Topaz

Topaz is an open-source (Apache-2.0) authorizer for fine-grained, policy-based, real-time access control for applications and APIs, maintained by Aserto (github.com/aserto-dev/topaz). It combines the Open Policy Agent (OPA) decision engine with a built-in Zanzibar-style relationship directory, so you can express authorization as policy-as-code and model RBAC, ReBAC, and ABAC over an object graph of users, groups, resources, and relations. Topaz is self-hosted - you run the authorizer yourself (Docker or binary) and it exposes gRPC plus REST (gRPC-gateway) APIs from your own instance. The Authorizer API answers decisions (is, decisiontree, query); the Directory API reads and writes objects, relations, and permission checks; and a local web Console ships alongside. Aserto is the commercial hosted control plane built on Topaz for centrally managing policies, data, and decision logs across many deployed authorizers.

Topaz publishes 5 APIs on the APIs.io network, including Authorizer API, Directory Checks API, Directory Objects API, and 2 more. Tagged areas include Access Control, Authorization, Fine-Grained Authorization, Open Source, and RBAC.

Topaz’s developer surface includes documentation and 8 more developer resources.

🌐 Visit website 📡 Source on GitHub
35.5/100 thin ▬ flat Agent 39/100 agent aware Full breakdown ↓
scored 2026-07-27 · rubric v0.5
AccessFreemium
5 APIs
Access ControlAuthorizationFine-Grained AuthorizationOpen SourceRBACReBACZanzibarOPAPolicy as Code

Kin Score

Kin Score Kin Score How this is scored →
scored 2026-07-27 · rubric v0.5
Composite quality — 35.5/100 · thin
Contract Quality 14.5 / 25
Developer Ergonomics 1.7 / 20
Commercial Clarity 5.8 / 20
Operational Transparency 4.8 / 13
Governance 0.0 / 12
Discoverability 8.8 / 10
Agent readiness — 39/100 · agent aware
Machine-Readable Contract 18 / 18
Agentic Access Contract 15 / 15
MCP Server 0 / 12
Machine-Readable Auth 0 / 10
Idempotency 0 / 9
Stable Error Semantics 0 / 8
Request/Response Examples 0 / 7
Rate-Limit Signaling 7 / 7
Typed Event Surface 0 / 6
Agent Skills 0 / 5
Well-Known Catalog 0 / 4
Consent & Bot Identity 0 / 3
Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. This rating is computed from github.com/api-evangelist/topaz: open an issue to ask a question, or submit a pull request to add artifacts. Want it done for you? Prioritized profiling — $2,500 →

APIs 5

Individual APIs this provider publishes, each with its own machine-readable definition.

Topaz Authorizer API

Policy-driven decisions - is, decisiontree, and query - evaluated by the OPA engine.

Topaz Directory Checks API

Graph-based check and graph-expansion queries over the directory.

Topaz Directory Objects API

Objects in the Zanzibar-style directory - users, groups, resources, and other entities.

Topaz Directory Relations API

Relations (tuples) connecting subjects to objects in the directory graph.

Topaz Policies API

OPA policy modules loaded into the authorizer.

Open Collections 1

Open, tool-agnostic API collections (OpenAPI-derived and Bruno).

Topaz Authorizer and Directory API

OPEN COLLECTION

Pricing Plans 1

Published pricing tiers and plan structures.

Topaz Plans Pricing

2 plans

PLANS

Rate Limits 1

Documented rate limits and quota policies.

Topaz Rate Limits

3 limits

RATE LIMITS

FinOps 1

Cost, billing, and metering signals for API financial operations.

Topaz Finops

FINOPS

Agentic Access 1

Recommended x-agentic-access execution contracts for AI agents.

Topaz Agentic Access

15 operations · 8 acting

15 operations · 8 acting

AGENTIC

Resources

Documentation 1

Reference material describing how the API behaves

Documentation
Documentation

Agent Surfaces 1

MCP servers, agent skills, and machine-readable catalogs

AgenticAccess
AgenticAccess

Build 2

SDKs, sample code, and the tooling you integrate with

GitHubOrganization
GitHubOrganization
 SourceCode
SourceCode

Operate 1

Status, limits, changes, and where to get help

RateLimits
RateLimits

Commercial 2

Pricing, plans, and the legal terms of use

Plans
Plans
 FinOps
FinOps

Company 2

The organization behind the API

LinkedIn
LinkedIn
 Website
Website

Source (apis.yml)

apis.yml Raw ↑ 
aid: topaz
url: https://raw.githubusercontent.com/api-evangelist/topaz/refs/heads/main/apis.yml
name: Topaz
kind: organization
description: Topaz is an open-source (Apache-2.0) authorizer for fine-grained, policy-based, real-time access control for
  applications and APIs, maintained by Aserto (github.com/aserto-dev/topaz). It combines the Open Policy Agent (OPA) decision
  engine with a built-in Zanzibar-style relationship directory, so you can express authorization as policy-as-code and model
  RBAC, ReBAC, and ABAC over an object graph of users, groups, resources, and relations. Topaz is self-hosted - you run the
  authorizer yourself (Docker or binary) and it exposes gRPC plus REST (gRPC-gateway) APIs from your own instance. The Authorizer
  API answers decisions (is, decisiontree, query); the Directory API reads and writes objects, relations, and permission checks;
  and a local web Console ships alongside. Aserto is the commercial hosted control plane built on Topaz for centrally managing
  policies, data, and decision logs across many deployed authorizers.
accessModel:
  pricing: freemium
  onboarding: unknown
  trial: false
  try_now: false
  public: false
  label: Freemium
  confidence: medium
  source:
  - plans
  generated: '2026-07-22'
  method: derived
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/topaz.png
tags:
- Access Control
- Authorization
- Fine-Grained Authorization
- Open Source
- RBAC
- ReBAC
- Zanzibar
- OPA
- Policy as Code
created: '2026-07-11'
modified: '2026-07-11'
specificationVersion: '0.19'
apis:
- aid: topaz:topaz-authorizer-api
  name: Topaz Authorizer API
  description: Policy-driven decisions - is, decisiontree, and query - evaluated by the OPA engine.
  humanURL: https://www.topaz.sh/docs/authorizer-guide/overview
  baseURL: https://localhost:8383
  tags:
  - Authorizer
  properties:
  - type: OpenAPI
    url: openapi/topaz-authorizer-api-openapi.yml
  - type: Documentation
    url: https://www.topaz.sh/docs/authorizer-guide/overview
  - type: APIReference
    url: https://www.topaz.sh/docs/authorizer-guide/is
  - type: PostmanCollection
    url: collections/topaz.postman_collection.json
  - type: OpenCollection
    url: collections/topaz.opencollection.json
  - type: Documentation
    url: https://www.topaz.sh/docs/directory
  - type: APIReference
    url: https://www.topaz.sh/docs/directory/writer
  - type: APIReference
    url: https://www.topaz.sh/docs/directory/apis
- aid: topaz:topaz-directory-checks-api
  name: Topaz Directory Checks API
  description: Graph-based check and graph-expansion queries over the directory.
  humanURL: https://www.topaz.sh/docs/authorizer-guide/overview
  baseURL: https://localhost:8383
  tags:
  - Directory Checks
  properties:
  - type: OpenAPI
    url: openapi/topaz-directory-checks-api-openapi.yml
  - type: Documentation
    url: https://www.topaz.sh/docs/authorizer-guide/overview
  - type: APIReference
    url: https://www.topaz.sh/docs/authorizer-guide/is
  - type: PostmanCollection
    url: collections/topaz.postman_collection.json
  - type: OpenCollection
    url: collections/topaz.opencollection.json
  - type: Documentation
    url: https://www.topaz.sh/docs/directory
  - type: APIReference
    url: https://www.topaz.sh/docs/directory/writer
  - type: APIReference
    url: https://www.topaz.sh/docs/directory/apis
- aid: topaz:topaz-directory-objects-api
  name: Topaz Directory Objects API
  description: Objects in the Zanzibar-style directory - users, groups, resources, and other entities.
  humanURL: https://www.topaz.sh/docs/authorizer-guide/overview
  baseURL: https://localhost:8383
  tags:
  - Directory Objects
  properties:
  - type: OpenAPI
    url: openapi/topaz-directory-objects-api-openapi.yml
  - type: Documentation
    url: https://www.topaz.sh/docs/authorizer-guide/overview
  - type: APIReference
    url: https://www.topaz.sh/docs/authorizer-guide/is
  - type: PostmanCollection
    url: collections/topaz.postman_collection.json
  - type: OpenCollection
    url: collections/topaz.opencollection.json
  - type: Documentation
    url: https://www.topaz.sh/docs/directory
  - type: APIReference
    url: https://www.topaz.sh/docs/directory/writer
  - type: APIReference
    url: https://www.topaz.sh/docs/directory/apis
- aid: topaz:topaz-directory-relations-api
  name: Topaz Directory Relations API
  description: Relations (tuples) connecting subjects to objects in the directory graph.
  humanURL: https://www.topaz.sh/docs/authorizer-guide/overview
  baseURL: https://localhost:8383
  tags:
  - Directory Relations
  properties:
  - type: OpenAPI
    url: openapi/topaz-directory-relations-api-openapi.yml
  - type: Documentation
    url: https://www.topaz.sh/docs/authorizer-guide/overview
  - type: APIReference
    url: https://www.topaz.sh/docs/authorizer-guide/is
  - type: PostmanCollection
    url: collections/topaz.postman_collection.json
  - type: OpenCollection
    url: collections/topaz.opencollection.json
  - type: Documentation
    url: https://www.topaz.sh/docs/directory
  - type: APIReference
    url: https://www.topaz.sh/docs/directory/writer
  - type: APIReference
    url: https://www.topaz.sh/docs/directory/apis
- aid: topaz:topaz-policies-api
  name: Topaz Policies API
  description: OPA policy modules loaded into the authorizer.
  humanURL: https://www.topaz.sh/docs/authorizer-guide/overview
  baseURL: https://localhost:8383
  tags:
  - Policies
  properties:
  - type: OpenAPI
    url: openapi/topaz-policies-api-openapi.yml
  - type: Documentation
    url: https://www.topaz.sh/docs/authorizer-guide/overview
  - type: APIReference
    url: https://www.topaz.sh/docs/authorizer-guide/is
  - type: PostmanCollection
    url: collections/topaz.postman_collection.json
  - type: OpenCollection
    url: collections/topaz.opencollection.json
  - type: Documentation
    url: https://www.topaz.sh/docs/directory
  - type: APIReference
    url: https://www.topaz.sh/docs/directory/writer
  - type: APIReference
    url: https://www.topaz.sh/docs/directory/apis
common:
- type: AgenticAccess
  url: agentic-access/topaz-agentic-access.yml
- type: GitHubOrganization
  url: https://github.com/aserto-dev/topaz
- type: LinkedIn
  url: https://www.linkedin.com/company/aserto
- type: Website
  url: https://www.topaz.sh/
- type: Documentation
  url: https://www.topaz.sh/docs
- type: Plans
  url: plans/topaz-plans-pricing.yml
- type: RateLimits
  url: rate-limits/topaz-rate-limits.yml
- type: FinOps
  url: finops/topaz-finops.yml
- type: SourceCode
  url: https://github.com/aserto-dev/topaz
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com