> ## Documentation Index > Fetch the complete documentation index at: https://docs.fga.dev/llms.txt > Use this file to discover all available pages before exploring further. # Get tuples from the store that matches a query, without following userset rewrite rules > The Read API will return the tuples for a certain store that match a query filter specified in the body of the request. The API doesn't guarantee order by any field. It is different from the `/stores/{store_id}/expand` API in that it only returns relationship tuples that are stored in the system and satisfy the query. In the body: 1. `tuple_key` is optional. If not specified, it will return all tuples in the store. 2. `tuple_key.object` is mandatory if `tuple_key` is specified. It can be a full object (e.g., `type:object_id`) or type only (e.g., `type:`). 3. `tuple_key.user` is mandatory if tuple_key is specified in the case the `tuple_key.object` is a type only. ## Examples ### Query for all objects in a type definition To query for all objects that `user:bob` has `reader` relationship in the `document` type definition, call Read API with body of ```json { "tuple_key": { "user": "user:bob", "relation": "reader", "object": "document:" } } ``` The API will return tuples and a continuation token, something like ```json { "tuples": [ { "key": { "user": "user:bob", "relation": "reader", "object": "document:2021-budget" }, "timestamp": "2021-10-06T15:32:11.128Z" } ], "continuation_token": "eyJwayI6IkxBVEVTVF9OU0NPTkZJR19hdXRoMHN0b3JlIiwic2siOiIxem1qbXF3MWZLZExTcUoyN01MdTdqTjh0cWgifQ==" } ``` This means that `user:bob` has a `reader` relationship with 1 document `document:2021-budget`. Note that this API, unlike the List Objects API, does not evaluate the tuples in the store. The continuation token will be empty if there are no more tuples to query. ### Query for all stored relationship tuples that have a particular relation and object To query for all users that have `reader` relationship with `document:2021-budget`, call Read API with body of ```json { "tuple_key": { "object": "document:2021-budget", "relation": "reader" } } ``` The API will return something like ```json { "tuples": [ { "key": { "user": "user:bob", "relation": "reader", "object": "document:2021-budget" }, "timestamp": "2021-10-06T15:32:11.128Z" } ], "continuation_token": "eyJwayI6IkxBVEVTVF9OU0NPTkZJR19hdXRoMHN0b3JlIiwic2siOiIxem1qbXF3MWZLZExTcUoyN01MdTdqTjh0cWgifQ==" } ``` This means that `document:2021-budget` has 1 `reader` (`user:bob`). Note that, even if the model said that all `writers` are also `readers`, the API will not return writers such as `user:anne` because it only returns tuples and does not evaluate them. ### Query for all users with all relationships for a particular document To query for all users that have any relationship with `document:2021-budget`, call Read API with body of ```json { "tuple_key": { "object": "document:2021-budget" } } ``` The API will return something like ```json { "tuples": [ { "key": { "user": "user:anne", "relation": "writer", "object": "document:2021-budget" }, "timestamp": "2021-10-05T13:42:12.356Z" }, { "key": { "user": "user:bob", "relation": "reader", "object": "document:2021-budget" }, "timestamp": "2021-10-06T15:32:11.128Z" } ], "continuation_token": "eyJwayI6IkxBVEVTVF9OU0NPTkZJR19hdXRoMHN0b3JlIiwic2siOiIxem1qbXF3MWZLZExTcUoyN01MdTdqTjh0cWgifQ==" } ``` This means that `document:2021-budget` has 1 `reader` (`user:bob`) and 1 `writer` (`user:anne`). ## OpenAPI ````yaml oas/fga-api-oas.json POST /stores/{store_id}/read openapi: 3.0.3 info: contact: name: Auth0 url: https://docs.fga.dev/support description: >- Auth0 Fine-Grained Authorization (FGA) enables developers to design authorization models, from coarse grained to fine grained, in a way that's centralized, flexible, fast, scalable, and easy to use. title: Auth0 Fine-Grained Authorization (FGA) version: '1' servers: - url: https://api.us1.fga.dev description: United States - url: https://api.eu1.fga.dev description: Europe - url: https://api.au1.fga.dev description: Australia security: [] tags: - name: Auth0FGAService paths: /stores/{store_id}/read: post: tags: - Relationship Tuples summary: >- Get tuples from the store that matches a query, without following userset rewrite rules description: > The Read API will return the tuples for a certain store that match a query filter specified in the body of the request. The API doesn't guarantee order by any field. It is different from the `/stores/{store_id}/expand` API in that it only returns relationship tuples that are stored in the system and satisfy the query. In the body: 1. `tuple_key` is optional. If not specified, it will return all tuples in the store. 2. `tuple_key.object` is mandatory if `tuple_key` is specified. It can be a full object (e.g., `type:object_id`) or type only (e.g., `type:`). 3. `tuple_key.user` is mandatory if tuple_key is specified in the case the `tuple_key.object` is a type only. ## Examples ### Query for all objects in a type definition To query for all objects that `user:bob` has `reader` relationship in the `document` type definition, call Read API with body of ```json { "tuple_key": { "user": "user:bob", "relation": "reader", "object": "document:" } } ``` The API will return tuples and a continuation token, something like ```json { "tuples": [ { "key": { "user": "user:bob", "relation": "reader", "object": "document:2021-budget" }, "timestamp": "2021-10-06T15:32:11.128Z" } ], "continuation_token": "eyJwayI6IkxBVEVTVF9OU0NPTkZJR19hdXRoMHN0b3JlIiwic2siOiIxem1qbXF3MWZLZExTcUoyN01MdTdqTjh0cWgifQ==" } ``` This means that `user:bob` has a `reader` relationship with 1 document `document:2021-budget`. Note that this API, unlike the List Objects API, does not evaluate the tuples in the store. The continuation token will be empty if there are no more tuples to query. ### Query for all stored relationship tuples that have a particular relation and object To query for all users that have `reader` relationship with `document:2021-budget`, call Read API with body of ```json { "tuple_key": { "object": "document:2021-budget", "relation": "reader" } } ``` The API will return something like ```json { "tuples": [ { "key": { "user": "user:bob", "relation": "reader", "object": "document:2021-budget" }, "timestamp": "2021-10-06T15:32:11.128Z" } ], "continuation_token": "eyJwayI6IkxBVEVTVF9OU0NPTkZJR19hdXRoMHN0b3JlIiwic2siOiIxem1qbXF3MWZLZExTcUoyN01MdTdqTjh0cWgifQ==" } ``` This means that `document:2021-budget` has 1 `reader` (`user:bob`). Note that, even if the model said that all `writers` are also `readers`, the API will not return writers such as `user:anne` because it only returns tuples and does not evaluate them. ### Query for all users with all relationships for a particular document To query for all users that have any relationship with `document:2021-budget`, call Read API with body of ```json { "tuple_key": { "object": "document:2021-budget" } } ``` The API will return something like ```json { "tuples": [ { "key": { "user": "user:anne", "relation": "writer", "object": "document:2021-budget" }, "timestamp": "2021-10-05T13:42:12.356Z" }, { "key": { "user": "user:bob", "relation": "reader", "object": "document:2021-budget" }, "timestamp": "2021-10-06T15:32:11.128Z" } ], "continuation_token": "eyJwayI6IkxBVEVTVF9OU0NPTkZJR19hdXRoMHN0b3JlIiwic2siOiIxem1qbXF3MWZLZExTcUoyN01MdTdqTjh0cWgifQ==" } ``` This means that `document:2021-budget` has 1 `reader` (`user:bob`) and 1 `writer` (`user:anne`). operationId: Read parameters: - in: path name: store_id required: true schema: type: string requestBody: content: application/json: schema: properties: consistency: allOf: - $ref: '#/components/schemas/ConsistencyPreference' - description: >- Controls the consistency preference for this request. Default value is UNSPECIFIED, which will have the same behavior as MINIMIZE_LATENCY. continuation_token: example: >- eyJwayI6IkxBVEVTVF9OU0NPTkZJR19hdXRoMHN0b3JlIiwic2siOiIxem1qbXF3MWZLZExTcUoyN01MdTdqTjh0cWgifQ== type: string page_size: example: 50 format: int32 maximum: 100 minimum: 1 type: integer tuple_key: $ref: '#/components/schemas/ReadRequestTupleKey' type: object required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/ReadResponse' description: A successful response. '400': content: application/json: schema: $ref: >- #/components/schemas/errormessages.ValidationErrorMessageResponse description: Request failed due to invalid input. '401': content: application/json: schema: $ref: '#/components/schemas/AuthenticationErrorMessageResponse' description: Request failed due to authentication errors. '403': content: application/json: schema: $ref: '#/components/schemas/AuthenticationErrorMessageResponse' description: Request failed due to forbidden permission. '404': content: application/json: schema: $ref: >- #/components/schemas/errormessages.PathUnknownErrorMessageResponse description: Request failed due to incorrect path. '409': content: application/json: schema: $ref: '#/components/schemas/errormessages.AbortedMessageResponse' description: Request was aborted due a transaction conflict. '422': content: application/json: schema: $ref: >- #/components/schemas/errormessages.UnprocessableContentMessageResponse description: Request timeout due to throttling on complex query. '429': content: application/json: schema: $ref: '#/components/schemas/ResourceExhaustedErrorMessageResponse' description: Request failed due to too many requests. '500': content: application/json: schema: $ref: >- #/components/schemas/errormessages.InternalErrorMessageResponse description: Request failed due to internal server error. security: - ClientCredentials: - read:tuples x-codeSamples: - lang: javascript label: Node.js source: >- const { CredentialsMethod, OpenFgaClient, ConsistencyPreference } = require('@openfga/sdk'); const fgaClient = new OpenFgaClient({ apiUrl: process.env.FGA_API_URL, // https://api.us1.fga.dev, or your store's eu1/au1 region storeId: process.env.FGA_STORE_ID, authorizationModelId: process.env.FGA_MODEL_ID, credentials: { method: CredentialsMethod.ClientCredentials, config: { apiTokenIssuer: process.env.FGA_API_TOKEN_ISSUER, // auth.fga.dev apiAudience: process.env.FGA_API_AUDIENCE, // URL for your store's region clientId: process.env.FGA_CLIENT_ID, clientSecret: process.env.FGA_CLIENT_SECRET, }, }, }); async function main() { const body = { "user": "user:anne", "relation": "reader", "object": "document:budget" }; const options = {"pageSize":20}; const response = await fgaClient.read(body, options); } main().catch((error) => { console.error(error); process.exitCode = 1; }); - lang: go label: Go source: >- package main import ( "context" "os" . "github.com/openfga/go-sdk/client" "github.com/openfga/go-sdk/credentials" ) // Configure FGA_API_URL and FGA_API_AUDIENCE for your store's us1/eu1/au1 region. // Set FGA_STORE_ID, FGA_MODEL_ID, FGA_API_TOKEN_ISSUER, FGA_CLIENT_ID, and FGA_CLIENT_SECRET. func main() { fgaClient, err := NewSdkClient(&ClientConfiguration{ ApiUrl: os.Getenv("FGA_API_URL"), StoreId: os.Getenv("FGA_STORE_ID"), AuthorizationModelId: os.Getenv("FGA_MODEL_ID"), Credentials: &credentials.Credentials{ Method: credentials.CredentialsMethodClientCredentials, Config: &credentials.Config{ ClientCredentialsApiTokenIssuer: os.Getenv("FGA_API_TOKEN_ISSUER"), ClientCredentialsApiAudience: os.Getenv("FGA_API_AUDIENCE"), ClientCredentialsClientId: os.Getenv("FGA_CLIENT_ID"), ClientCredentialsClientSecret: os.Getenv("FGA_CLIENT_SECRET"), }, }, }) if err != nil { panic(err) } pageSize := int32(20) user := "user:anne" relation := "reader" object := "document:budget" body := ClientReadRequest{ User: &user, Relation: &relation, Object: &object, } options := ClientReadOptions{ PageSize: &pageSize, } response, err := fgaClient.Read(context.Background()).Body(body).Options(options).Execute() if err != nil { panic(err) } _ = response } - lang: csharp label: .NET source: >- using System.Collections.Generic; using OpenFga.Sdk.Client; using OpenFga.Sdk.Client.Model; using OpenFga.Sdk.Configuration; using OpenFga.Sdk.Model; using Environment = System.Environment; // FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region. var fgaClient = new OpenFgaClient(new ClientConfiguration() { ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL"), StoreId = Environment.GetEnvironmentVariable("FGA_STORE_ID"), AuthorizationModelId = Environment.GetEnvironmentVariable("FGA_MODEL_ID"), Credentials = new Credentials() { Method = CredentialsMethod.ClientCredentials, Config = new CredentialsConfig() { ApiTokenIssuer = Environment.GetEnvironmentVariable("FGA_API_TOKEN_ISSUER"), ApiAudience = Environment.GetEnvironmentVariable("FGA_API_AUDIENCE"), ClientId = Environment.GetEnvironmentVariable("FGA_CLIENT_ID"), ClientSecret = Environment.GetEnvironmentVariable("FGA_CLIENT_SECRET"), } } }); var body = new ClientReadRequest { User = "user:anne", Relation = "reader", Object = "document:budget", }; var options = new ClientReadOptions { PageSize = 20, }; var response = await fgaClient.Read(body, options); - lang: python label: Python source: >- import asyncio import os from openfga_sdk.client import OpenFgaClient, ClientConfiguration from openfga_sdk.client.models import ClientCheckRequest, ClientTuple from openfga_sdk.models import RelationshipCondition from openfga_sdk.credentials import Credentials, CredentialConfiguration # FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region. credentials = Credentials( method='client_credentials', configuration=CredentialConfiguration( api_issuer=os.environ.get('FGA_API_TOKEN_ISSUER'), api_audience=os.environ.get('FGA_API_AUDIENCE'), client_id=os.environ.get('FGA_CLIENT_ID'), client_secret=os.environ.get('FGA_CLIENT_SECRET'), ), ) from openfga_sdk import ReadRequestTupleKey async def main(): configuration = ClientConfiguration( api_url=os.environ.get('FGA_API_URL'), store_id=os.environ.get('FGA_STORE_ID'), authorization_model_id=os.environ.get('FGA_MODEL_ID'), credentials=credentials, ) async with OpenFgaClient(configuration) as fga_client: body = ReadRequestTupleKey( user="user:anne", relation="reader", object="document:budget", ) options = {"page_size": 20} response = await fga_client.read(body=body, options=options) asyncio.run(main()) - lang: java label: Java source: >- import dev.openfga.sdk.api.client.OpenFgaClient; import dev.openfga.sdk.api.configuration.ClientConfiguration; import dev.openfga.sdk.api.configuration.ClientCredentials; import dev.openfga.sdk.api.configuration.Credentials; import dev.openfga.sdk.api.configuration.ClientCheckOptions; import dev.openfga.sdk.api.configuration.ClientBatchCheckOptions; import dev.openfga.sdk.api.configuration.ClientWriteOptions; import dev.openfga.sdk.api.configuration.ClientListObjectsOptions; import dev.openfga.sdk.api.configuration.ClientListUsersOptions; import dev.openfga.sdk.api.client.model.*; import dev.openfga.sdk.api.model.*; import java.util.List; import java.util.Map; // FGA_API_URL and FGA_API_AUDIENCE must match the store's us1/eu1/au1 region. import dev.openfga.sdk.api.configuration.ClientReadOptions; public class Example { public static void main(String[] args) throws Exception { var config = new ClientConfiguration() .apiUrl(System.getenv("FGA_API_URL")) .storeId(System.getenv("FGA_STORE_ID")) .authorizationModelId(System.getenv("FGA_MODEL_ID")) .credentials(new Credentials(new ClientCredentials() .apiTokenIssuer(System.getenv("FGA_API_TOKEN_ISSUER")) .apiAudience(System.getenv("FGA_API_AUDIENCE")) .clientId(System.getenv("FGA_CLIENT_ID")) .clientSecret(System.getenv("FGA_CLIENT_SECRET")))); var fgaClient = new OpenFgaClient(config); var body = new ClientReadRequest() .user("user:anne") .relation("reader") ._object("document:budget"); var options = new ClientReadOptions() .pageSize(20); var response = fgaClient.read(body, options).get(); } } - lang: bash label: curl source: >- # Set FGA_API_URL to your store region (https://api.us1.fga.dev, or eu1/au1). # Set FGA_STORE_ID and obtain FGA_BEARER_TOKEN with the client credentials grant. # See /integration/getting-your-api-keys; never put client secrets in source code. curl -X POST "$FGA_API_URL/stores/$FGA_STORE_ID/read" \ -H "authorization: Bearer $FGA_BEARER_TOKEN" \ -H "content-type: application/json" \ -d '{ "tuple_key": { "user": "user:anne", "relation": "reader", "object": "document:budget" }, "page_size": 20 }' components: schemas: ConsistencyPreference: default: UNSPECIFIED description: |- Controls the consistency preferences when calling the query APIs. - UNSPECIFIED: Default if not set. Behavior will be the same as MINIMIZE_LATENCY. - MINIMIZE_LATENCY: Minimize latency at the potential expense of lower consistency. - HIGHER_CONSISTENCY: Prefer higher consistency, at the potential expense of increased latency. enum: - UNSPECIFIED - MINIMIZE_LATENCY - HIGHER_CONSISTENCY example: MINIMIZE_LATENCY type: string ReadRequestTupleKey: properties: object: example: document:2021-budget maxLength: 256 type: string relation: example: reader maxLength: 50 type: string user: example: user:anne maxLength: 512 type: string type: object ReadResponse: properties: continuation_token: description: The continuation token will be empty if there are no more tuples. example: >- eyJwayI6IkxBVEVTVF9OU0NPTkZJR19hdXRoMHN0b3JlIiwic2siOiIxem1qbXF3MWZLZExTcUoyN01MdTdqTjh0cWgifQ== type: string tuples: items: $ref: '#/components/schemas/Tuple' type: array required: - tuples - continuation_token type: object errormessages.ValidationErrorMessageResponse: example: code: validation_error message: Generic validation error properties: code: $ref: '#/components/schemas/errormessages.ErrorCode' message: type: string type: object AuthenticationErrorMessageResponse: example: code: unauthorized_principal message: Missing permissions to perform operation properties: code: $ref: '#/components/schemas/errormessages.AuthErrorCode' message: type: string type: object errormessages.PathUnknownErrorMessageResponse: example: code: undefined_endpoint message: Endpoint not enabled properties: code: $ref: '#/components/schemas/errormessages.NotFoundErrorCode' message: type: string type: object errormessages.AbortedMessageResponse: example: code: '10' message: transaction conflict properties: code: type: string message: type: string type: object errormessages.UnprocessableContentMessageResponse: example: code: throttled_timeout_error message: timeout due to throttling on complex request properties: code: $ref: '#/components/schemas/errormessages.UnprocessableContentErrorCode' message: type: string type: object ResourceExhaustedErrorMessageResponse: example: code: rate_limit_exceeded message: Rate Limit exceeded properties: code: $ref: '#/components/schemas/ResourceExhaustedErrorCode' message: type: string type: object errormessages.InternalErrorMessageResponse: example: code: internal_error message: Internal Server Error properties: code: $ref: '#/components/schemas/errormessages.InternalErrorCode' message: type: string type: object Tuple: properties: key: $ref: '#/components/schemas/TupleKey' timestamp: format: date-time type: string required: - key - timestamp type: object errormessages.ErrorCode: default: no_error description: |- - no_error: no error - validation_error: generic validation error. - authorization_model_not_found: authorization model not found. - authorization_model_resolution_too_complex: too many rewrite rules to be resolved. - invalid_write_input: invalid write input. - cannot_allow_duplicate_tuples_in_one_request: duplicate tuples in one request. - cannot_allow_duplicate_types_in_one_request: duplicate types in one request. - cannot_allow_multiple_references_to_one_relation: cannot use a relation to define itself. - invalid_continuation_token: invalid continuation token. - invalid_tuple_set: invalid tuple set. - invalid_check_input: invalid check input. - invalid_expand_input: invalid expand input. - unsupported_user_set: unsupported user set. - invalid_object_format: invalid object format. - token_issuer_already_registered: token issuers already registered. - write_failed_due_to_invalid_input: write request failed due to invalid input. - authorization_model_assertions_not_found: no assertions found for authorization model. - latest_authorization_model_not_found: latest authorization model not found. - type_not_found: type not found. - relation_not_found: relation not found. - empty_relation_definition: empty relation definition. - invalid_user: invalid user. - invalid_token_issuer: invalid token issuer. - invalid_tuple: invalid tuple. - unknown_relation: unknown relation. - store_id_invalid_length: store id has invalid length. - issuer_url_invalid_uri: issuer url has invalid URI. - issuer_url_required_absolute_path: issuer url is not absolute path. - assertions_too_many_items: assertions have too many items. - id_too_long: ID is too long. - invalid_environment: invalid environment is specified. - authorization_model_id_too_long: authorization model id is too long. - tuple_key_value_not_specified: tuple key value is not specified. - tuple_keys_too_many_or_too_few_items: tuple keys have too few or too many items. - page_size_invalid: page size is outside of acceptable range. - param_missing_value: params value is missing. - difference_base_missing_value: difference's base value is missing. - subtract_base_missing_value: subtract base value is missing. - object_too_long: object length is too long. - relation_too_long: relation length is too long. - type_definitions_too_few_items: type definitions do not have enough item. - type_invalid_length: type length is invalid. - type_invalid_pattern: type does not match expected pattern. - relations_too_few_items: relations have too few items. - relations_too_long: relations' length is too long. - relations_invalid_pattern: relations do not match expected pattern. - object_invalid_pattern: object does not match expected pattern. - query_string_type_continuation_token_mismatch: type in the query string and the continuation token don't match. - invalid_contextual_tuple: Invalid contextual tuple. - duplicate_contextual_tuple: Duplicate contextual tuple. enum: - no_error - validation_error - authorization_model_not_found - authorization_model_resolution_too_complex - invalid_write_input - cannot_allow_duplicate_tuples_in_one_request - cannot_allow_duplicate_types_in_one_request - cannot_allow_multiple_references_to_one_relation - invalid_continuation_token - invalid_tuple_set - invalid_check_input - invalid_expand_input - unsupported_user_set - invalid_object_format - token_issuer_already_registered - write_failed_due_to_invalid_input - authorization_model_assertions_not_found - latest_authorization_model_not_found - type_not_found - relation_not_found - empty_relation_definition - invalid_user - invalid_token_issuer - invalid_tuple - unknown_relation - store_id_invalid_length - issuer_url_invalid_uri - issuer_url_required_absolute_path - assertions_too_many_items - id_too_long - invalid_environment - authorization_model_id_too_long - tuple_key_value_not_specified - tuple_keys_too_many_or_too_few_items - page_size_invalid - param_missing_value - difference_base_missing_value - subtract_base_missing_value - object_too_long - relation_too_long - type_definitions_too_few_items - type_invalid_length - type_invalid_pattern - relations_too_few_items - relations_too_long - relations_invalid_pattern - object_invalid_pattern - query_string_type_continuation_token_mismatch - invalid_contextual_tuple - duplicate_contextual_tuple title: ErrorCodeEnums type: string errormessages.AuthErrorCode: default: no_auth_error description: |- - no_auth_error: no error - auth_failure: generic authentication error. Details available via message field. - auth_failed_invalid_subject: authentication failure due to invalid subject. - auth_failed_invalid_audience: authentication failure due to invalid audience. - auth_failed_invalid_issuer: authentication failure due to invalid issuer. - invalid_claims: authentication failure due to invalid claims. - auth_failed_invalid_bearer_token: authentication failure due to invalid bearer token. - missing_customer_in_bearer_token: authentication failure with customer id missing in bearer token. - missing_store_in_bearer_token: authentication failure with store id missing in bearer token. - store_mismatch_in_bearer_token: authentication failure due to store mismatch from bearer token. - customer_mismatch_in_bearer_token: authentication failure due to customer id in the request being different from the customer id in the bearer token. - bearer_token_missing: bearer token missing in request. - unauthenticated: unauthenticated. - insufficient_permissions: insufficient permissions. - unauthorized_principal: authentication denial due to unauthorized principal. enum: - no_auth_error - auth_failure - auth_failed_invalid_subject - auth_failed_invalid_audience - auth_failed_invalid_issuer - invalid_claims - auth_failed_invalid_bearer_token - missing_customer_in_bearer_token - missing_store_in_bearer_token - store_mismatch_in_bearer_token - customer_mismatch_in_bearer_token - bearer_token_missing - unauthenticated - insufficient_permissions - unauthorized_principal title: AuthErrorCodeEnums type: string errormessages.NotFoundErrorCode: default: no_not_found_error description: |- - no_not_found_error: no error - undefined_endpoint: undefined endpoint. - store_id_not_found: store ID not found - resource_not_found: generic not found. - unimplemented: method is unimplemented enum: - no_not_found_error - undefined_endpoint - store_id_not_found - resource_not_found - unimplemented title: NotFoundErrorCodeEnums type: string errormessages.UnprocessableContentErrorCode: default: no_throttled_error_code enum: - no_throttled_error_code - throttled_timeout_error title: |- - no_throttled_error_code: no error - throttled_timeout_error: 3500 level errors are timeout due to throttling type: string ResourceExhaustedErrorCode: default: no_resource_exhausted_error description: |- - no_resource_exhausted_error: no error - rate_limit_exceeded: operation failed due to exceeding rate limit. - auth_rate_limit_exceeded: rate limit error during authentication. enum: - no_resource_exhausted_error - rate_limit_exceeded - auth_rate_limit_exceeded title: ResourceExhaustedErrorCodeEnums type: string errormessages.InternalErrorCode: default: no_internal_error description: |- - no_internal_error: no error - internal_error: generic internal error. - auth_internal_error: internal error due to authentication error. - auth_failed_error_fetching_well_known_jwks: authentication failure due to internal error in fetching well-known/jwks.json. - cancelled: internal error - request being cancelled. - deadline_exceeded: internal error - deadline exceeded. - already_exists: internal error - already exists. - resource_exhausted: internal error - resource exhausted. - failed_precondition: internal error - failed precondition. - aborted: internal error - aborted. - out_of_range: internal error - out of range. - unavailable: internal error - unavailable. - data_loss: internal error - data loss. enum: - no_internal_error - internal_error - auth_internal_error - auth_failed_error_fetching_well_known_jwks - cancelled - deadline_exceeded - already_exists - resource_exhausted - failed_precondition - aborted - out_of_range - unavailable - data_loss title: InternalErrorCodeEnums type: string TupleKey: properties: condition: $ref: '#/components/schemas/RelationshipCondition' object: example: document:2021-budget maxLength: 256 type: string relation: example: reader maxLength: 50 type: string user: example: user:anne maxLength: 512 type: string required: - user - relation - object type: object RelationshipCondition: properties: context: description: >- Additional context/data to persist along with the condition. The keys must match the parameters defined by the condition, and the value types must match the parameter type definitions. type: object name: description: >- A reference (by name) of the relationship condition defined in the authorization model. example: condition1 maxLength: 256 type: string required: - name type: object securitySchemes: ClientCredentials: flows: clientCredentials: scopes: check:tuples: Allows checking tuples create:stores: Allows creation of stores delete:stores: Allows deletion of stores expand:tuples: Allows expanding tuples list:objects: Allows reading results of list objects list:users: Allows reading results of list users read:assertions: Allows reading assertions read:authorization_models: Allows reading authorization models read:changes: Allows reading changes read:expansions: Allows reading index expansions read:indexes: Allows reading permission indexes read:stores: Allows reading of stores read:tuples: Allows reading tuples search:logs: Allows searching store logs write:assertions: Allows updating assertions write:authorization_models: Allows writing authorization models write:tuples: Allows writing tuples tokenUrl: https://auth.fga.dev/oauth/token type: oauth2 ````