GET /v1/fga/stores

fga:read

List fine-grained authorization (ReBAC / Zanzibar) stores in the instance. Each store namespaces its own authorization models and relationship tuples.

POST /v1/fga/stores

fga:write

✓

Create a fine-grained authorization store — an isolated namespace for authorization models and relationship tuples.

GET /v1/fga/stores/:id

fga:read

Read one FGA store. A store from another instance is a 404.

DELETE /v1/fga/stores/:id

fga:write

Delete an FGA store, cascading its authorization models and relationship tuples.

GET /v1/fga/stores/:id/authorization-models

fga:read

List the immutable authorization-model versions of a store, newest first.

POST /v1/fga/stores/:id/authorization-models

fga:write

✓

Write a new immutable authorization-model version (OpenFGA-shaped type_definitions with this/computedUserset/tupleToUserset and union/intersection/difference). Unknown relation or type references are rejected.

GET /v1/fga/stores/:id/authorization-models/:mid

fga:read

Read one authorization-model version, including its full model definition.

POST /v1/fga/stores/:id/write

fga:write

✓

Transactionally write and/or delete relationship tuples in a store. Writes are idempotent (a re-written tuple is a no-op); the whole batch is all-or-nothing.

POST /v1/fga/stores/:id/read

fga:read

Query stored relationship tuples in a store, optionally filtered by user, relation and/or object.

POST /v1/fga/stores/:id/check

fga:read

Check whether a user has a relation on an object, resolving the authorization model (direct tuples, computed usersets, tuple-to-userset hops, set operators) with cycle + depth safety. Supports contextual tuples and a pinned authorization_model_id.

POST /v1/fga/stores/:id/list-objects

fga:read

List the object ids of a type that a user has a relation on. Exact (check-filtered over the complete candidate set); cost is linear in the objects of that type.

POST /v1/fga/stores/:id/expand

fga:read

Expand the userset tree for an (object, relation) — who would hold the relation, mirroring the model rewrite. Not user-specific.

POST /v1/fga/stores/:id/batch-check

fga:read

Check up to 100 (user, relation, object) tuples in one request.