Lakekeeper Permissions Openfga API

openapi: 3.2.0
info:
  title: Lakekeeper Permissions Openfga API
  version: 0.0.0
  description: 'Operations tagged permissions-openfga across 2 of this provider''s published API definitions: lakekeeper-management-api-openapi.yml, lakekeeper-management-plus-api-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: '{scheme}://{host}{basePath}'
  description: Lakekeeper Management API
  variables:
    basePath:
      default: ''
      description: Optional path prefix (starting with '/') to be prepended to all routes
    host:
      default: localhost
      description: The host (and optional port) for the specified server
    scheme:
      default: https
      description: The scheme of the URI, either http or https
security:
- bearerAuth: []
tags:
- name: permissions-openfga
  description: Authorization and permissions management using OpenFGA
paths:
  /management/v1/permissions/check:
    post:
      tags:
      - permissions-openfga
      summary: Check if a specific action is allowed on the given object
      operationId: check
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CheckRequest'
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CheckResponse'
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/namespace/{namespace_id}:
    get:
      tags:
      - permissions-openfga
      summary: Get Authorization properties of a namespace
      operationId: get_namespace_by_id
      parameters:
      - name: namespace_id
        in: path
        description: Namespace ID
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetNamespaceAuthPropertiesResponse'
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/namespace/{namespace_id}/access:
    get:
      tags:
      - permissions-openfga
      summary: Get my access to a namespace
      description: '**Deprecated:** Use `/management/v1/permissions/namespace/{namespace_id}/authorizer-actions` for Authorizer permissions

        or `/management/v1/warehouse/{warehouse_id}/namespace/{namespace_id}/actions` for Catalog permissions instead.'
      operationId: get_namespace_access_by_id
      parameters:
      - name: principalUser
        in: query
        description: 'The user to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
      - name: principalRole
        in: query
        description: 'The role to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
          format: uuid
      - name: namespace_id
        in: path
        description: Namespace ID
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: Server Relations
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetNamespaceAccessResponse'
      deprecated: true
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/namespace/{namespace_id}/assignments:
    get:
      tags:
      - permissions-openfga
      summary: Get user and role assignments for a namespace
      operationId: get_namespace_assignments_by_id
      parameters:
      - name: relations
        in: query
        description: Relations to be loaded. If not specified, all relations are returned.
        required: false
        schema:
          type: array
          items:
            $ref: '#/components/schemas/NamespaceRelation'
      - name: namespace_id
        in: path
        description: Namespace ID
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetNamespaceAssignmentsResponse'
    post:
      tags:
      - permissions-openfga
      summary: Update permissions for a namespace
      operationId: update_namespace_assignments_by_id
      parameters:
      - name: namespace_id
        in: path
        description: Namespace ID
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateNamespaceAssignmentsRequest'
        required: true
      responses:
        '204':
          description: Permissions updated successfully
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/namespace/{namespace_id}/authorizer-actions:
    get:
      tags:
      - permissions-openfga
      summary: Get allowed Authorizer actions on a namespace
      description: 'Returns Authorizer permissions (OpenFGA relations) for the specified namespace.

        For Catalog permissions, use `/management/v1/warehouse/{warehouse_id}/namespace/{namespace_id}/actions` instead.'
      operationId: get_authorizer_namespace_actions
      parameters:
      - name: principalUser
        in: query
        description: 'The user to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
      - name: principalRole
        in: query
        description: 'The role to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
          format: uuid
      - name: namespace_id
        in: path
        description: Namespace ID
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: Namespace Authorizer Actions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOpenFGANamespaceActionsResponse'
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/namespace/{namespace_id}/managed-access:
    post:
      tags:
      - permissions-openfga
      summary: Set managed access property of a namespace
      operationId: set_namespace_managed_access
      parameters:
      - name: namespace_id
        in: path
        description: Namespace ID
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetManagedAccessRequest'
        required: true
      responses:
        '200':
          description: ''
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/project/access:
    get:
      tags:
      - permissions-openfga
      summary: Get my access to the default project
      description: '**Deprecated:** Use `/management/v1/permissions/project/authorizer-actions` for Authorizer permissions

        or `/management/v1/project/actions` for Catalog permissions instead.'
      operationId: get_project_access
      parameters:
      - name: principalUser
        in: query
        description: 'The user to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
      - name: principalRole
        in: query
        description: 'The role to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: Server Relations
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetProjectAccessResponse'
      deprecated: true
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/project/assignments:
    get:
      tags:
      - permissions-openfga
      summary: Get user and role assignments of a project
      operationId: get_project_assignments
      parameters:
      - name: relations
        in: query
        description: Relations to be loaded. If not specified, all relations are returned.
        required: false
        schema:
          type: array
          items:
            $ref: '#/components/schemas/ProjectRelation'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetProjectAssignmentsResponse'
    post:
      tags:
      - permissions-openfga
      summary: Update permissions for the default project
      operationId: update_project_assignments
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateProjectAssignmentsRequest'
        required: true
      responses:
        '204':
          description: Permissions updated successfully
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/project/authorizer-actions:
    get:
      tags:
      - permissions-openfga
      summary: Get allowed Authorizer actions on the default project
      description: 'Returns Authorizer permissions (OpenFGA relations) for the default project.

        For Catalog permissions, use `/management/v1/project/actions` instead.'
      operationId: get_authorizer_project_actions
      parameters:
      - name: principalUser
        in: query
        description: 'The user to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
      - name: principalRole
        in: query
        description: 'The role to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
          format: uuid
      - name: x-project-id
        in: header
        description: Optional project ID
        required: false
        schema:
          type:
          - string
          - 'null'
      responses:
        '200':
          description: Project Authorizer Actions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOpenFGAProjectActionsResponse'
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/project/{project_id}/access:
    get:
      tags:
      - permissions-openfga
      summary: Get my access to a project
      description: '**Deprecated:** Use `/management/v1/permissions/project/authorizer-actions` for Authorizer permissions

        or `/management/v1/project/actions` for Catalog permissions instead.'
      operationId: get_project_access_by_id
      parameters:
      - name: principalUser
        in: query
        description: 'The user to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
      - name: principalRole
        in: query
        description: 'The role to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
          format: uuid
      - name: project_id
        in: path
        description: Project ID (optional; falls back to the default project if not provided)
        required: true
        schema:
          type:
          - string
          - 'null'
      responses:
        '200':
          description: Server Relations
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetProjectAccessResponse'
      deprecated: true
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/project/{project_id}/assignments:
    get:
      tags:
      - permissions-openfga
      summary: Get user and role assignments to a project
      description: '**Deprecated:** Use `/management/v1/permissions/project/assignments` instead.'
      operationId: get_project_assignments_by_id
      parameters:
      - name: relations
        in: query
        description: Relations to be loaded. If not specified, all relations are returned.
        required: false
        schema:
          type: array
          items:
            $ref: '#/components/schemas/ProjectRelation'
      - name: project_id
        in: path
        description: Project ID (optional; falls back to the default project if not provided)
        required: true
        schema:
          type:
          - string
          - 'null'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetProjectAssignmentsResponse'
      deprecated: true
    post:
      tags:
      - permissions-openfga
      summary: Update permissions for a project
      operationId: update_project_assignments_by_id
      parameters:
      - name: project_id
        in: path
        description: Project ID (optional; falls back to the default project if not provided)
        required: true
        schema:
          type:
          - string
          - 'null'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateProjectAssignmentsRequest'
        required: true
      responses:
        '204':
          description: Permissions updated successfully
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/role/{role_id}/access:
    get:
      tags:
      - permissions-openfga
      summary: Get my access to a role
      description: '**Deprecated:** Use `/management/v1/permissions/role/{role_id}/authorizer-actions` for Authorizer permissions

        or `/management/v1/role/{role_id}/actions` for Catalog permissions instead.'
      operationId: get_role_access_by_id
      parameters:
      - name: role_id
        in: path
        description: Role ID
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetRoleAccessResponse'
      deprecated: true
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/role/{role_id}/assignments:
    get:
      tags:
      - permissions-openfga
      summary: Get user and role assignments of a role
      operationId: get_role_assignments_by_id
      parameters:
      - name: relations
        in: query
        description: Relations to be loaded. If not specified, all relations are returned.
        required: false
        schema:
          type: array
          items:
            $ref: '#/components/schemas/RoleRelation'
      - name: role_id
        in: path
        description: Role ID
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetRoleAssignmentsResponse'
    post:
      tags:
      - permissions-openfga
      operationId: update_role_assignments_by_id
      parameters:
      - name: role_id
        in: path
        description: Role ID
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRoleAssignmentsRequest'
        required: true
      responses:
        '204':
          description: Permissions updated successfully
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/role/{role_id}/authorizer-actions:
    get:
      tags:
      - permissions-openfga
      summary: Get allowed Authorizer actions on a role
      description: 'Returns Authorizer permissions (OpenFGA relations) for the specified role.

        For Catalog permissions, use `/management/v1/role/{role_id}/actions` instead.'
      operationId: get_authorizer_role_actions
      parameters:
      - name: principalUser
        in: query
        description: 'The user to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
      - name: principalRole
        in: query
        description: 'The role to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
          format: uuid
      - name: role_id
        in: path
        description: Role ID
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOpenFGARoleActionsResponse'
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/server/access:
    get:
      tags:
      - permissions-openfga
      summary: Get my access to the server
      description: '**Deprecated:** Use `/management/v1/permissions/server/authorizer-actions` for Authorizer permissions

        or `/management/v1/server/actions` for Catalog permissions instead.'
      operationId: get_server_access
      parameters:
      - name: principalUser
        in: query
        description: 'The user to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
      - name: principalRole
        in: query
        description: 'The role to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: Server Access
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetServerAccessResponse'
      deprecated: true
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/server/assignments:
    get:
      tags:
      - permissions-openfga
      summary: Get user and role assignments of the server
      operationId: get_server_assignments
      parameters:
      - name: relations
        in: query
        description: Relations to be loaded. If not specified, all relations are returned.
        required: false
        schema:
          type: array
          items:
            $ref: '#/components/schemas/ServerRelation'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetServerAssignmentsResponse'
    post:
      tags:
      - permissions-openfga
      summary: Update permissions for this server
      operationId: update_server_assignments
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateServerAssignmentsRequest'
        required: true
      responses:
        '204':
          description: Permissions updated successfully
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/server/authorizer-actions:
    get:
      tags:
      - permissions-openfga
      summary: Get allowed Authorizer actions on the server
      description: 'Returns Authorizer permissions (OpenFGA relations) for the server.

        For Catalog permissions, use `/management/v1/server/actions` instead.'
      operationId: get_authorizer_server_actions
      parameters:
      - name: principalUser
        in: query
        description: 'The user to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
      - name: principalRole
        in: query
        description: 'The role to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: Server Access
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOpenFGAServerActionsResponse'
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/warehouse/{warehouse_id}:
    get:
      tags:
      - permissions-openfga
      summary: Get Authorization properties of a warehouse
      operationId: get_warehouse_by_id
      parameters:
      - name: warehouse_id
        in: path
        description: Warehouse ID
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWarehouseAuthPropertiesResponse'
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/warehouse/{warehouse_id}/access:
    get:
      tags:
      - permissions-openfga
      summary: Get my access to a warehouse
      description: '**Deprecated:** Use `/management/v1/permissions/warehouse/{warehouse_id}/authorizer-actions` for Authorizer permissions

        or `/management/v1/warehouse/{warehouse_id}/actions` for Catalog permissions instead.'
      operationId: get_warehouse_access_by_id
      parameters:
      - name: principalUser
        in: query
        description: 'The user to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
      - name: principalRole
        in: query
        description: 'The role to show actions for.

          If neither user nor role is specified, shows actions for the current user.'
        required: false
        schema:
          type: string
          format: uuid
      - name: warehouse_id
        in: path
        description: Warehouse ID
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWarehouseAccessResponse'
      deprecated: true
    servers:
    - url: '{scheme}://{host}{basePath}'
      description: Lakekeeper Management API
      variables:
        basePath:
          default: ''
          description: Optional path prefix (starting with '/') to be prepended to all routes
        host:
          default: localhost
          description: The host (and optional port) for the specified server
        scheme:
          default: https
          description: The scheme of the URI, either http or https
  /management/v1/permissions/warehouse/{warehouse_id}/assignments:
    get:
      tags:
      - permissions-openfga
      summary: Get user and role assignments for a warehouse
      operationId: get_warehouse_assignments_by_id
      parameters:
      - name: relations
        in: query
        description: Relations to be loaded. If not specified, all relations are returned.
        required: false
        schema:
          type: array
          items:
            $ref: '#/components/schemas/WarehouseRelation'
      - name: warehouse_id
        in: path
        description: Warehouse ID
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWarehouseAssignmentsResponse'
    post:
      tags:
      - permissions-openfga
      summary: Update permissions for a warehouse
      operationId: update_warehouse_assignments_by_id
      parameters:
      - name: warehouse_id
        in: path
        description: Warehouse ID
        required: true
        schema:
     

# --- truncated at 32 KB (84 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/lakekeeper/refs/heads/main/openapi/lakekeeper-permissions-openfga-api-openapi.yml