Skip to main content
Version: 1.0

AuthZEN access evaluation

The AS exposes an AuthZEN-compatible endpoint for coarse-grained access queries.

Authentication: Bearer token with authzen scope, OR Basic auth with a client entitled to authzen scope.

Get an authzen-scoped token first:

curl -X POST https://pbac.example.com/token \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d "grant_type=client_credentials" \
  -d "scope=authzen" \
  -d "resource=urn:as:authzen"

Evaluate access:

curl -X POST https://pbac.example.com/access/v1/evaluation \
  -H "Authorization: Bearer $AUTHZEN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "subject": {
      "type": "user",
      "id": "alice@example.com"
    },
    "action": {
      "name": "read"
    },
    "resource": {
      "type": "urn:example:Patient",
      "id": "patient/123"
    },
    "context": {
      "scope": "read",
      "resource_type": "urn:example:Patient"
    }
  }'

Response:

{ "decision": true }

The AuthZEN endpoint routes to OPA's direct evaluation path (OpaDirectClient), which uses the same token policy package. The subject, action, resource, and context fields are mapped to the OPA input.

Next steps​