> ## Documentation Index > Fetch the complete documentation index at: https://docs.fga.dev/llms.txt > Use this file to discover all available pages before exploring further. # Get all users that have a given relation with a given object > The ListUsers API returns a list of all the users of a specific type that have a relation to a given object. To arrive at a result, the API uses: an authorization model, explicit tuples written through the Write API, contextual tuples present in the request, and implicit tuples that exist by virtue of applying set theory (such as `document:2021-budget#viewer@document:2021-budget#viewer`; the set of users who are viewers of `document:2021-budget` are the set of users who are the viewers of `document:2021-budget`). An `authorization_model_id` may be specified in the body. If it is not specified, the latest authorization model ID will be used. It is strongly recommended to specify authorization model id for better performance. You may also specify `contextual_tuples` that will be treated as regular tuples. Each of these tuples may have an associated `condition`. You may also provide a `context` object that will be used to evaluate the conditioned tuples in the system. It is strongly recommended to provide a value for all the input parameters of all the conditions, to ensure that all tuples be evaluated correctly. The response will contain the related users in an array in the "users" field of the response. These results may include specific objects, usersets or type-bound public access. Each of these types of results is encoded in its own type and not represented as a string.In cases where a type-bound public acces result is returned (e.g. `user:*`), it cannot be inferred that all subjects of that type have a relation to the object; it is possible that negations exist and checks should still be queried on individual subjects to ensure access to that document. The number of users in the response array will be at most 250, and it will be limited by an execution timeout of 3 seconds, whichever is hit first. The users given will not be sorted, and therefore two identical calls can give a given different set of users. ## OpenAPI ````yaml oas/fga-api-oas.json POST /stores/{store_id}/list-users openapi: 3.0.3 info: contact: name: Auth0 url: https://docs.fga.dev/support description: >- Auth0 Fine-Grained Authorization (FGA) enables developers to design authorization models, from coarse grained to fine grained, in a way that's centralized, flexible, fast, scalable, and easy to use. title: Auth0 Fine-Grained Authorization (FGA) version: '1' servers: - url: https://api.us1.fga.dev description: United States - url: https://api.eu1.fga.dev description: Europe - url: https://api.au1.fga.dev description: Australia security: [] tags: - name: Auth0FGAService paths: /stores/{store_id}/list-users: post: tags: - Relationship Queries summary: Get all users that have a given relation with a given object description: >- The ListUsers API returns a list of all the users of a specific type that have a relation to a given object. To arrive at a result, the API uses: an authorization model, explicit tuples written through the Write API, contextual tuples present in the request, and implicit tuples that exist by virtue of applying set theory (such as `document:2021-budget#viewer@document:2021-budget#viewer`; the set of users who are viewers of `document:2021-budget` are the set of users who are the viewers of `document:2021-budget`). An `authorization_model_id` may be specified in the body. If it is not specified, the latest authorization model ID will be used. It is strongly recommended to specify authorization model id for better performance. You may also specify `contextual_tuples` that will be treated as regular tuples. Each of these tuples may have an associated `condition`. You may also provide a `context` object that will be used to evaluate the conditioned tuples in the system. It is strongly recommended to provide a value for all the input parameters of all the conditions, to ensure that all tuples be evaluated correctly. The response will contain the related users in an array in the "users" field of the response. These results may include specific objects, usersets or type-bound public access. Each of these types of results is encoded in its own type and not represented as a string.In cases where a type-bound public acces result is returned (e.g. `user:*`), it cannot be inferred that all subjects of that type have a relation to the object; it is possible that negations exist and checks should still be queried on individual subjects to ensure access to that document. The number of users in the response array will be at most 250, and it will be limited by an execution timeout of 3 seconds, whichever is hit first. The users given will not be sorted, and therefore two identical calls can give a given different set of users. operationId: ListUsers parameters: - in: path name: store_id required: true schema: type: string requestBody: content: application/json: schema: properties: authorization_model_id: example: 01G5JAVJ41T49E9TT3SKVS7X1J type: string consistency: allOf: - $ref: '#/components/schemas/ConsistencyPreference' - description: >- Controls the consistency preference for this request. Default value is UNSPECIFIED, which will have the same behavior as MINIMIZE_LATENCY. context: description: >- Additional request context that will be used to evaluate any ABAC conditions encountered in the query evaluation. type: object contextual_tuples: items: $ref: '#/components/schemas/TupleKey' maxItems: 100 type: array object: allOf: - $ref: '#/components/schemas/Object' - example: document:example relation: example: reader type: string user_filters: description: >- The type of results returned. Only accepts exactly one value. example: - type: user - relation: member type: group items: $ref: '#/components/schemas/UserTypeFilter' maxItems: 1 minItems: 1 type: array required: - object - relation - user_filters type: object required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/ListUsersResponse' description: A successful response. '400': content: application/json: schema: $ref: >- #/components/schemas/errormessages.ValidationErrorMessageResponse description: Request failed due to invalid input. '401': content: application/json: schema: $ref: '#/components/schemas/AuthenticationErrorMessageResponse' description: Request failed due to authentication errors. '403': content: application/json: schema: $ref: '#/components/schemas/AuthenticationErrorMessageResponse' description: Request failed due to forbidden permission. '404': content: application/json: schema: $ref: >- #/components/schemas/errormessages.PathUnknownErrorMessageResponse description: Request failed due to incorrect path. '409': content: application/json: schema: $ref: '#/components/schemas/errormessages.AbortedMessageResponse' description: Request was aborted due a transaction conflict. '422': content: application/json: schema: $ref: >- #/components/schemas/errormessages.UnprocessableContentMessageResponse description: Request timeout due to throttling on complex query. '429': content: application/json: schema: $ref: '#/components/schemas/ResourceExhaustedErrorMessageResponse' description: Request failed due to too many requests. '500': content: application/json: schema: $ref: >- #/components/schemas/errormessages.InternalErrorMessageResponse description: Request failed due to internal server error. security: - ClientCredentials: - list:users x-codeSamples: - lang: javascript label: Node.js source: >- const { CredentialsMethod, OpenFgaClient, ConsistencyPreference } = require('@openfga/sdk'); const fgaClient = new OpenFgaClient({ apiUrl: process.env.FGA_API_URL, // https://api.us1.fga.dev, or your store's eu1/au1 region storeId: process.env.FGA_STORE_ID, authorizationModelId: process.env.FGA_MODEL_ID, credentials: { method: CredentialsMethod.ClientCredentials, config: { apiTokenIssuer: process.env.FGA_API_TOKEN_ISSUER, // auth.fga.dev apiAudience: process.env.FGA_API_AUDIENCE, // URL for your store's region clientId: process.env.FGA_CLIENT_ID, clientSecret: process.env.FGA_CLIENT_SECRET, }, }, }); async function main() { const body = { "object": {"type": "document", "id": "budget"}, "relation": "reader", "user_filters": [ { "type": "user" } ] }; const options = { }; const response = await fgaClient.listUsers(body, options); } main().catch((error) => { console.error(error); process.exitCode = 1; }); - lang: go label: Go source: >- package main import ( "context" "os" openfga "github.com/openfga/go-sdk" . "github.com/openfga/go-sdk/client" "github.com/openfga/go-sdk/credentials" ) // Configure FGA_API_URL and FGA_API_AUDIENCE for your store's us1/eu1/au1 region. // Set FGA_STORE_ID, FGA_MODEL_ID, FGA_API_TOKEN_ISSUER, FGA_CLIENT_ID, and FGA_CLIENT_SECRET. func main() { fgaClient, err := NewSdkClient(&ClientConfiguration{ ApiUrl: os.Getenv("FGA_API_URL"), StoreId: os.Getenv("FGA_STORE_ID"), AuthorizationModelId: os.Getenv("FGA_MODEL_ID"), Credentials: &credentials.Credentials{ Method: credentials.CredentialsMethodClientCredentials, Config: &credentials.Config{ ClientCredentialsApiTokenIssuer: os.Getenv("FGA_API_TOKEN_ISSUER"), ClientCredentialsApiAudience: os.Getenv("FGA_API_AUDIENCE"), ClientCredentialsClientId: os.Getenv("FGA_CLIENT_ID"), ClientCredentialsClientSecret: os.Getenv("FGA_CLIENT_SECRET"), }, }, }) if err != nil { panic(err) } body := ClientListUsersRequest{ Object: openfga.FgaObject{ Type: "document", Id: "budget", }, Relation: "reader", UserFilters: []openfga.UserTypeFilter{ openfga.UserTypeFilter{ Type: "user", }, }, } options := ClientListUsersOptions{ } data, err := fgaClient.ListUsers(context.Background()).Body(body).Options(options).Execute() if err != nil { panic(err) } _ = data } - lang: csharp label: .NET source: >- using System.Collections.Generic; using OpenFga.Sdk.Client; using OpenFga.Sdk.Client.Model; using OpenFga.Sdk.Configuration; using OpenFga.Sdk.Model; using Environment = System.Environment; // FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region. var fgaClient = new OpenFgaClient(new ClientConfiguration() { ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL"), StoreId = Environment.GetEnvironmentVariable("FGA_STORE_ID"), AuthorizationModelId = Environment.GetEnvironmentVariable("FGA_MODEL_ID"), Credentials = new Credentials() { Method = CredentialsMethod.ClientCredentials, Config = new CredentialsConfig() { ApiTokenIssuer = Environment.GetEnvironmentVariable("FGA_API_TOKEN_ISSUER"), ApiAudience = Environment.GetEnvironmentVariable("FGA_API_AUDIENCE"), ClientId = Environment.GetEnvironmentVariable("FGA_CLIENT_ID"), ClientSecret = Environment.GetEnvironmentVariable("FGA_CLIENT_SECRET"), } } }); var body = new ClientListUsersRequest { Object = new FgaObject { Type = "document", Id = "budget", }, Relation = "reader", UserFilters = new List { new UserTypeFilter { Type = "user", }, }, }; var options = new ClientListUsersOptions { }; var response = await fgaClient.ListUsers(body, options); - lang: python label: Python source: >- import asyncio import os from openfga_sdk.client import OpenFgaClient, ClientConfiguration from openfga_sdk.client.models import ClientTuple from openfga_sdk.models import RelationshipCondition, FgaObject, UserTypeFilter from openfga_sdk.client.models.list_users_request import ClientListUsersRequest from openfga_sdk.credentials import Credentials, CredentialConfiguration # FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region. credentials = Credentials( method='client_credentials', configuration=CredentialConfiguration( api_issuer=os.environ.get('FGA_API_TOKEN_ISSUER'), api_audience=os.environ.get('FGA_API_AUDIENCE'), client_id=os.environ.get('FGA_CLIENT_ID'), client_secret=os.environ.get('FGA_CLIENT_SECRET'), ), ) async def main(): configuration = ClientConfiguration( api_url=os.environ.get('FGA_API_URL'), store_id=os.environ.get('FGA_STORE_ID'), authorization_model_id=os.environ.get('FGA_MODEL_ID'), credentials=credentials, ) async with OpenFgaClient(configuration) as fga_client: body = ClientListUsersRequest( object=FgaObject( type="document", id="budget", ), relation="reader", user_filters=[ UserTypeFilter( type="user", ) ], ) options = { } response = await fga_client.list_users(body, options) asyncio.run(main()) - lang: java label: Java source: >- import dev.openfga.sdk.api.client.OpenFgaClient; import dev.openfga.sdk.api.configuration.ClientConfiguration; import dev.openfga.sdk.api.configuration.ClientCredentials; import dev.openfga.sdk.api.configuration.Credentials; import dev.openfga.sdk.api.configuration.ClientCheckOptions; import dev.openfga.sdk.api.configuration.ClientBatchCheckOptions; import dev.openfga.sdk.api.configuration.ClientWriteOptions; import dev.openfga.sdk.api.configuration.ClientListObjectsOptions; import dev.openfga.sdk.api.configuration.ClientListUsersOptions; import dev.openfga.sdk.api.client.model.*; import dev.openfga.sdk.api.model.*; import java.util.List; import java.util.Map; // FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region. public class Example { public static void main(String[] args) throws Exception { var config = new ClientConfiguration() .apiUrl(System.getenv("FGA_API_URL")) .storeId(System.getenv("FGA_STORE_ID")) .authorizationModelId(System.getenv("FGA_MODEL_ID")) .credentials(new Credentials(new ClientCredentials() .apiTokenIssuer(System.getenv("FGA_API_TOKEN_ISSUER")) .apiAudience(System.getenv("FGA_API_AUDIENCE")) .clientId(System.getenv("FGA_CLIENT_ID")) .clientSecret(System.getenv("FGA_CLIENT_SECRET")))); var fgaClient = new OpenFgaClient(config); var body = new ClientListUsersRequest() ._object(new FgaObject() .type("document") .id("budget")) .relation("reader") .userFilters(java.util.Arrays.asList(new UserTypeFilter() .type("user"))); var options = new ClientListUsersOptions(); var response = fgaClient.listUsers(body, options).get(); } } - lang: bash label: curl source: >- # Set FGA_API_URL to your store region (https://api.us1.fga.dev, or eu1/au1). # Set FGA_STORE_ID and obtain FGA_BEARER_TOKEN with the client credentials grant. # See /integration/getting-your-api-keys; never put client secrets in source code. curl -X POST "$FGA_API_URL/stores/$FGA_STORE_ID/list-users" \ -H "authorization: Bearer $FGA_BEARER_TOKEN" \ -H "content-type: application/json" \ -d '{ "object": { "type": "document", "id": "budget" }, "relation": "reader", "user_filters": [ { "type": "user" } ] }' components: schemas: ConsistencyPreference: default: UNSPECIFIED description: |- Controls the consistency preferences when calling the query APIs. - UNSPECIFIED: Default if not set. Behavior will be the same as MINIMIZE_LATENCY. - MINIMIZE_LATENCY: Minimize latency at the potential expense of lower consistency. - HIGHER_CONSISTENCY: Prefer higher consistency, at the potential expense of increased latency. enum: - UNSPECIFIED - MINIMIZE_LATENCY - HIGHER_CONSISTENCY example: MINIMIZE_LATENCY type: string TupleKey: properties: condition: $ref: '#/components/schemas/RelationshipCondition' object: example: document:2021-budget maxLength: 256 type: string relation: example: reader maxLength: 50 type: string user: example: user:anne maxLength: 512 type: string required: - user - relation - object type: object Object: description: |- Object represents an OpenFGA Object. An Object is composed of a type and identifier (e.g. 'document:1') See https://openfga.dev/docs/concepts#what-is-an-object properties: id: example: 0bcdf6fa-a6aa-4730-a8eb-9cf172ff16d9 type: string type: example: document type: string required: - type - id type: object UserTypeFilter: properties: relation: example: member type: string type: example: group type: string required: - type type: object ListUsersResponse: properties: users: items: $ref: '#/components/schemas/User' type: array required: - users type: object errormessages.ValidationErrorMessageResponse: example: code: validation_error message: Generic validation error properties: code: $ref: '#/components/schemas/errormessages.ErrorCode' message: type: string type: object AuthenticationErrorMessageResponse: example: code: unauthorized_principal message: Missing permissions to perform operation properties: code: $ref: '#/components/schemas/errormessages.AuthErrorCode' message: type: string type: object errormessages.PathUnknownErrorMessageResponse: example: code: undefined_endpoint message: Endpoint not enabled properties: code: $ref: '#/components/schemas/errormessages.NotFoundErrorCode' message: type: string type: object errormessages.AbortedMessageResponse: example: code: '10' message: transaction conflict properties: code: type: string message: type: string type: object errormessages.UnprocessableContentMessageResponse: example: code: throttled_timeout_error message: timeout due to throttling on complex request properties: code: $ref: '#/components/schemas/errormessages.UnprocessableContentErrorCode' message: type: string type: object ResourceExhaustedErrorMessageResponse: example: code: rate_limit_exceeded message: Rate Limit exceeded properties: code: $ref: '#/components/schemas/ResourceExhaustedErrorCode' message: type: string type: object errormessages.InternalErrorMessageResponse: example: code: internal_error message: Internal Server Error properties: code: $ref: '#/components/schemas/errormessages.InternalErrorCode' message: type: string type: object RelationshipCondition: properties: context: description: >- Additional context/data to persist along with the condition. The keys must match the parameters defined by the condition, and the value types must match the parameter type definitions. type: object name: description: >- A reference (by name) of the relationship condition defined in the authorization model. example: condition1 maxLength: 256 type: string required: - name type: object User: description: >- User. Represents any possible value for a user (subject or principal). Can be a: - Specific user object e.g.: 'user:will', 'folder:marketing', 'org:contoso', ...) - Specific userset (e.g. 'group:engineering#member') - Public-typed wildcard (e.g. 'user:*') See https://openfga.dev/docs/concepts#what-is-a-user properties: object: $ref: '#/components/schemas/Object' userset: $ref: '#/components/schemas/UsersetUser' wildcard: $ref: '#/components/schemas/TypedWildcard' type: object errormessages.ErrorCode: default: no_error description: |- - no_error: no error - validation_error: generic validation error. - authorization_model_not_found: authorization model not found. - authorization_model_resolution_too_complex: too many rewrite rules to be resolved. - invalid_write_input: invalid write input. - cannot_allow_duplicate_tuples_in_one_request: duplicate tuples in one request. - cannot_allow_duplicate_types_in_one_request: duplicate types in one request. - cannot_allow_multiple_references_to_one_relation: cannot use a relation to define itself. - invalid_continuation_token: invalid continuation token. - invalid_tuple_set: invalid tuple set. - invalid_check_input: invalid check input. - invalid_expand_input: invalid expand input. - unsupported_user_set: unsupported user set. - invalid_object_format: invalid object format. - token_issuer_already_registered: token issuers already registered. - write_failed_due_to_invalid_input: write request failed due to invalid input. - authorization_model_assertions_not_found: no assertions found for authorization model. - latest_authorization_model_not_found: latest authorization model not found. - type_not_found: type not found. - relation_not_found: relation not found. - empty_relation_definition: empty relation definition. - invalid_user: invalid user. - invalid_token_issuer: invalid token issuer. - invalid_tuple: invalid tuple. - unknown_relation: unknown relation. - store_id_invalid_length: store id has invalid length. - issuer_url_invalid_uri: issuer url has invalid URI. - issuer_url_required_absolute_path: issuer url is not absolute path. - assertions_too_many_items: assertions have too many items. - id_too_long: ID is too long. - invalid_environment: invalid environment is specified. - authorization_model_id_too_long: authorization model id is too long. - tuple_key_value_not_specified: tuple key value is not specified. - tuple_keys_too_many_or_too_few_items: tuple keys have too few or too many items. - page_size_invalid: page size is outside of acceptable range. - param_missing_value: params value is missing. - difference_base_missing_value: difference's base value is missing. - subtract_base_missing_value: subtract base value is missing. - object_too_long: object length is too long. - relation_too_long: relation length is too long. - type_definitions_too_few_items: type definitions do not have enough item. - type_invalid_length: type length is invalid. - type_invalid_pattern: type does not match expected pattern. - relations_too_few_items: relations have too few items. - relations_too_long: relations' length is too long. - relations_invalid_pattern: relations do not match expected pattern. - object_invalid_pattern: object does not match expected pattern. - query_string_type_continuation_token_mismatch: type in the query string and the continuation token don't match. - invalid_contextual_tuple: Invalid contextual tuple. - duplicate_contextual_tuple: Duplicate contextual tuple. enum: - no_error - validation_error - authorization_model_not_found - authorization_model_resolution_too_complex - invalid_write_input - cannot_allow_duplicate_tuples_in_one_request - cannot_allow_duplicate_types_in_one_request - cannot_allow_multiple_references_to_one_relation - invalid_continuation_token - invalid_tuple_set - invalid_check_input - invalid_expand_input - unsupported_user_set - invalid_object_format - token_issuer_already_registered - write_failed_due_to_invalid_input - authorization_model_assertions_not_found - latest_authorization_model_not_found - type_not_found - relation_not_found - empty_relation_definition - invalid_user - invalid_token_issuer - invalid_tuple - unknown_relation - store_id_invalid_length - issuer_url_invalid_uri - issuer_url_required_absolute_path - assertions_too_many_items - id_too_long - invalid_environment - authorization_model_id_too_long - tuple_key_value_not_specified - tuple_keys_too_many_or_too_few_items - page_size_invalid - param_missing_value - difference_base_missing_value - subtract_base_missing_value - object_too_long - relation_too_long - type_definitions_too_few_items - type_invalid_length - type_invalid_pattern - relations_too_few_items - relations_too_long - relations_invalid_pattern - object_invalid_pattern - query_string_type_continuation_token_mismatch - invalid_contextual_tuple - duplicate_contextual_tuple title: ErrorCodeEnums type: string errormessages.AuthErrorCode: default: no_auth_error description: |- - no_auth_error: no error - auth_failure: generic authentication error. Details available via message field. - auth_failed_invalid_subject: authentication failure due to invalid subject. - auth_failed_invalid_audience: authentication failure due to invalid audience. - auth_failed_invalid_issuer: authentication failure due to invalid issuer. - invalid_claims: authentication failure due to invalid claims. - auth_failed_invalid_bearer_token: authentication failure due to invalid bearer token. - missing_customer_in_bearer_token: authentication failure with customer id missing in bearer token. - missing_store_in_bearer_token: authentication failure with store id missing in bearer token. - store_mismatch_in_bearer_token: authentication failure due to store mismatch from bearer token. - customer_mismatch_in_bearer_token: authentication failure due to customer id in the request being different from the customer id in the bearer token. - bearer_token_missing: bearer token missing in request. - unauthenticated: unauthenticated. - insufficient_permissions: insufficient permissions. - unauthorized_principal: authentication denial due to unauthorized principal. enum: - no_auth_error - auth_failure - auth_failed_invalid_subject - auth_failed_invalid_audience - auth_failed_invalid_issuer - invalid_claims - auth_failed_invalid_bearer_token - missing_customer_in_bearer_token - missing_store_in_bearer_token - store_mismatch_in_bearer_token - customer_mismatch_in_bearer_token - bearer_token_missing - unauthenticated - insufficient_permissions - unauthorized_principal title: AuthErrorCodeEnums type: string errormessages.NotFoundErrorCode: default: no_not_found_error description: |- - no_not_found_error: no error - undefined_endpoint: undefined endpoint. - store_id_not_found: store ID not found - resource_not_found: generic not found. - unimplemented: method is unimplemented enum: - no_not_found_error - undefined_endpoint - store_id_not_found - resource_not_found - unimplemented title: NotFoundErrorCodeEnums type: string errormessages.UnprocessableContentErrorCode: default: no_throttled_error_code enum: - no_throttled_error_code - throttled_timeout_error title: |- - no_throttled_error_code: no error - throttled_timeout_error: 3500 level errors are timeout due to throttling type: string ResourceExhaustedErrorCode: default: no_resource_exhausted_error description: |- - no_resource_exhausted_error: no error - rate_limit_exceeded: operation failed due to exceeding rate limit. - auth_rate_limit_exceeded: rate limit error during authentication. enum: - no_resource_exhausted_error - rate_limit_exceeded - auth_rate_limit_exceeded title: ResourceExhaustedErrorCodeEnums type: string errormessages.InternalErrorCode: default: no_internal_error description: |- - no_internal_error: no error - internal_error: generic internal error. - auth_internal_error: internal error due to authentication error. - auth_failed_error_fetching_well_known_jwks: authentication failure due to internal error in fetching well-known/jwks.json. - cancelled: internal error - request being cancelled. - deadline_exceeded: internal error - deadline exceeded. - already_exists: internal error - already exists. - resource_exhausted: internal error - resource exhausted. - failed_precondition: internal error - failed precondition. - aborted: internal error - aborted. - out_of_range: internal error - out of range. - unavailable: internal error - unavailable. - data_loss: internal error - data loss. enum: - no_internal_error - internal_error - auth_internal_error - auth_failed_error_fetching_well_known_jwks - cancelled - deadline_exceeded - already_exists - resource_exhausted - failed_precondition - aborted - out_of_range - unavailable - data_loss title: InternalErrorCodeEnums type: string UsersetUser: description: >- Userset. A set or group of users, represented in the `:#` format `group:fga#member` represents all members of group FGA, not to be confused by `group:fga` which represents the group itself as a specific object. See: https://openfga.dev/docs/modeling/building-blocks/usersets#what-is-a-userset properties: id: example: fga type: string relation: example: member type: string type: example: group type: string required: - type - id - relation type: object TypedWildcard: description: >- Type bound public access. Normally represented using the `:*` syntax `employee:*` represents every object of type `employee`, including those not currently present in the system See https://openfga.dev/docs/concepts#what-is-type-bound-public-access properties: type: example: employee type: string required: - type type: object securitySchemes: ClientCredentials: flows: clientCredentials: scopes: check:tuples: Allows checking tuples create:stores: Allows creation of stores delete:stores: Allows deletion of stores expand:tuples: Allows expanding tuples list:objects: Allows reading results of list objects list:users: Allows reading results of list users read:assertions: Allows reading assertions read:authorization_models: Allows reading authorization models read:changes: Allows reading changes read:expansions: Allows reading index expansions read:indexes: Allows reading permission indexes read:stores: Allows reading of stores read:tuples: Allows reading tuples search:logs: Allows searching store logs write:assertions: Allows updating assertions write:authorization_models: Allows writing authorization models write:tuples: Allows writing tuples tokenUrl: https://auth.fga.dev/oauth/token type: oauth2 ````