Auth0

Auth0 Authorization Models API

The Authorization Models API from Auth0 — 2 operation(s) for authorization models.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 3

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /stores/{store_id}/authorization-models List a store's authorization models · Return all the authorization models for a particular store #
Ask an LLM
“What versions of the authorization model exist for my FGA store?”
“Are authorization models returned newest first?”
Tell an agent
List the authorization models in store {store_id}.
Show {page_size} authorization models from store {store_id}.
POST /stores/{store_id}/authorization-models Create a new authorization model version · Create a new authorization model #
Ask an LLM
“How do I publish a new authorization model with my type definitions?”
“Can an authorization model include conditions?”
Tell an agent
Write a new authorization model to store {store_id} with type definitions {type_definitions} and schema version {schema_version}.
Add a model to store {store_id}: schema {schema_version}, types {type_definitions}, conditions {conditions}.
GET /stores/{store_id}/authorization-models/{id} Get one authorization model version · Return a particular version of an authorization model #
Ask an LLM
“What type definitions are in a specific version of my authorization model?”
“Can I fetch an older authorization model by its ID?”
Tell an agent
Get authorization model {id} from store {store_id}.
Show the type definitions of model version {id} in store {store_id}.

Documentation

📖
Documentation
https://auth0.com/docs/api/management/v2
📖
APIReference
https://auth0.com/docs/api/management/v2
📖
GettingStarted
https://auth0.com/docs/get-started
📖
Authentication
https://auth0.com/docs/secure/tokens
📖
Documentation
https://auth0.com/docs/api/authentication
📖
APIReference
https://auth0.com/docs/api/authentication
📖
Documentation
https://docs.fga.dev

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/auth0/refs/heads/main/openapi/auth0-authorization-models-api-openapi.yml
⚙
AsyncAPI
https://raw.githubusercontent.com/api-evangelist/auth0/refs/heads/main/asyncapi/auth0-log-streams-and-actions-asyncapi.yml

Other Resources

🔗
OpenAPISource
https://auth0.com/docs/api/management/openapi.json
🔗
SpectralRules
https://raw.githubusercontent.com/api-evangelist/auth0/refs/heads/main/rules/auth0-management-rules.yml
🔗
SpectralRules
https://raw.githubusercontent.com/api-evangelist/auth0/refs/heads/main/rules/auth0-authentication-rules.yml
🔗
SpectralRules
https://raw.githubusercontent.com/api-evangelist/auth0/refs/heads/main/rules/auth0-fga-rules.yml
🔗
Project
https://openfga.dev
🔗
Repository
https://github.com/openfga/openfga

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/auth0-authorization-models-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

auth0-authorization-models-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: OpenFGA Authorization Models API
  description: A high performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.
  version: 1.x
  contact:
    name: OpenFGA
    url: https://openfga.dev
    email: community@openfga.dev
  license:
    name: Apache-2.0
    url: https://github.com/openfga/openfga/blob/main/LICENSE
tags:
- name: Authorization Models
paths:
  /stores/{store_id}/authorization-models:
    get:
      summary: Return all the authorization models for a particular store
      description: 'The ReadAuthorizationModels API will return all the authorization models for a certain store.

        OpenFGA''s response will contain an array of all authorization models, sorted in descending order of creation.


        ## Example

        Assume that a store''s authorization model has been configured twice. To get all the authorization models that have been created in this store, call GET authorization-models. The API will return a response that looks like:

        ```json

        {

        "authorization_models": [

        {

        "id": "01G50QVV17PECNVAHX1GG4Y5NC",

        "type_definitions": [...]

        },

        {

        "id": "01G4ZW8F4A07AKQ8RHSVG9RW04",

        "type_definitions": [...]

        },

        ],

        "continuation_token": "eyJwayI6IkxBVEVTVF9OU0NPTkZJR19hdXRoMHN0b3JlIiwic2siOiIxem1qbXF3MWZLZExTcUoyN01MdTdqTjh0cWgifQ=="

        }

        ```

        If there are no more authorization models available, the `continuation_token` field will be empty

        ```json

        {

        "authorization_models": [

        {

        "id": "01G50QVV17PECNVAHX1GG4Y5NC",

        "type_definitions": [...]

        },

        {

        "id": "01G4ZW8F4A07AKQ8RHSVG9RW04",

        "type_definitions": [...]

        },

        ],

        "continuation_token": ""

        }

        ```'
      operationId: ReadAuthorizationModels
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReadAuthorizationModelsResponse'
        '400':
          description: Request failed due to invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationErrorMessageResponse'
        '401':
          description: Not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthenticatedResponse'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Request failed due to incorrect path.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PathUnknownErrorMessageResponse'
        '409':
          description: Request was aborted due a transaction conflict.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AbortedMessageResponse'
        '422':
          description: Request timed out due to excessive request throttling.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnprocessableContentMessageResponse'
        '500':
          description: Request failed due to internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorMessageResponse'
      parameters:
      - name: store_id
        in: path
        required: true
        schema:
          type: string
      - name: page_size
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: continuation_token
        in: query
        required: false
        schema:
          type: string
      tags:
      - Authorization Models
    post:
      summary: Create a new authorization model
      description: 'The WriteAuthorizationModel API will add a new authorization model to a store.

        Each item in the `type_definitions` array is a type definition as specified in the field `type_definition`.

        The response will return the authorization model''s ID in the `id` field.


        ## Example

        To add an authorization model with `user` and `document` type definitions, call POST authorization-models API with the body:

        ```json

        {

        "type_definitions":[

        {

        "type":"user"

        },

        {

        "type":"document",

        "relations":{

        "reader":{

        "union":{

        "child":[

        {

        "this":{}

        },

        {

        "computedUserset":{

        "object":"",

        "relation":"writer"

        }

        }

        ]

        }

        },

        "writer":{

        "this":{}

        }

        }

        }

        ]

        }

        ```

        OpenFGA''s response will include the version id for this authorization model, which will look like

        ```

        {"authorization_model_id": "01G50QVV17PECNVAHX1GG4Y5NC"}

        ```'
      operationId: WriteAuthorizationModel
      responses:
        '201':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WriteAuthorizationModelResponse'
        '400':
          description: Request failed due to invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationErrorMessageResponse'
        '401':
          description: Not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthenticatedResponse'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Request failed due to incorrect path.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PathUnknownErrorMessageResponse'
        '409':
          description: Request was aborted due a transaction conflict.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AbortedMessageResponse'
        '422':
          description: Request timed out due to excessive request throttling.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnprocessableContentMessageResponse'
        '500':
          description: Request failed due to internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorMessageResponse'
      parameters:
      - name: store_id
        in: path
        required: true
        schema:
          type: string
      tags:
      - Authorization Models
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                type_definitions:
                  type: array
                  items:
                    type: object
                    $ref: '#/components/schemas/TypeDefinition'
                  minItems: 1
                schema_version:
                  type: string
                conditions:
                  type: object
                  additionalProperties:
                    $ref: '#/components/schemas/Condition'
              required:
              - type_definitions
              - schema_version
        required: true
  /stores/{store_id}/authorization-models/{id}:
    get:
      summary: Return a particular version of an authorization model
      description: 'The ReadAuthorizationModel API returns an authorization model by its identifier.

        The response will return the authorization model for the particular version.


        ## Example

        To retrieve the authorization model with ID `01G5JAVJ41T49E9TT3SKVS7X1J` for the store, call the GET authorization-models by ID API with `01G5JAVJ41T49E9TT3SKVS7X1J` as the `id` path parameter. The API will return:

        ```json

        {

        "authorization_model":{

        "id":"01G5JAVJ41T49E9TT3SKVS7X1J",

        "type_definitions":[

        {

        "type":"user"

        },

        {

        "type":"document",

        "relations":{

        "reader":{

        "union":{

        "child":[

        {

        "this":{}

        },

        {

        "computedUserset":{

        "object":"",

        "relation":"writer"

        }

        }

        ]

        }

        },

        "writer":{

        "this":{}

        }

        }

        }

        ]

        }

        }

        ```

        In the above example, there are 2 types (`user` and `document`). The `document` type has 2 relations (`writer` and `reader`).'
      operationId: ReadAuthorizationModel
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReadAuthorizationModelResponse'
        '400':
          description: Request failed due to invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationErrorMessageResponse'
        '401':
          description: Not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthenticatedResponse'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Request failed due to incorrect path.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PathUnknownErrorMessageResponse'
        '409':
          description: Request was aborted due a transaction conflict.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AbortedMessageResponse'
        '422':
          description: Request timed out due to excessive request throttling.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnprocessableContentMessageResponse'
        '500':
          description: Request failed due to internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorMessageResponse'
      parameters:
      - name: store_id
        in: path
        required: true
        schema:
          type: string
      - name: id
        in: path
        required: true
        schema:
          type: string
      tags:
      - Authorization Models
components:
  schemas:
    WriteAuthorizationModelResponse:
      type: object
      properties:
        authorization_model_id:
          type: string
          example: 01G5JAVJ41T49E9TT3SKVS7X1J
      required:
      - authorization_model_id
    v1.Difference:
      type: object
      properties:
        base:
          $ref: '#/components/schemas/Userset'
        subtract:
          $ref: '#/components/schemas/Userset'
      required:
      - base
      - subtract
    UnauthenticatedResponse:
      type: object
      example:
        code: unauthenticated
        message: unauthenticated
      properties:
        code:
          $ref: '#/components/schemas/ErrorCode'
        message:
          type: string
    Metadata:
      type: object
      properties:
        relations:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/RelationMetadata'
        module:
          type: string
        source_info:
          $ref: '#/components/schemas/SourceInfo'
    ConditionParamTypeRef:
      type: object
      properties:
        type_name:
          $ref: '#/components/schemas/TypeName'
        generic_types:
          type: array
          items:
            type: object
            $ref: '#/components/schemas/ConditionParamTypeRef'
      required:
      - type_name
    RelationMetadata:
      type: object
      properties:
        directly_related_user_types:
          type: array
          items:
            type: object
            $ref: '#/components/schemas/RelationReference'
        module:
          type: string
        source_info:
          $ref: '#/components/schemas/SourceInfo'
    ErrorCode:
      type: string
      enum:
      - no_error
      - validation_error
      - authorization_model_not_found
      - authorization_model_resolution_too_complex
      - invalid_write_input
      - cannot_allow_duplicate_tuples_in_one_request
      - cannot_allow_duplicate_types_in_one_request
      - cannot_allow_multiple_references_to_one_relation
      - invalid_continuation_token
      - invalid_tuple_set
      - invalid_check_input
      - invalid_expand_input
      - unsupported_user_set
      - invalid_object_format
      - write_failed_due_to_invalid_input
      - authorization_model_assertions_not_found
      - latest_authorization_model_not_found
      - type_not_found
      - relation_not_found
      - empty_relation_definition
      - invalid_user
      - invalid_tuple
      - unknown_relation
      - store_id_invalid_length
      - assertions_too_many_items
      - id_too_long
      - authorization_model_id_too_long
      - tuple_key_value_not_specified
      - tuple_keys_too_many_or_too_few_items
      - page_size_invalid
      - param_missing_value
      - difference_base_missing_value
      - subtract_base_missing_value
      - object_too_long
      - relation_too_long
      - type_definitions_too_few_items
      - type_invalid_length
      - type_invalid_pattern
      - relations_too_few_items
      - relations_too_long
      - relations_invalid_pattern
      - object_invalid_pattern
      - query_string_type_continuation_token_mismatch
      - exceeded_entity_limit
      - invalid_contextual_tuple
      - duplicate_contextual_tuple
      - invalid_authorization_model
      - unsupported_schema_version
      - cancelled
      - invalid_start_time
      default: no_error
    InternalErrorMessageResponse:
      type: object
      example:
        code: internal_error
        message: Internal Server Error
      properties:
        code:
          $ref: '#/components/schemas/InternalErrorCode'
        message:
          type: string
    InternalErrorCode:
      type: string
      enum:
      - no_internal_error
      - internal_error
      - deadline_exceeded
      - already_exists
      - resource_exhausted
      - failed_precondition
      - aborted
      - out_of_range
      - unavailable
      - data_loss
      default: no_internal_error
    v1.TupleToUserset:
      type: object
      properties:
        tupleset:
          $ref: '#/components/schemas/ObjectRelation'
          title: The target object/relation
        computedUserset:
          $ref: '#/components/schemas/ObjectRelation'
      required:
      - tupleset
      - computedUserset
    ForbiddenResponse:
      type: object
      example:
        code: forbidden
        message: the principal is not authorized to perform the action
      properties:
        code:
          $ref: '#/components/schemas/AuthErrorCode'
        message:
          type: string
    Wildcard:
      type: object
    AbortedMessageResponse:
      type: object
      example:
        code: '10'
        message: transaction conflict
      properties:
        code:
          type: string
        message:
          type: string
    ValidationErrorMessageResponse:
      type: object
      example:
        code: validation_error
        message: Generic validation error
      properties:
        code:
          $ref: '#/components/schemas/ErrorCode'
        message:
          type: string
    Condition:
      type: object
      properties:
        name:
          type: string
          title: A unique name for the condition
        expression:
          type: string
          description: A Google CEL expression, expressed as a string.
        parameters:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/ConditionParamTypeRef'
          description: A map of parameter names to the parameter's defined type reference.
        metadata:
          $ref: '#/components/schemas/ConditionMetadata'
      required:
      - name
      - expression
    UnprocessableContentMessageResponse:
      type: object
      example:
        code: throttled_timeout_error
        message: timeout due to throttling on complex request
      properties:
        code:
          $ref: '#/components/schemas/UnprocessableContentErrorCode'
        message:
          type: string
    RelationReference:
      type: object
      properties:
        type:
          type: string
          example: group
        relation:
          type: string
          example: member
        wildcard:
          $ref: '#/components/schemas/Wildcard'
        condition:
          type: string
          description: The name of a condition that is enforced over the allowed relation.
      description: RelationReference represents a relation of a particular object type (e.g. 'document#viewer').
      required:
      - type
    UnprocessableContentErrorCode:
      type: string
      enum:
      - no_throttled_error_code
      - throttled_timeout_error
      default: no_throttled_error_code
    SourceInfo:
      type: object
      properties:
        file:
          type: string
    ConditionMetadata:
      type: object
      properties:
        module:
          type: string
        source_info:
          $ref: '#/components/schemas/SourceInfo'
    Usersets:
      type: object
      properties:
        child:
          type: array
          items:
            type: object
            $ref: '#/components/schemas/Userset'
      required:
      - child
    AuthErrorCode:
      type: string
      enum:
      - no_auth_error
      - auth_failed_invalid_subject
      - auth_failed_invalid_audience
      - auth_failed_invalid_issuer
      - invalid_claims
      - auth_failed_invalid_bearer_token
      - bearer_token_missing
      - unauthenticated
      - forbidden
      default: no_auth_error
    AuthorizationModel:
      type: object
      properties:
        id:
          type: string
          example: 01G5JAVJ41T49E9TT3SKVS7X1J
        schema_version:
          type: string
        type_definitions:
          type: array
          example:
          - type: user
          - type: document
            relations:
              reader:
                union:
                  child:
                  - this: {}
                  - computedUserset:
                      object: ''
                      relation: writer
              writer:
                this: {}
            metadata:
              relations:
                reader:
                  directly_related_user_types:
                  - type: user
                writer:
                  directly_related_user_types:
                  - type: user
          items:
            type: object
            $ref: '#/components/schemas/TypeDefinition'
        conditions:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Condition'
      required:
      - id
      - schema_version
      - type_definitions
    NotFoundErrorCode:
      type: string
      enum:
      - no_not_found_error
      - undefined_endpoint
      - store_id_not_found
      - unimplemented
      default: no_not_found_error
    TypeName:
      type: string
      enum:
      - TYPE_NAME_UNSPECIFIED
      - TYPE_NAME_ANY
      - TYPE_NAME_BOOL
      - TYPE_NAME_STRING
      - TYPE_NAME_INT
      - TYPE_NAME_UINT
      - TYPE_NAME_DOUBLE
      - TYPE_NAME_DURATION
      - TYPE_NAME_TIMESTAMP
      - TYPE_NAME_MAP
      - TYPE_NAME_LIST
      - TYPE_NAME_IPADDRESS
      default: TYPE_NAME_UNSPECIFIED
    TypeDefinition:
      type: object
      properties:
        type:
          type: string
          example: document
        relations:
          type: object
          example:
            reader:
              union:
                child:
                - this: {}
                - computedUserset:
                    object: ''
                    relation: writer
            writer:
              this: {}
          additionalProperties:
            $ref: '#/components/schemas/Userset'
        metadata:
          $ref: '#/components/schemas/Metadata'
          description: 'A map whose keys are the name of the relation and whose value is the Metadata for that relation.

            It also holds information around the module name and source file if this model was constructed

            from a modular model.'
      required:
      - type
    Userset:
      type: object
      properties:
        this:
          $ref: '#/components/schemas/DirectUserset'
        computedUserset:
          $ref: '#/components/schemas/ObjectRelation'
        tupleToUserset:
          $ref: '#/components/schemas/v1.TupleToUserset'
        union:
          $ref: '#/components/schemas/Usersets'
        intersection:
          $ref: '#/components/schemas/Usersets'
        difference:
          $ref: '#/components/schemas/v1.Difference'
    ReadAuthorizationModelResponse:
      type: object
      properties:
        authorization_model:
          $ref: '#/components/schemas/AuthorizationModel'
    PathUnknownErrorMessageResponse:
      type: object
      example:
        code: undefined_endpoint
        message: Endpoint not enabled
      properties:
        code:
          $ref: '#/components/schemas/NotFoundErrorCode'
        message:
          type: string
    ReadAuthorizationModelsResponse:
      type: object
      properties:
        authorization_models:
          type: array
          items:
            type: object
            $ref: '#/components/schemas/AuthorizationModel'
        continuation_token:
          type: string
          example: eyJwayI6IkxBVEVTVF9OU0NPTkZJR19hdXRoMHN0b3JlIiwic2siOiIxem1qbXF3MWZLZExTcUoyN01MdTdqTjh0cWgifQ==
          description: The continuation token will be empty if there are no more models.
      required:
      - authorization_models
    DirectUserset:
      type: object
      description: 'A DirectUserset is a sentinel message for referencing

        the direct members specified by an object/relation mapping.'
    ObjectRelation:
      type: object
      properties:
        object:
          type: string
        relation:
          type: string