# Topaz

**Canonical:** https://apis.io/providers/topaz/  
**Website:** https://www.topaz.sh/  
**APIs profiled:** 5

Topaz is an open-source (Apache-2.0) authorizer for fine-grained, policy-based, real-time access control for applications and APIs, maintained by Aserto (github.com/aserto-dev/topaz). It combines the Open Policy Agent (OPA) decision engine with a built-in Zanzibar-style relationship directory, so you can express authorization as policy-as-code and model RBAC, ReBAC, and ABAC over an object graph of users, groups, resources, and relations. Topaz is self-hosted - you run the authorizer yourself (Docker or binary) and it exposes gRPC plus REST (gRPC-gateway) APIs from your own instance. The Authorizer API answers decisions (is, decisiontree, query); the Directory API reads and writes objects, relations, and permission checks; and a local web Console ships alongside. Aserto is the commercial hosted control plane built on Topaz for centrally managing policies, data, and decision logs across many deployed authorizers.

## Kin Score — 28.5 / 100 (thin)

Scored 2026-08-20 under rubric 0.12.0. Trend: flat (+0.0 from 28.5).

| Facet | Score |
|---|---|
| Discoverability | 64.8 |
| Contract Quality | 55.7 |
| Governance | 0.0 |
| Contract Governance | 0.0 |
| Operational Transparency | 34.2 |
| Developer Ergonomics | 9.5 |
| Commercial Clarity | 28.9 |
| Access Clarity | 28.9 |

Regulatory layer — **Insurance**: 0.0 (matched via tags).

## Agent readiness — 20.5 (agent-aware)

| Dimension | Value |
|---|---|
| Spec Presence | yes |
| Agentic Access | derived |
| Reversibility Documented | no |
| MCP Server | no |
| Auth Clarity | no |
| Idempotency | no |
| Error Semantics | no |
| OpenAPI Examples | no |
| Rate Limit Signal | documented |
| Event Surface Described | no |
| Agent Skills | no |
| Well Known Catalog | no |
| Consent Identity | no |
| Agent Card | no |
| Dry Run Mode | no |

## Access

Freemium — onboarding: unknown, pricing: freemium, trial: no (confidence: medium).

## APIs (5)

- **Topaz Authorizer API** — Policy-driven decisions - is, decisiontree, and query - evaluated by the OPA engine.
- **Topaz Directory Checks API** — Graph-based check and graph-expansion queries over the directory.
- **Topaz Directory Objects API** — Objects in the Zanzibar-style directory - users, groups, resources, and other entities.
- **Topaz Directory Relations API** — Relations (tuples) connecting subjects to objects in the directory graph.
- **Topaz Policies API** — OPA policy modules loaded into the authorizer.

## Agentic access (1)

- **Topaz Agentic Access** — 15 operations · 8 acting

## Plans (1)

- **Topaz Plans Pricing**

## Tags

Access Control, Authorization, Fine-Grained Authorization, Open-Source, RBAC, ReBAC, Zanzibar, OPA, Policy as Code

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/topaz/). Scores are computed from the provider's own public artifacts under a published rubric.