OpenFGA

OpenFGA Assertions API

The Assertions API from OpenFGA — 1 operation(s) for assertions.

Documentation GitHub OpenAPI

Operations 2

GET /stores/{store_id}/assertions/{authorization_model_id} Read assertions for an authorization model ID #

PUT /stores/{store_id}/assertions/{authorization_model_id} Upsert assertions for an authorization model ID #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/openfga-assertions-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: OpenFGA Assertions API
  description: A high performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.
  version: 1.x
  contact:
    name: OpenFGA
    url: https://openfga.dev
    email: community@openfga.dev
  license:
    name: Apache-2.0
    url: https://github.com/openfga/openfga/blob/main/LICENSE
tags:
- name: Assertions
paths:
  /stores/{store_id}/assertions/{authorization_model_id}:
    get:
      summary: Read assertions for an authorization model ID
      description: 'The ReadAssertions API will return, for a given authorization model id, all the assertions stored for it. '
      operationId: ReadAssertions
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReadAssertionsResponse'
        '400':
          description: Request failed due to invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationErrorMessageResponse'
        '401':
          description: Not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthenticatedResponse'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Request failed due to incorrect path.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PathUnknownErrorMessageResponse'
        '409':
          description: Request was aborted due a transaction conflict.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AbortedMessageResponse'
        '422':
          description: Request timed out due to excessive request throttling.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnprocessableContentMessageResponse'
        '500':
          description: Request failed due to internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorMessageResponse'
      parameters:
      - name: store_id
        in: path
        required: true
        schema:
          type: string
      - name: authorization_model_id
        in: path
        required: true
        schema:
          type: string
      tags:
      - Assertions
    put:
      summary: Upsert assertions for an authorization model ID
      description: The WriteAssertions API will upsert new assertions for an authorization model id, or overwrite the existing ones. An assertion is an object that contains a tuple key, the expectation of whether a call to the Check API of that tuple key will return true or false, and optionally a list of contextual tuples.
      operationId: WriteAssertions
      responses:
        '204':
          description: A successful response.
        '400':
          description: Request failed due to invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationErrorMessageResponse'
        '401':
          description: Not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthenticatedResponse'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Request failed due to incorrect path.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PathUnknownErrorMessageResponse'
        '409':
          description: Request was aborted due a transaction conflict.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AbortedMessageResponse'
        '422':
          description: Request timed out due to excessive request throttling.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnprocessableContentMessageResponse'
        '500':
          description: Request failed due to internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorMessageResponse'
      parameters:
      - name: store_id
        in: path
        required: true
        schema:
          type: string
      - name: authorization_model_id
        in: path
        required: true
        schema:
          type: string
      tags:
      - Assertions
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                assertions:
                  type: array
                  items:
                    type: object
                    $ref: '#/components/schemas/Assertion'
                  maxItems: 100
              required:
              - assertions
        required: true
components:
  schemas:
    Assertion:
      type: object
      properties:
        tuple_key:
          $ref: '#/components/schemas/AssertionTupleKey'
        expectation:
          type: boolean
        contextual_tuples:
          type: array
          items:
            type: object
            $ref: '#/components/schemas/TupleKey'
          maxItems: 20
        context:
          type: object
          example:
            view_count: 100
          description: 'Additional request context that will be used to evaluate any ABAC conditions encountered

            in the query evaluation.'
      required:
      - tuple_key
      - expectation
    ErrorCode:
      type: string
      enum:
      - no_error
      - validation_error
      - authorization_model_not_found
      - authorization_model_resolution_too_complex
      - invalid_write_input
      - cannot_allow_duplicate_tuples_in_one_request
      - cannot_allow_duplicate_types_in_one_request
      - cannot_allow_multiple_references_to_one_relation
      - invalid_continuation_token
      - invalid_tuple_set
      - invalid_check_input
      - invalid_expand_input
      - unsupported_user_set
      - invalid_object_format
      - write_failed_due_to_invalid_input
      - authorization_model_assertions_not_found
      - latest_authorization_model_not_found
      - type_not_found
      - relation_not_found
      - empty_relation_definition
      - invalid_user
      - invalid_tuple
      - unknown_relation
      - store_id_invalid_length
      - assertions_too_many_items
      - id_too_long
      - authorization_model_id_too_long
      - tuple_key_value_not_specified
      - tuple_keys_too_many_or_too_few_items
      - page_size_invalid
      - param_missing_value
      - difference_base_missing_value
      - subtract_base_missing_value
      - object_too_long
      - relation_too_long
      - type_definitions_too_few_items
      - type_invalid_length
      - type_invalid_pattern
      - relations_too_few_items
      - relations_too_long
      - relations_invalid_pattern
      - object_invalid_pattern
      - query_string_type_continuation_token_mismatch
      - exceeded_entity_limit
      - invalid_contextual_tuple
      - duplicate_contextual_tuple
      - invalid_authorization_model
      - unsupported_schema_version
      - cancelled
      - invalid_start_time
      default: no_error
    InternalErrorMessageResponse:
      type: object
      example:
        code: internal_error
        message: Internal Server Error
      properties:
        code:
          $ref: '#/components/schemas/InternalErrorCode'
        message:
          type: string
    AbortedMessageResponse:
      type: object
      example:
        code: '10'
        message: transaction conflict
      properties:
        code:
          type: string
        message:
          type: string
    UnauthenticatedResponse:
      type: object
      example:
        code: unauthenticated
        message: unauthenticated
      properties:
        code:
          $ref: '#/components/schemas/ErrorCode'
        message:
          type: string
    ValidationErrorMessageResponse:
      type: object
      example:
        code: validation_error
        message: Generic validation error
      properties:
        code:
          $ref: '#/components/schemas/ErrorCode'
        message:
          type: string
    NotFoundErrorCode:
      type: string
      enum:
      - no_not_found_error
      - undefined_endpoint
      - store_id_not_found
      - unimplemented
      default: no_not_found_error
    TupleKey:
      type: object
      properties:
        user:
          type: string
          example: user:anne
          maxLength: 512
        relation:
          type: string
          example: reader
          maxLength: 50
        object:
          type: string
          example: document:2021-budget
          maxLength: 256
        condition:
          $ref: '#/components/schemas/RelationshipCondition'
      required:
      - user
      - relation
      - object
    AssertionTupleKey:
      type: object
      properties:
        object:
          type: string
          example: document:2021-budget
          maxLength: 256
        relation:
          type: string
          example: reader
          maxLength: 50
        user:
          type: string
          example: user:anne
          maxLength: 512
      required:
      - object
      - relation
      - user
    AuthErrorCode:
      type: string
      enum:
      - no_auth_error
      - auth_failed_invalid_subject
      - auth_failed_invalid_audience
      - auth_failed_invalid_issuer
      - invalid_claims
      - auth_failed_invalid_bearer_token
      - bearer_token_missing
      - unauthenticated
      - forbidden
      default: no_auth_error
    InternalErrorCode:
      type: string
      enum:
      - no_internal_error
      - internal_error
      - deadline_exceeded
      - already_exists
      - resource_exhausted
      - failed_precondition
      - aborted
      - out_of_range
      - unavailable
      - data_loss
      default: no_internal_error
    UnprocessableContentMessageResponse:
      type: object
      example:
        code: throttled_timeout_error
        message: timeout due to throttling on complex request
      properties:
        code:
          $ref: '#/components/schemas/UnprocessableContentErrorCode'
        message:
          type: string
    UnprocessableContentErrorCode:
      type: string
      enum:
      - no_throttled_error_code
      - throttled_timeout_error
      default: no_throttled_error_code
    ForbiddenResponse:
      type: object
      example:
        code: forbidden
        message: the principal is not authorized to perform the action
      properties:
        code:
          $ref: '#/components/schemas/AuthErrorCode'
        message:
          type: string
    RelationshipCondition:
      type: object
      properties:
        name:
          type: string
          example: condition1
          description: A reference (by name) of the relationship condition defined in the authorization model.
          maxLength: 256
        context:
          type: object
          description: 'Additional context/data to persist along with the condition.

            The keys must match the parameters defined by the condition, and the value types must

            match the parameter type definitions.'
      required:
      - name
    PathUnknownErrorMessageResponse:
      type: object
      example:
        code: undefined_endpoint
        message: Endpoint not enabled
      properties:
        code:
          $ref: '#/components/schemas/NotFoundErrorCode'
        message:
          type: string
    ReadAssertionsResponse:
      type: object
      properties:
        authorization_model_id:
          type: string
          example: 01G5JAVJ41T49E9TT3SKVS7X1J
        assertions:
          type: array
          items:
            type: object
            $ref: '#/components/schemas/Assertion'
      required:
      - authorization_model_id