Auth0 AuthZenService API

openapi: 3.2.0
info:
  title: OpenFGA Auth Zen Service API
  description: A high performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.
  version: 1.x
  contact:
    name: OpenFGA
    url: https://openfga.dev
    email: community@openfga.dev
  license:
    name: Apache-2.0
    url: https://github.com/openfga/openfga/blob/main/LICENSE
tags:
- name: AuthZenService
paths:
  /.well-known/authzen-configuration/{store_id}:
    get:
      summary: '[Experimental] Get AuthZEN PDP configuration and capabilities'
      description: "[Experimental] The GetConfiguration API returns metadata about the Policy Decision Point (PDP) including its name, version, supported endpoints, and capabilities. This endpoint follows the AuthZEN specification for PDP discovery.\n\nFollowing the AuthZEN spec's multi-tenant pattern, OpenFGA provides a per-store discovery endpoint at `/.well-known/authzen-configuration/{store_id}`. This returns absolute endpoint URLs specific to that store.\n\n## Example Response\n```json\n{\n  \"policy_decision_point\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV\",\n  \"access_evaluation_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/evaluation\",\n  \"access_evaluations_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/evaluations\",\n  \"search_subject_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/subject\",\n  \"search_resource_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/resource\",\n  \"search_action_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/action\"\n}\n```\n"
      operationId: GetConfiguration
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetConfigurationResponse'
        '400':
          description: Request failed due to invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationErrorMessageResponse'
        '401':
          description: Not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthenticatedResponse'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Request failed due to incorrect path.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PathUnknownErrorMessageResponse'
        '409':
          description: Request was aborted due a transaction conflict.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AbortedMessageResponse'
        '422':
          description: Request timed out due to excessive request throttling.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnprocessableContentMessageResponse'
        '500':
          description: Request failed due to internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorMessageResponse'
      parameters:
      - name: store_id
        description: 'The store ID for which to retrieve configuration.

          Following the AuthZEN spec''s multi-tenant pattern, each store has its own discovery endpoint.'
        in: path
        required: true
        schema:
          type: string
      tags:
      - AuthZenService
  /stores/{store_id}/access/v1/evaluation:
    post:
      summary: '[Experimental] Evaluate whether a subject can perform an action on a resource'
      description: "[Experimental] The Evaluation API determines whether a subject is authorized to perform an action on a resource. This endpoint implements the AuthZEN Access Evaluation API specification.\n\n## Request Structure\nThe request requires three components:\n- **subject**: The entity requesting access (e.g., a user or service)\n- **action**: The operation being performed (maps to a relation in the authorization model)\n- **resource**: The object being accessed\n\nEach component has a `type` and `id` field, and may include optional `properties` for ABAC (Attribute-Based Access Control) conditions.\n\n## Response\nThe response contains a `decision` field (boolean) indicating whether access is permitted, and an optional `context` object with additional information such as the evaluation ID or error details.\n\n## ABAC Support\nProperties on subject, action, and resource are automatically merged into the evaluation context with prefixes:\n- Subject properties: `subject_<property_name>`\n- Resource properties: `resource_<property_name>`\n- Action properties: `action_<property_name>`\n\nThese merged properties can be used in conditions defined in your authorization model.\n\n## Examples\n### Basic authorization check\nCheck if user Anne can read a document:\n```json\n{\n  \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n  \"action\": {\"name\": \"can_read\"},\n  \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"}\n}\n```\nResponse when authorized:\n```json\n{\n  \"decision\": true\n}\n```\n### Using properties for ABAC\nCheck access with subject and resource attributes:\n```json\n{\n  \"subject\": {\n    \"type\": \"user\",\n    \"id\": \"anne\",\n    \"properties\": {\"department\": \"engineering\", \"clearance_level\": 3}\n  },\n  \"action\": {\"name\": \"can_read\"},\n  \"resource\": {\n    \"type\": \"document\",\n    \"id\": \"secret-project\",\n    \"properties\": {\"classification\": \"confidential\", \"required_clearance\": 2}\n  }\n}\n```\n### Using request context\nProvide additional context for time-based or environmental conditions:\n```json\n{\n  \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n  \"action\": {\"name\": \"can_access\"},\n  \"resource\": {\"type\": \"system\", \"id\": \"production\"},\n  \"context\": {\n    \"current_time\": \"2024-01-15T14:30:00Z\",\n    \"ip_address\": \"192.168.1.100\",\n    \"is_vpn_connected\": true\n  }\n}\n```\n### Specifying authorization model\nPin the evaluation to a specific authorization model version using the `Openfga-Authorization-Model-Id` header:\n```\nPOST /stores/{store_id}/access/v1/evaluation\nOpenfga-Authorization-Model-Id: 01G50QVV17PECNVAHX1GG4Y5NC\n\n{\n  \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n  \"action\": {\"name\": \"can_write\"},\n  \"resource\": {\"type\": \"document\", \"id\": \"budget-2024\"}\n}\n```\n"
      operationId: Evaluation
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EvaluationResponse'
        '400':
          description: Request failed due to invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationErrorMessageResponse'
        '401':
          description: Not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthenticatedResponse'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Request failed due to incorrect path.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PathUnknownErrorMessageResponse'
        '409':
          description: Request was aborted due a transaction conflict.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AbortedMessageResponse'
        '422':
          description: Request timed out due to excessive request throttling.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnprocessableContentMessageResponse'
        '500':
          description: Request failed due to internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorMessageResponse'
      parameters:
      - name: store_id
        in: path
        required: true
        schema:
          type: string
      tags:
      - AuthZenService
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                subject:
                  $ref: '#/components/schemas/Subject'
                resource:
                  $ref: '#/components/schemas/Resource'
                action:
                  $ref: '#/components/schemas/Action'
                context:
                  type: object
              required:
              - subject
              - resource
              - action
        required: true
  /stores/{store_id}/access/v1/evaluations:
    post:
      summary: '[Experimental] Check whether one or more users are authorized to access resources'
      description: "[Experimental] The Evaluations API allows batch authorization checks in a single request. It supports request-level defaults for subject, action, resource, and context that can be overridden per evaluation item.\n\n## Evaluation Semantics\nThe `options.evaluations_semantic` field controls how evaluations are processed:\n- `execute_all` (default): Execute all evaluations and return all results\n- `deny_on_first_deny`: Stop processing on first deny decision\n- `permit_on_first_permit`: Stop processing on first permit decision\n\nWhen using `deny_on_first_deny` or `permit_on_first_permit`, the response may include fewer items than the request because processing short-circuits when the condition is met.\n\n## Authorization Model Selection\nTo pin evaluations to a specific authorization model version, send the `Openfga-Authorization-Model-Id` header. If the header is not provided, the latest model is used.\n\n## Examples\n### Basic batch evaluation\nCheck if a user can perform multiple actions on a document:\n```json\n{\n  \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n  \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n  \"evaluations\": [\n    {\"action\": {\"name\": \"can_read\"}},\n    {\"action\": {\"name\": \"can_write\"}},\n    {\"action\": {\"name\": \"can_delete\"}}\n  ]\n}\n```\n### Using evaluation semantics\nStop on first permitted action (useful for finding any valid permission):\n```json\n{\n  \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n  \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n  \"evaluations\": [\n    {\"action\": {\"name\": \"can_read\"}},\n    {\"action\": {\"name\": \"can_write\"}}\n  ],\n  \"options\": {\n    \"evaluations_semantic\": \"permit_on_first_permit\"\n  }\n}\n```\n### Overriding defaults per evaluation\nCheck permissions across multiple resources:\n```json\n{\n  \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n  \"action\": {\"name\": \"can_read\"},\n  \"evaluations\": [\n    {\"resource\": {\"type\": \"document\", \"id\": \"doc1\"}},\n    {\"resource\": {\"type\": \"document\", \"id\": \"doc2\"}},\n    {\"resource\": {\"type\": \"folder\", \"id\": \"folder1\"}}\n  ]\n}\n```\n"
      operationId: Evaluations
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EvaluationsResponse'
        '400':
          description: Request failed due to invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationErrorMessageResponse'
        '401':
          description: Not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthenticatedResponse'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Request failed due to incorrect path.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PathUnknownErrorMessageResponse'
        '409':
          description: Request was aborted due a transaction conflict.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AbortedMessageResponse'
        '422':
          description: Request timed out due to excessive request throttling.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnprocessableContentMessageResponse'
        '500':
          description: Request failed due to internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorMessageResponse'
      parameters:
      - name: store_id
        in: path
        required: true
        schema:
          type: string
      tags:
      - AuthZenService
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                subject:
                  $ref: '#/components/schemas/Subject'
                action:
                  $ref: '#/components/schemas/Action'
                resource:
                  $ref: '#/components/schemas/Resource'
                context:
                  type: object
                evaluations:
                  type: array
                  items:
                    type: object
                    $ref: '#/components/schemas/EvaluationsItemRequest'
                  description: Optional. If omitted or empty, behaves like a single Access Evaluation request.
                options:
                  $ref: '#/components/schemas/EvaluationsOptions'
                  title: Options for batch evaluation semantics
        required: true
  /stores/{store_id}/access/v1/search/action:
    post:
      summary: '[Experimental] Search for actions a subject can perform on a resource'
      description: "[Experimental] The ActionSearch API returns all actions (relations) that a subject can perform on a specific resource. This is useful for answering questions like \"What can Anne do with this document?\" or building dynamic UIs that show only the actions a user is permitted to perform.\n\n## Examples\n### Find all actions a user can perform on a document\n```json\n{\n  \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n  \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"}\n}\n```\nResponse:\n```json\n{\n  \"results\": [\n    {\"name\": \"can_read\"},\n    {\"name\": \"can_write\"},\n    {\"name\": \"can_share\"}\n  ],\n  \"page\": {\"count\": 3}\n}\n```\n### Search with ABAC context for time-based permissions\n```json\n{\n  \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n  \"resource\": {\"type\": \"report\", \"id\": \"quarterly-financials\"},\n  \"context\": {\n    \"current_time\": \"2024-01-15T14:30:00Z\",\n    \"user_department\": \"finance\"\n  }\n}\n```\n### Paginated action search\n```json\n{\n  \"subject\": {\"type\": \"user\", \"id\": \"admin\"},\n  \"resource\": {\"type\": \"system\", \"id\": \"production\"},\n  \"page\": {\"limit\": 50}\n}\n```\n"
      operationId: ActionSearch
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActionSearchResponse'
        '400':
          description: Request failed due to invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationErrorMessageResponse'
        '401':
          description: Not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthenticatedResponse'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Request failed due to incorrect path.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PathUnknownErrorMessageResponse'
        '409':
          description: Request was aborted due a transaction conflict.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AbortedMessageResponse'
        '422':
          description: Request timed out due to excessive request throttling.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnprocessableContentMessageResponse'
        '500':
          description: Request failed due to internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorMessageResponse'
      parameters:
      - name: store_id
        in: path
        required: true
        schema:
          type: string
      tags:
      - AuthZenService
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                subject:
                  $ref: '#/components/schemas/Subject'
                resource:
                  $ref: '#/components/schemas/Resource'
                context:
                  type: object
                page:
                  $ref: '#/components/schemas/PageRequest'
              title: ActionSearch request
              required:
              - subject
              - resource
        required: true
  /stores/{store_id}/access/v1/search/resource:
    post:
      summary: '[Experimental] Search for resources a subject has access to'
      description: "[Experimental] The ResourceSearch API returns all resources of a given type that a subject has a specific action (relation) on. This is useful for answering questions like \"What documents can Anne read?\" or \"What folders can Bob administer?\"\n\nThe resource type filter is required. Results support pagination for large result sets.\n\n## Examples\n### Find all documents a user can read\n```json\n{\n  \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n  \"action\": {\"name\": \"can_read\"},\n  \"resource\": {\"type\": \"document\"}\n}\n```\nResponse:\n```json\n{\n  \"results\": [\n    {\"type\": \"document\", \"id\": \"roadmap\"},\n    {\"type\": \"document\", \"id\": \"budget-2024\"},\n    {\"type\": \"document\", \"id\": \"team-roster\"}\n  ],\n  \"page\": {\"count\": 3}\n}\n```\n### Find folders a user can administer with pagination\n```json\n{\n  \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n  \"action\": {\"name\": \"can_admin\"},\n  \"resource\": {\"type\": \"folder\"},\n  \"page\": {\"limit\": 25}\n}\n```\n### Search with ABAC context\n```json\n{\n  \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n  \"action\": {\"name\": \"can_read\"},\n  \"resource\": {\"type\": \"document\"},\n  \"context\": {\n    \"current_time\": \"2024-01-15T10:00:00Z\",\n    \"ip_address\": \"192.168.1.100\"\n  }\n}\n```\n"
      operationId: ResourceSearch
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceSearchResponse'
        '400':
          description: Request failed due to invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationErrorMessageResponse'
        '401':
          description: Not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthenticatedResponse'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Request failed due to incorrect path.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PathUnknownErrorMessageResponse'
        '409':
          description: Request was aborted due a transaction conflict.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AbortedMessageResponse'
        '422':
          description: Request timed out due to excessive request throttling.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnprocessableContentMessageResponse'
        '500':
          description: Request failed due to internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorMessageResponse'
      parameters:
      - name: store_id
        in: path
        required: true
        schema:
          type: string
      tags:
      - AuthZenService
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                subject:
                  $ref: '#/components/schemas/Subject'
                action:
                  $ref: '#/components/schemas/Action'
                resource:
                  $ref: '#/components/schemas/ResourceFilter'
                  title: Filter by resource type
                context:
                  type: object
                page:
                  $ref: '#/components/schemas/PageRequest'
              title: ResourceSearch request
              required:
              - subject
              - action
              - resource
        required: true
  /stores/{store_id}/access/v1/search/subject:
    post:
      summary: '[Experimental] Search for subjects with access to a resource'
      description: "[Experimental] The SubjectSearch API returns all subjects that have a specific action (relation) on a given resource. This is useful for answering questions like \"Who can read this document?\" or \"Who can administer this folder?\"\n\nResults can be filtered by subject type and support pagination for large result sets.\n\n## Examples\n### Find all users who can read a document\n```json\n{\n  \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n  \"action\": {\"name\": \"can_read\"},\n  \"subject\": {\"type\": \"user\"}\n}\n```\nResponse:\n```json\n{\n  \"results\": [\n    {\"type\": \"user\", \"id\": \"anne\"},\n    {\"type\": \"user\", \"id\": \"bob\"},\n    {\"type\": \"user\", \"id\": \"charlie\"}\n  ],\n  \"page\": {\"count\": 3}\n}\n```\n### Paginated search with limit\n```json\n{\n  \"resource\": {\"type\": \"folder\", \"id\": \"engineering\"},\n  \"action\": {\"name\": \"can_view\"},\n  \"subject\": {\"type\": \"user\"},\n  \"page\": {\"limit\": 10}\n}\n```\n### Continue from previous page\n```json\n{\n  \"resource\": {\"type\": \"folder\", \"id\": \"engineering\"},\n  \"action\": {\"name\": \"can_view\"},\n  \"subject\": {\"type\": \"user\"},\n  \"page\": {\"token\": \"eyJsYXN0X2lkIjoiMTAwIn0=\", \"limit\": 10}\n}\n```\n"
      operationId: SubjectSearch
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SubjectSearchResponse'
        '400':
          description: Request failed due to invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationErrorMessageResponse'
        '401':
          description: Not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthenticatedResponse'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Request failed due to incorrect path.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PathUnknownErrorMessageResponse'
        '409':
          description: Request was aborted due a transaction conflict.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AbortedMessageResponse'
        '422':
          description: Request timed out due to excessive request throttling.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnprocessableContentMessageResponse'
        '500':
          description: Request failed due to internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorMessageResponse'
      parameters:
      - name: store_id
        in: path
        required: true
        schema:
          type: string
      tags:
      - AuthZenService
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                resource:
                  $ref: '#/components/schemas/Resource'
                action:
                  $ref: '#/components/schemas/Action'
                subject:
                  $ref: '#/components/schemas/SubjectFilter'
                  description: REQUIRED by AuthZEN Subject Search. Subject `id` may be provided but is ignored.
                context:
                  type: object
                page:
                  $ref: '#/components/schemas/PageRequest'
              title: SubjectSearch request
              required:
              - resource
              - action
              - subject
        required: true
components:
  schemas:
    NotFoundErrorCode:
      type: string
      enum:
      - no_not_found_error
      - undefined_endpoint
      - store_id_not_found
      - unimplemented
      default: no_not_found_error
    Resource:
      type: object
      properties:
        type:
          type: string
          example: document
        id:
          type: string
          example: roadmap
        properties:
          type: object
      required:
      - type
      - id
    PageRequest:
      type: object
      properties:
        token:
          type: string
          title: Continuation token from previous response
        limit:
          type: integer
          format: int64
          title: 'Maximum number of results to return (default: 50, max: 1000)'
      title: Pagination request parameters for search operations
    ActionSearchResponse:
      type: object
      properties:
        results:
          type: array
          items:
            type: object
            $ref: '#/components/schemas/Action'
        page:
          $ref: '#/components/schemas/PageResponse'
          title: Optional per AuthZEN spec - omit if pagination not supported
    ResourceFilter:
      type: object
      properties:
        type:
          type: string
          example: document
        id:
          type: string
          description: Optional resource id. If present in Resource Search, it is ignored per AuthZEN spec.
        properties:
          type: object
      title: ResourceFilter is used for search operations where only type is required
      required:
      - type
    PathUnknownErrorMessageResponse:
      type: object
      example:
        code: undefined_endpoint
        message: Endpoint not enabled
      properties:
        code:
          $ref: '#/components/schemas/NotFoundErrorCode'
        message:
          type: string
    SubjectSearchResponse:
      type: object
      properties:
        results:
          type: array
          items:
            type: object
            $ref: '#/components/schemas/Subject'
        page:
          $ref: '#/components/schemas/PageResponse'
          title: Optional per AuthZEN spec - omit if pagination not supported
    InternalErrorCode:
      type: string
      enum:
      - no_internal_error
      - internal_error
      - deadline_exceeded
      - already_exists
      - resource_exhausted
      - failed_precondition
      - aborted
      - out_of_range
      - unavailable
      - data_loss
      default: no_internal_error
    PageResponse:
      type: object
      properties:
        next_token:
          type: string
          title: Token to retrieve next page (empty if no more results)
        count:
          type: integer
          format: int64
          title: Number of results in this page
        total:
          type: integer
          format: int64
          title: Total number of results (if known, otherwise 0)
      title: Pagination response parameters
    EvaluationResponse:
      type: object
      properties:
        decision:
          type: boolean
        context:
          type: object
    UnprocessableContentErrorCode:
      type: string
      enum:
      - no_throttled_error_code
      - throttled_timeout_error
      default: no_throttled_error_code
    GetConfigurationResponse:
      type: object
      properties:
        policy_decision_point:
          type: string
          description: REQUIRED. The PDP identifier URL (HTTPS, no query or fragment).
        access_evaluation_endpoint:
          type: string
          description: REQUIRED. The access evaluation endpoint URL.
        access_evaluations_endpoint:
          type: string
          description: OPTIONAL. The batch evaluations endpoint URL.
        search_subject_endpoint:
          type: string
          description: OPTIONAL. The subject search endpoint URL.
        search_resource_endpoint:
          type: string
          description: OPTIONAL. The resource search endpoint URL.
        search_action_endpoint:
          type: string
          description: OPTIONAL. The action search endpoint URL.
        capabilities:
          type: array
          items:
            type: string
          description: OPTIONAL. Supported capabilities as URN strings.
        signed_metadata:
          type: string
          description: OPTIONAL. Signed metadata JWT per AuthZEN metadata specification.
      title: GetConfiguration response - PDP metadata per AuthZEN spec
      required:
      - policy_decision_point
      - access_evaluation_endpoint
    UnauthenticatedResponse:
      type: object
      example:
        code: unauthenticated
        message: unauthenticated
      properties:
        code:
          $ref: '#/components/schemas/ErrorCode'
        message:
          type: string
    InternalErrorMessageResponse:
      type: object
      example:
        code: internal_error
        message: Internal Server Error
      properties:
        code:
          $ref: '#/components/schemas/InternalErrorCode'
        message:
          type: string
    AbortedMessageResponse:
      type: object
      example:
        code: '10'
        message: transaction conflict
      properties:
        code:
          type: string
        message:
          type: string
    ValidationErrorMessageResponse:
      type: object
      example:
        code: validation_error
        message: Generic validation error
      properties:
        code:
          $ref: '#/components/schemas/ErrorCode'
        message:
          type: string
    AuthErrorCode:
      type: string
      enum:
      - no_auth_error
      - auth_failed_invalid_subject
      - auth_failed_invalid_audience
      - auth_failed_invalid_issuer
      - invalid_claims
      - auth_failed_invalid_bearer_token
      - bearer_token_missing
      - unauthenticated
      - forbidden
      default: no_auth_error
    EvaluationsItemRequest:
      type: object
      properties:
        subject:
          $ref: '#/components/schemas/Subject'
        resource:
          $ref: '#/co

# --- truncated at 32 KB (36 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/auth0/refs/heads/main/openapi/auth0-authzenservice-api-openapi.yml