who are viewers of `document:2021-budget` are the set of users who are the viewers of `document:2021-budget`). A `contextual_tuples` object may also be included in the body of the request. This object contains one field `tuple_keys`, which is an array of tuple keys. Each of these tuples may have an associated `condition`. You may also provide an `authorization_model_id` in the body. This will be used to assert that the input `tuple_key` is valid for the model specified. If not specified, the assertion will be made against the latest authorization model ID. It is strongly recommended to specify authorization model id for better performance. You may also provide a `context` object that will be used to evaluate the conditioned tuples in the system. It is strongly recommended to provide a value for all the input parameters of all the conditions, to ensure that all tuples be evaluated correctly. By default, the Check API caches results for a short time to optimize performance. You may specify a value of `HIGHER_CONSISTENCY` for the optional `consistency` parameter in the body to inform the server that higher consistency is preferred at the expense of increased latency. Consideration should be given to the increased latency if requesting higher consistency. The response will return whether the relationship exists in the field `allowed`. Some exceptions apply, but in general, if a Check API responds with `{allowed: true}`, then you can expect the equivalent ListObjects query to return the object, and viceversa. For example, if `Check(user:anne, reader, document:2021-budget)` responds with `{allowed: true}`, then `ListObjects(user:anne, reader, document)` may include `document:2021-budget` in the response. ## Examples ### Querying with contextual tuples In order to check if user `user:anne` of type `user` has a `reader` relationship with object `document:2021-budget` given the following contextual tuple ```json { "user": "user:anne", "relation": "member", "object": "time_slot:office_hours" } ``` the Check API can be used with the following request body: ```json { "tuple_key": { "user": "user:anne", "relation": "reader", "object": "document:2021-budget" }, "contextual_tuples": { "tuple_keys": [ { "user": "user:anne", "relation": "member", "object": "time_slot:office_hours" } ] }, "authorization_model_id": "01G50QVV17PECNVAHX1GG4Y5NC" } ``` ### Querying usersets Some Checks will always return `true`, even without any tuples. For example, for the following authorization model ```python model schema 1.1 type user type document relations define reader: [user] ``` the following query ```json { "tuple_key": { "user": "document:2021-budget#reader", "relation": "reader", "object": "document:2021-budget" } } ``` will always return `{ "allowed": true }`. This is because usersets are self-defining: the userset `document:2021-budget#reader` will always have the `reader` relation with `document:2021-budget`. ### Querying usersets with difference in the model A Check for a userset can yield results that must be treated carefully if the model involves difference. For example, for the following authorization model ```python model schema 1.1 type user type group relations define member: [user] type document relations define blocked: [user] define reader: [group#member] but not blocked ``` the following query ```json { "tuple_key": { "user": "group:finance#member", "relation": "reader", "object": "document:2021-budget" }, "contextual_tuples": { "tuple_keys": [ { "user": "user:anne", "relation": "member", "object": "group:finance" }, { "user": "group:finance#member", "relation": "reader", "object": "document:2021-budget" }, { "user": "user:anne", "relation": "blocked", "object": "document:2021-budget" } ] }, } ``` will return `{ "allowed": true }`, even though a specific user of the userset `group:finance#member` does not have the `reader` relationship with the given object. ### Requesting higher consistency By default, the Check API caches results for a short time to optimize performance. You may request higher consistency to inform the server that higher consistency should be preferred at the expense of increased latency. Care should be taken when requesting higher consistency due to the increased latency. ```json { "tuple_key": { "user": "group:finance#member", "relation": "reader", "object": "document:2021-budget" }, "consistency": "HIGHER_CONSISTENCY" } ``` operationId: Check parameters: - in: path name: store_id required: true schema: type: string requestBody: content: application/json: schema: properties: authorization_model_id: example: 01G5JAVJ41T49E9TT3SKVS7X1J type: string consistency: allOf: - $ref: '#/components/schemas/ConsistencyPreference' - description: >- Controls the consistency preference for this request. Default value is UNSPECIFIED, which will have the same behavior as MINIMIZE_LATENCY. context: description: >- Additional request context that will be used to evaluate any ABAC conditions encountered in the query evaluation. type: object contextual_tuples: $ref: '#/components/schemas/ContextualTupleKeys' trace: description: >- Defaults to false. Making it true has performance implications. example: false readOnly: true type: boolean tuple_key: $ref: '#/components/schemas/CheckRequestTupleKey' required: - tuple_key type: object required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/CheckResponse' description: A successful response. '400': content: application/json: schema: $ref: >- #/components/schemas/errormessages.ValidationErrorMessageResponse description: Request failed due to invalid input. '401': content: application/json: schema: $ref: '#/components/schemas/AuthenticationErrorMessageResponse' description: Request failed due to authentication errors. '403': content: application/json: schema: $ref: '#/components/schemas/AuthenticationErrorMessageResponse' description: Request failed due to forbidden permission. '404': content: application/json: schema: $ref: >- #/components/schemas/errormessages.PathUnknownErrorMessageResponse description: Request failed due to incorrect path. '409': content: application/json: schema: $ref: '#/components/schemas/errormessages.AbortedMessageResponse' description: Request was aborted due a transaction conflict. '422': content: application/json: schema: $ref: >- #/components/schemas/errormessages.UnprocessableContentMessageResponse description: Request timeout due to throttling on complex query. '429': content: application/json: schema: $ref: '#/components/schemas/ResourceExhaustedErrorMessageResponse' description: Request failed due to too many requests. '500': content: application/json: schema: $ref: >- #/components/schemas/errormessages.InternalErrorMessageResponse description: Request failed due to internal server error. security: - ClientCredentials: - check:tuples x-codeSamples: - lang: javascript label: Node.js source: >- const { CredentialsMethod, OpenFgaClient, ConsistencyPreference } = require('@openfga/sdk'); const fgaClient = new OpenFgaClient({ apiUrl: process.env.FGA_API_URL, // https://api.us1.fga.dev, or your store's eu1/au1 region storeId: process.env.FGA_STORE_ID, authorizationModelId: process.env.FGA_MODEL_ID, credentials: { method: CredentialsMethod.ClientCredentials, config: { apiTokenIssuer: process.env.FGA_API_TOKEN_ISSUER, // auth.fga.dev apiAudience: process.env.FGA_API_AUDIENCE, // URL for your store's region clientId: process.env.FGA_CLIENT_ID, clientSecret: process.env.FGA_CLIENT_SECRET, }, }, }); async function main() { const body = { "user": "user:anne", "relation": "reader", "object": "document:budget" }; const options = { }; const response = await fgaClient.check(body, options); } main().catch((error) => { console.error(error); process.exitCode = 1; }); - lang: go label: Go source: >- package main import ( "context" "os" . "github.com/openfga/go-sdk/client" "github.com/openfga/go-sdk/credentials" ) // Configure FGA_API_URL and FGA_API_AUDIENCE for your store's us1/eu1/au1 region. // Set FGA_STORE_ID, FGA_MODEL_ID, FGA_API_TOKEN_ISSUER, FGA_CLIENT_ID, and FGA_CLIENT_SECRET. func main() { fgaClient, err := NewSdkClient(&ClientConfiguration{ ApiUrl: os.Getenv("FGA_API_URL"), StoreId: os.Getenv("FGA_STORE_ID"), AuthorizationModelId: os.Getenv("FGA_MODEL_ID"), Credentials: &credentials.Credentials{ Method: credentials.CredentialsMethodClientCredentials, Config: &credentials.Config{ ClientCredentialsApiTokenIssuer: os.Getenv("FGA_API_TOKEN_ISSUER"), ClientCredentialsApiAudience: os.Getenv("FGA_API_AUDIENCE"), ClientCredentialsClientId: os.Getenv("FGA_CLIENT_ID"), ClientCredentialsClientSecret: os.Getenv("FGA_CLIENT_SECRET"), }, }, }) if err != nil { panic(err) } body := ClientCheckRequest{ User: "user:anne", Relation: "reader", Object: "document:budget", } options := ClientCheckOptions{ } data, err := fgaClient.Check(context.Background()).Body(body).Options(options).Execute() if err != nil { panic(err) } _ = data } - lang: csharp label: .NET source: >- using System.Collections.Generic; using OpenFga.Sdk.Client; using OpenFga.Sdk.Client.Model; using OpenFga.Sdk.Configuration; using OpenFga.Sdk.Model; using Environment = System.Environment; // FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region. var fgaClient = new OpenFgaClient(new ClientConfiguration() { ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL"), StoreId = Environment.GetEnvironmentVariable("FGA_STORE_ID"), AuthorizationModelId = Environment.GetEnvironmentVariable("FGA_MODEL_ID"), Credentials = new Credentials() { Method = CredentialsMethod.ClientCredentials, Config = new CredentialsConfig() { ApiTokenIssuer = Environment.GetEnvironmentVariable("FGA_API_TOKEN_ISSUER"), ApiAudience = Environment.GetEnvironmentVariable("FGA_API_AUDIENCE"), ClientId = Environment.GetEnvironmentVariable("FGA_CLIENT_ID"), ClientSecret = Environment.GetEnvironmentVariable("FGA_CLIENT_SECRET"), } } }); var body = new ClientCheckRequest { User = "user:anne", Relation = "reader", Object = "document:budget", }; var options = new ClientCheckOptions { }; var response = await fgaClient.Check(body, options); - lang: python label: Python source: >- import asyncio import os from openfga_sdk.client import OpenFgaClient, ClientConfiguration from openfga_sdk.client.models import ClientCheckRequest, ClientTuple from openfga_sdk.models import RelationshipCondition from openfga_sdk.credentials import Credentials, CredentialConfiguration # FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region. credentials = Credentials( method='client_credentials', configuration=CredentialConfiguration( api_issuer=os.environ.get('FGA_API_TOKEN_ISSUER'), api_audience=os.environ.get('FGA_API_AUDIENCE'), client_id=os.environ.get('FGA_CLIENT_ID'), client_secret=os.environ.get('FGA_CLIENT_SECRET'), ), ) async def main(): configuration = ClientConfiguration( api_url=os.environ.get('FGA_API_URL'), store_id=os.environ.get('FGA_STORE_ID'), authorization_model_id=os.environ.get('FGA_MODEL_ID'), credentials=credentials, ) async with OpenFgaClient(configuration) as fga_client: body = ClientCheckRequest( user="user:anne", relation="reader", object="document:budget", ) options = { } response = await fga_client.check(body, options) asyncio.run(main()) - lang: java label: Java source: >- import dev.openfga.sdk.api.client.OpenFgaClient; import dev.openfga.sdk.api.configuration.ClientConfiguration; import dev.openfga.sdk.api.configuration.ClientCredentials; import dev.openfga.sdk.api.configuration.Credentials; import dev.openfga.sdk.api.configuration.ClientCheckOptions; import dev.openfga.sdk.api.configuration.ClientBatchCheckOptions; import dev.openfga.sdk.api.configuration.ClientWriteOptions; import dev.openfga.sdk.api.configuration.ClientListObjectsOptions; import dev.openfga.sdk.api.configuration.ClientListUsersOptions; import dev.openfga.sdk.api.client.model.*; import dev.openfga.sdk.api.model.*; import java.util.List; import java.util.Map; // FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region. public class Example { public static void main(String[] args) throws Exception { var config = new ClientConfiguration() .apiUrl(System.getenv("FGA_API_URL")) .storeId(System.getenv("FGA_STORE_ID")) .authorizationModelId(System.getenv("FGA_MODEL_ID")) .credentials(new Credentials(new ClientCredentials() .apiTokenIssuer(System.getenv("FGA_API_TOKEN_ISSUER")) .apiAudience(System.getenv("FGA_API_AUDIENCE")) .clientId(System.getenv("FGA_CLIENT_ID")) .clientSecret(System.getenv("FGA_CLIENT_SECRET")))); var fgaClient = new OpenFgaClient(config); var body = new ClientCheckRequest() .user("user:anne") .relation("reader") ._object("document:budget"); var options = new ClientCheckOptions(); var response = fgaClient.check(body, options).get(); } } - lang: bash label: curl source: >- # Set FGA_API_URL to your store region (https://api.us1.fga.dev, or eu1/au1). # Set FGA_STORE_ID and obtain FGA_BEARER_TOKEN with the client credentials grant. # See /integration/getting-your-api-keys; never put client secrets in source code. curl -X POST "$FGA_API_URL/stores/$FGA_STORE_ID/check" \ -H "authorization: Bearer $FGA_BEARER_TOKEN" \ -H "content-type: application/json" \ -d '{ "tuple_key": { "user": "user:anne", "relation": "reader", "object": "document:budget" } }' components: schemas: ConsistencyPreference: default: UNSPECIFIED description: |- Controls the consistency preferences when calling the query APIs. - UNSPECIFIED: Default if not set. Behavior will be the same as MINIMIZE_LATENCY. - MINIMIZE_LATENCY: Minimize latency at the potential expense of lower consistency. - HIGHER_CONSISTENCY: Prefer higher consistency, at the potential expense of increased latency. enum: - UNSPECIFIED - MINIMIZE_LATENCY - HIGHER_CONSISTENCY example: MINIMIZE_LATENCY type: string ContextualTupleKeys: properties: tuple_keys: items: $ref: '#/components/schemas/TupleKey' maxItems: 100 type: array required: - tuple_keys type: object CheckRequestTupleKey: properties: object: example: document:2021-budget maxLength: 256 type: string relation: example: reader maxLength: 50 type: string user: example: user:anne maxLength: 512 type: string required: - user - relation - object type: object CheckResponse: properties: allowed: example: true type: boolean resolution: description: For internal use only. type: string type: object errormessages.ValidationErrorMessageResponse: example: code: validation_error message: Generic validation error properties: code: $ref: '#/components/schemas/errormessages.ErrorCode' message: type: string type: object AuthenticationErrorMessageResponse: example: code: unauthorized_principal message: Missing permissions to perform operation properties: code: $ref: '#/components/schemas/errormessages.AuthErrorCode' message: type: string type: object errormessages.PathUnknownErrorMessageResponse: example: code: undefined_endpoint message: Endpoint not enabled properties: code: $ref: '#/components/schemas/errormessages.NotFoundErrorCode' message: type: string type: object errormessages.AbortedMessageResponse: example: code: '10' message: transaction conflict properties: code: type: string message: type: string type: object errormessages.UnprocessableContentMessageResponse: example: code: throttled_timeout_error message: timeout due to throttling on complex request properties: code: $ref: '#/components/schemas/errormessages.UnprocessableContentErrorCode' message: type: string type: object ResourceExhaustedErrorMessageResponse: example: code: rate_limit_exceeded message: Rate Limit exceeded properties: code: $ref: '#/components/schemas/ResourceExhaustedErrorCode' message: type: string type: object errormessages.InternalErrorMessageResponse: example: code: internal_error message: Internal Server Error properties: code: $ref: '#/components/schemas/errormessages.InternalErrorCode' message: type: string type: object TupleKey: properties: condition: $ref: '#/components/schemas/RelationshipCondition' object: example: document:2021-budget maxLength: 256 type: string relation: example: reader maxLength: 50 type: string user: example: user:anne maxLength: 512 type: string required: - user - relation - object type: object errormessages.ErrorCode: default: no_error description: |- - no_error: no error - validation_error: generic validation error. - authorization_model_not_found: authorization model not found. - authorization_model_resolution_too_complex: too many rewrite rules to be resolved. - invalid_write_input: invalid write input. - cannot_allow_duplicate_tuples_in_one_request: duplicate tuples in one request. - cannot_allow_duplicate_types_in_one_request: duplicate types in one request. - cannot_allow_multiple_references_to_one_relation: cannot use a relation to define itself. - invalid_continuation_token: invalid continuation token. - invalid_tuple_set: invalid tuple set. - invalid_check_input: invalid check input. - invalid_expand_input: invalid expand input. - unsupported_user_set: unsupported user set. - invalid_object_format: invalid object format. - token_issuer_already_registered: token issuers already registered. - write_failed_due_to_invalid_input: write request failed due to invalid input. - authorization_model_assertions_not_found: no assertions found for authorization model. - latest_authorization_model_not_found: latest authorization model not found. - type_not_found: type not found. - relation_not_found: relation not found. - empty_relation_definition: empty relation definition. - invalid_user: invalid user. - invalid_token_issuer: invalid token issuer. - invalid_tuple: invalid tuple. - unknown_relation: unknown relation. - store_id_invalid_length: store id has invalid length. - issuer_url_invalid_uri: issuer url has invalid URI. - issuer_url_required_absolute_path: issuer url is not absolute path. - assertions_too_many_items: assertions have too many items. - id_too_long: ID is too long. - invalid_environment: invalid environment is specified. - authorization_model_id_too_long: authorization model id is too long. - tuple_key_value_not_specified: tuple key value is not specified. - tuple_keys_too_many_or_too_few_items: tuple keys have too few or too many items. - page_size_invalid: page size is outside of acceptable range. - param_missing_value: params value is missing. - difference_base_missing_value: difference's base value is missing. - subtract_base_missing_value: subtract base value is missing. - object_too_long: object length is too long. - relation_too_long: relation length is too long. - type_definitions_too_few_items: type definitions do not have enough item. - type_invalid_length: type length is invalid. - type_invalid_pattern: type does not match expected pattern. - relations_too_few_items: relations have too few items. - relations_too_long: relations' length is too long. - relations_invalid_pattern: relations do not match expected pattern. - object_invalid_pattern: object does not match expected pattern. - query_string_type_continuation_token_mismatch: type in the query string and the continuation token don't match. - invalid_contextual_tuple: Invalid contextual tuple. - duplicate_contextual_tuple: Duplicate contextual tuple. enum: - no_error - validation_error - authorization_model_not_found - authorization_model_resolution_too_complex - invalid_write_input - cannot_allow_duplicate_tuples_in_one_request - cannot_allow_duplicate_types_in_one_request - cannot_allow_multiple_references_to_one_relation - invalid_continuation_token - invalid_tuple_set - invalid_check_input - invalid_expand_input - unsupported_user_set - invalid_object_format - token_issuer_already_registered - write_failed_due_to_invalid_input - authorization_model_assertions_not_found - latest_authorization_model_not_found - type_not_found - relation_not_found - empty_relation_definition - invalid_user - invalid_token_issuer - invalid_tuple - unknown_relation - store_id_invalid_length - issuer_url_invalid_uri - issuer_url_required_absolute_path - assertions_too_many_items - id_too_long - invalid_environment - authorization_model_id_too_long - tuple_key_value_not_specified - tuple_keys_too_many_or_too_few_items - page_size_invalid - param_missing_value - difference_base_missing_value - subtract_base_missing_value - object_too_long - relation_too_long - type_definitions_too_few_items - type_invalid_length - type_invalid_pattern - relations_too_few_items - relations_too_long - relations_invalid_pattern - object_invalid_pattern - query_string_type_continuation_token_mismatch - invalid_contextual_tuple - duplicate_contextual_tuple title: ErrorCodeEnums type: string errormessages.AuthErrorCode: default: no_auth_error description: |- - no_auth_error: no error - auth_failure: generic authentication error. Details available via message field. - auth_failed_invalid_subject: authentication failure due to invalid subject. - auth_failed_invalid_audience: authentication failure due to invalid audience. - auth_failed_invalid_issuer: authentication failure due to invalid issuer. - invalid_claims: authentication failure due to invalid claims. - auth_failed_invalid_bearer_token: authentication failure due to invalid bearer token. - missing_customer_in_bearer_token: authentication failure with customer id missing in bearer token. - missing_store_in_bearer_token: authentication failure with store id missing in bearer token. - store_mismatch_in_bearer_token: authentication failure due to store mismatch from bearer token. - customer_mismatch_in_bearer_token: authentication failure due to customer id in the request being different from the customer id in the bearer token. - bearer_token_missing: bearer token missing in request. - unauthenticated: unauthenticated. - insufficient_permissions: insufficient permissions. - unauthorized_principal: authentication denial due to unauthorized principal. enum: - no_auth_error - auth_failure - auth_failed_invalid_subject - auth_failed_invalid_audience - auth_failed_invalid_issuer - invalid_claims - auth_failed_invalid_bearer_token - missing_customer_in_bearer_token - missing_store_in_bearer_token - store_mismatch_in_bearer_token - customer_mismatch_in_bearer_token - bearer_token_missing - unauthenticated - insufficient_permissions - unauthorized_principal title: AuthErrorCodeEnums type: string errormessages.NotFoundErrorCode: default: no_not_found_error description: |- - no_not_found_error: no error - undefined_endpoint: undefined endpoint. - store_id_not_found: store ID not found - resource_not_found: generic not found. - unimplemented: method is unimplemented enum: - no_not_found_error - undefined_endpoint - store_id_not_found - resource_not_found - unimplemented title: NotFoundErrorCodeEnums type: string errormessages.UnprocessableContentErrorCode: default: no_throttled_error_code enum: - no_throttled_error_code - throttled_timeout_error title: |- - no_throttled_error_code: no error - throttled_timeout_error: 3500 level errors are timeout due to throttling type: string ResourceExhaustedErrorCode: default: no_resource_exhausted_error description: |- - no_resource_exhausted_error: no error - rate_limit_exceeded: operation failed due to exceeding rate limit. - auth_rate_limit_exceeded: rate limit error during authentication. enum: - no_resource_exhausted_error - rate_limit_exceeded - auth_rate_limit_exceeded title: ResourceExhaustedErrorCodeEnums type: string errormessages.InternalErrorCode: default: no_internal_error description: |- - no_internal_error: no error - internal_error: generic internal error. - auth_internal_error: internal error due to authentication error. - auth_failed_error_fetching_well_known_jwks: authentication failure due to internal error in fetching well-known/jwks.json. - cancelled: internal error - request being cancelled. - deadline_exceeded: internal error - deadline exceeded. - already_exists: internal error - already exists. - resource_exhausted: internal error - resource exhausted. - failed_precondition: internal error - failed precondition. - aborted: internal error - aborted. - out_of_range: internal error - out of range. - unavailable: internal error - unavailable. - data_loss: internal error - data loss. enum: - no_internal_error - internal_error - auth_internal_error - auth_failed_error_fetching_well_known_jwks - cancelled - deadline_exceeded - already_exists - resource_exhausted - failed_precondition - aborted - out_of_range - unavailable - data_loss title: InternalErrorCodeEnums type: string RelationshipCondition: properties: context: description: >- Additional context/data to persist along with the condition. The keys must match the parameters defined by the condition, and the value types must match the parameter type definitions. type: object name: description: >- A reference (by name) of the relationship condition defined in the authorization model. example: condition1 maxLength: 256 type: string required: - name type: object securitySchemes: ClientCredentials: flows: clientCredentials: scopes: check:tuples: Allows checking tuples create:stores: Allows creation of stores delete:stores: Allows deletion of stores expand:tuples: Allows expanding tuples list:objects: Allows reading results of list objects list:users: Allows reading results of list users read:assertions: Allows reading assertions read:authorization_models: Allows reading authorization models read:changes: Allows reading changes read:expansions: Allows reading index expansions read:indexes: Allows reading permission indexes read:stores: Allows reading of stores read:tuples: Allows reading tuples search:logs: Allows searching store logs write:assertions: Allows updating assertions write:authorization_models: Allows writing authorization models write:tuples: Allows writing tuples tokenUrl: https://auth.fga.dev/oauth/token type: oauth2 ````