apidocs.swagger.json

{
  "swagger": "2.0",
  "info": {
    "title": "Authzed",
    "version": "1.0",
    "contact": {
      "name": "Authzed, Inc.",
      "url": "https://github.com/authzed/api",
      "email": "support@authzed.com"
    },
    "license": {
      "name": "Apache 2.0 License",
      "url": "https://github.com/authzed/api/blob/main/LICENSE"
    }
  },
  "tags": [
    {
      "name": "ACLService"
    },
    {
      "name": "DeveloperService"
    },
    {
      "name": "NamespaceService"
    },
    {
      "name": "WatchService"
    },
    {
      "name": "PermissionsService"
    },
    {
      "name": "SchemaService"
    },
    {
      "name": "WatchService"
    },
    {
      "name": "SchemaService"
    }
  ],
  "schemes": [
    "http",
    "https",
    "wss"
  ],
  "consumes": [
    "application/json"
  ],
  "produces": [
    "application/json"
  ],
  "paths": {
    "/v1/permissions/check": {
      "post": {
        "summary": "CheckPermission checks whether a subject has a particular permission or is\na member of a particular relation, on a given resource.",
        "operationId": "PermissionsService_CheckPermission",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CheckPermissionResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CheckPermissionRequest"
            }
          }
        ],
        "tags": [
          "PermissionsService"
        ]
      }
    },
    "/v1/permissions/expand": {
      "post": {
        "summary": "ExpandPermissionTree expands the relationships reachable from a particular\npermission or relation of a given resource.",
        "operationId": "PermissionsService_ExpandPermissionTree",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ExpandPermissionTreeResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ExpandPermissionTreeRequest"
            }
          }
        ],
        "tags": [
          "PermissionsService"
        ]
      }
    },
    "/v1/permissions/resources": {
      "post": {
        "summary": "LookupResources returns the IDs of all resources on which the specified\nsubject has permission or on which the specified subject is a member of the\nrelation.",
        "operationId": "PermissionsService_LookupResources",
        "responses": {
          "200": {
            "description": "A successful response.(streaming responses)",
            "schema": {
              "type": "object",
              "properties": {
                "result": {
                  "$ref": "#/definitions/v1LookupResourcesResponse"
                },
                "error": {
                  "$ref": "#/definitions/rpcStatus"
                }
              },
              "title": "Stream result of v1LookupResourcesResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1LookupResourcesRequest"
            }
          }
        ],
        "tags": [
          "PermissionsService"
        ]
      }
    },
    "/v1/relationships/delete": {
      "post": {
        "summary": "DeleteRelationships deletes relationships matching one or more filters, in\nbulk.",
        "operationId": "PermissionsService_DeleteRelationships",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteRelationshipsResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1DeleteRelationshipsRequest"
            }
          }
        ],
        "tags": [
          "PermissionsService"
        ]
      }
    },
    "/v1/relationships/read": {
      "post": {
        "summary": "ReadRelationships reads a set of the relationships matching one or more\nfilters.",
        "operationId": "PermissionsService_ReadRelationships",
        "responses": {
          "200": {
            "description": "A successful response.(streaming responses)",
            "schema": {
              "type": "object",
              "properties": {
                "result": {
                  "$ref": "#/definitions/v1ReadRelationshipsResponse"
                },
                "error": {
                  "$ref": "#/definitions/rpcStatus"
                }
              },
              "title": "Stream result of v1ReadRelationshipsResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ReadRelationshipsRequest"
            }
          }
        ],
        "tags": [
          "PermissionsService"
        ]
      }
    },
    "/v1/relationships/write": {
      "post": {
        "summary": "WriteRelationships writes and/or deletes a set of specified relationships,\nwith an optional set of precondition relationships that must exist before\nthe operation can commit.",
        "operationId": "PermissionsService_WriteRelationships",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1WriteRelationshipsResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1WriteRelationshipsRequest"
            }
          }
        ],
        "tags": [
          "PermissionsService"
        ]
      }
    },
    "/v1/schema/read": {
      "post": {
        "summary": "Read returns the current Object Definitions for a Permissions System.",
        "description": "Errors include:\n- INVALID_ARGUMENT: a provided value has failed to semantically validate\n- NOT_FOUND: no schema has been defined",
        "operationId": "SchemaService_ReadSchema",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/apiv1ReadSchemaResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/apiv1ReadSchemaRequest"
            }
          }
        ],
        "tags": [
          "SchemaService"
        ]
      }
    },
    "/v1/schema/write": {
      "post": {
        "summary": "Write overwrites the current Object Definitions for a Permissions System.",
        "operationId": "SchemaService_WriteSchema",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/apiv1WriteSchemaResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/apiv1WriteSchemaRequest"
            }
          }
        ],
        "tags": [
          "SchemaService"
        ]
      }
    },
    "/v1/watch": {
      "post": {
        "operationId": "WatchService_Watch",
        "responses": {
          "200": {
            "description": "A successful response.(streaming responses)",
            "schema": {
              "type": "object",
              "properties": {
                "result": {
                  "$ref": "#/definitions/apiv1WatchResponse"
                },
                "error": {
                  "$ref": "#/definitions/rpcStatus"
                }
              },
              "title": "Stream result of apiv1WatchResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/apiv1WatchRequest"
            }
          }
        ],
        "tags": [
          "WatchService"
        ]
      }
    }
  },
  "definitions": {
    "CheckPermissionResponsePermissionship": {
      "type": "string",
      "enum": [
        "PERMISSIONSHIP_UNSPECIFIED",
        "PERMISSIONSHIP_NO_PERMISSION",
        "PERMISSIONSHIP_HAS_PERMISSION"
      ],
      "default": "PERMISSIONSHIP_UNSPECIFIED"
    },
    "CheckResponseMembership": {
      "type": "string",
      "enum": [
        "UNKNOWN",
        "NOT_MEMBER",
        "MEMBER"
      ],
      "default": "UNKNOWN"
    },
    "ChildThis": {
      "type": "object"
    },
    "ComputedUsersetObject": {
      "type": "string",
      "enum": [
        "TUPLE_OBJECT",
        "TUPLE_USERSET_OBJECT"
      ],
      "default": "TUPLE_OBJECT"
    },
    "DeveloperErrorErrorKind": {
      "type": "string",
      "enum": [
        "UNKNOWN_KIND",
        "PARSE_ERROR",
        "SCHEMA_ISSUE",
        "DUPLICATE_RELATIONSHIP",
        "MISSING_EXPECTED_RELATIONSHIP",
        "EXTRA_RELATIONSHIP_FOUND",
        "UNKNOWN_OBJECT_TYPE",
        "UNKNOWN_RELATION",
        "MAXIMUM_RECURSION",
        "ASSERTION_FAILED"
      ],
      "default": "UNKNOWN_KIND"
    },
    "DeveloperErrorSource": {
      "type": "string",
      "enum": [
        "UNKNOWN_SOURCE",
        "SCHEMA",
        "RELATIONSHIP",
        "VALIDATION_YAML",
        "CHECK_WATCH",
        "ASSERTION"
      ],
      "default": "UNKNOWN_SOURCE"
    },
    "LookupShareResponseLookupStatus": {
      "type": "string",
      "enum": [
        "UNKNOWN_REFERENCE",
        "FAILED_TO_LOOKUP",
        "VALID_REFERENCE",
        "UPGRADED_REFERENCE"
      ],
      "default": "UNKNOWN_REFERENCE"
    },
    "RelationTupleFilterFilter": {
      "type": "string",
      "enum": [
        "UNKNOWN",
        "OBJECT_ID",
        "RELATION",
        "USERSET"
      ],
      "default": "UNKNOWN"
    },
    "SetOperationChild": {
      "type": "object",
      "properties": {
        "This": {
          "$ref": "#/definitions/ChildThis"
        },
        "computedUserset": {
          "$ref": "#/definitions/v0ComputedUserset"
        },
        "tupleToUserset": {
          "$ref": "#/definitions/v0TupleToUserset"
        },
        "usersetRewrite": {
          "$ref": "#/definitions/v0UsersetRewrite"
        }
      }
    },
    "SubjectFilterRelationFilter": {
      "type": "object",
      "properties": {
        "relation": {
          "type": "string"
        }
      }
    },
    "apiv0WatchResponse": {
      "type": "object",
      "properties": {
        "updates": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v0RelationTupleUpdate"
          },
          "description": "A watch response contains all tuple modification events in ascending\ntimestamp order, from the requested start timestamp to a timestamp\nencoded in a heartbeat zookie included in the watch response. The client\ncan use the heartbeat zookie to resume watching where the previous watch\nresponse left off."
        },
        "endRevision": {
          "$ref": "#/definitions/v0Zookie"
        }
      }
    },
    "apiv1ReadSchemaRequest": {
      "type": "object",
      "description": "ReadSchemaRequest returns the schema from the database."
    },
    "apiv1ReadSchemaResponse": {
      "type": "object",
      "properties": {
        "schemaText": {
          "type": "string",
          "title": "schema_text is the textual form of the current schema in the system"
        }
      },
      "description": "ReadSchemaResponse is the resulting data after having read the Object\nDefinitions from a Schema."
    },
    "apiv1WatchRequest": {
      "type": "object",
      "properties": {
        "optionalObjectTypes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "optionalStartCursor": {
          "$ref": "#/definitions/v1ZedToken"
        }
      },
      "description": "WatchRequest specifies the object definitions for which we want to start\nwatching mutations, and an optional start snapshot for when to start\nwatching."
    },
    "apiv1WatchResponse": {
      "type": "object",
      "properties": {
        "updates": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v1RelationshipUpdate"
          }
        },
        "changesThrough": {
          "$ref": "#/definitions/v1ZedToken"
        }
      },
      "description": "WatchResponse contains all tuple modification events in ascending\ntimestamp order, from the requested start snapshot to a snapshot\nencoded in the watch response. The client can use the snapshot to resume\nwatching where the previous watch response left off."
    },
    "apiv1WriteSchemaRequest": {
      "type": "object",
      "properties": {
        "schema": {
          "type": "string",
          "description": "The Schema containing one or more Object Definitions that will be written\nto the Permissions System."
        }
      },
      "description": "WriteSchemaRequest is the required data used to \"upsert\" the Schema of a\nPermissions System."
    },
    "apiv1WriteSchemaResponse": {
      "type": "object",
      "description": "WriteSchemaResponse is the resulting data after having written a Schema to\na Permissions System."
    },
    "apiv1alpha1ReadSchemaResponse": {
      "type": "object",
      "properties": {
        "objectDefinitions": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The Object Definitions that were requested."
        },
        "computedDefinitionsRevision": {
          "type": "string",
          "description": "The computed revision of the returned object definitions."
        }
      },
      "description": "ReadSchemaResponse is the resulting data after having read the Object\nDefinitions from a Schema."
    },
    "apiv1alpha1WriteSchemaResponse": {
      "type": "object",
      "properties": {
        "objectDefinitionsNames": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The names of the Object Definitions that were written."
        },
        "computedDefinitionsRevision": {
          "type": "string",
          "description": "The computed revision of the written object definitions."
        }
      },
      "description": "WriteSchemaResponse is the resulting data after having written a Schema to\na Permissions System."
    },
    "protobufAny": {
      "type": "object",
      "properties": {
        "@type": {
          "type": "string",
          "description": "A URL/resource name that uniquely identifies the type of the serialized\nprotocol buffer message. This string must contain at least\none \"/\" character. The last segment of the URL's path must represent\nthe fully qualified name of the type (as in\n`path/google.protobuf.Duration`). The name should be in a canonical form\n(e.g., leading \".\" is not accepted).\n\nIn practice, teams usually precompile into the binary all types that they\nexpect it to use in the context of Any. However, for URLs which use the\nscheme `http`, `https`, or no scheme, one can optionally set up a type\nserver that maps type URLs to message definitions as follows:\n\n* If no scheme is provided, `https` is assumed.\n* An HTTP GET on the URL must yield a [google.protobuf.Type][]\n  value in binary format, or produce an error.\n* Applications are allowed to cache lookup results based on the\n  URL, or have them precompiled into a binary to avoid any\n  lookup. Therefore, binary compatibility needs to be preserved\n  on changes to types. (Use versioned type names to manage\n  breaking changes.)\n\nNote: this functionality is not currently available in the official\nprotobuf release, and it is not used for type URLs beginning with\ntype.googleapis.com.\n\nSchemes other than `http`, `https` (or the empty scheme) might be\nused with implementation specific semantics."
        }
      },
      "additionalProperties": {},
      "description": "`Any` contains an arbitrary serialized protocol buffer message along with a\nURL that describes the type of the serialized message.\n\nProtobuf library provides support to pack/unpack Any values in the form\nof utility functions or additional generated methods of the Any type.\n\nExample 1: Pack and unpack a message in C++.\n\n    Foo foo = ...;\n    Any any;\n    any.PackFrom(foo);\n    ...\n    if (any.UnpackTo(\u0026foo)) {\n      ...\n    }\n\nExample 2: Pack and unpack a message in Java.\n\n    Foo foo = ...;\n    Any any = Any.pack(foo);\n    ...\n    if (any.is(Foo.class)) {\n      foo = any.unpack(Foo.class);\n    }\n\n Example 3: Pack and unpack a message in Python.\n\n    foo = Foo(...)\n    any = Any()\n    any.Pack(foo)\n    ...\n    if any.Is(Foo.DESCRIPTOR):\n      any.Unpack(foo)\n      ...\n\n Example 4: Pack and unpack a message in Go\n\n     foo := \u0026pb.Foo{...}\n     any, err := anypb.New(foo)\n     if err != nil {\n       ...\n     }\n     ...\n     foo := \u0026pb.Foo{}\n     if err := any.UnmarshalTo(foo); err != nil {\n       ...\n     }\n\nThe pack methods provided by protobuf library will by default use\n'type.googleapis.com/full.type.name' as the type URL and the unpack\nmethods only use the fully qualified type name after the last '/'\nin the type URL, for example \"foo.bar.com/x/y.z\" will yield type\nname \"y.z\".\n\n\nJSON\n====\nThe JSON representation of an `Any` value uses the regular\nrepresentation of the deserialized, embedded message, with an\nadditional field `@type` which contains the type URL. Example:\n\n    package google.profile;\n    message Person {\n      string first_name = 1;\n      string last_name = 2;\n    }\n\n    {\n      \"@type\": \"type.googleapis.com/google.profile.Person\",\n      \"firstName\": \u003cstring\u003e,\n      \"lastName\": \u003cstring\u003e\n    }\n\nIf the embedded message type is well-known and has a custom JSON\nrepresentation, that representation will be embedded adding a field\n`value` which holds the custom JSON in addition to the `@type`\nfield. Example (for message [google.protobuf.Duration][]):\n\n    {\n      \"@type\": \"type.googleapis.com/google.protobuf.Duration\",\n      \"value\": \"1.212s\"\n    }"
    },
    "rpcStatus": {
      "type": "object",
      "properties": {
        "code": {
          "type": "integer",
          "format": "int32"
        },
        "message": {
          "type": "string"
        },
        "details": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/protobufAny"
          }
        }
      }
    },
    "v0CheckResponse": {
      "type": "object",
      "properties": {
        "isMember": {
          "type": "boolean"
        },
        "revision": {
          "$ref": "#/definitions/v0Zookie"
        },
        "membership": {
          "$ref": "#/definitions/CheckResponseMembership"
        }
      }
    },
    "v0ComputedUserset": {
      "type": "object",
      "properties": {
        "object": {
          "$ref": "#/definitions/ComputedUsersetObject"
        },
        "relation": {
          "type": "string"
        }
      }
    },
    "v0DeleteConfigsResponse": {
      "type": "object",
      "properties": {
        "revision": {
          "$ref": "#/definitions/v0Zookie"
        }
      }
    },
    "v0DeveloperError": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "line": {
          "type": "integer",
          "format": "int64"
        },
        "column": {
          "type": "integer",
          "format": "int64"
        },
        "source": {
          "$ref": "#/definitions/DeveloperErrorSource"
        },
        "kind": {
          "$ref": "#/definitions/DeveloperErrorErrorKind"
        },
        "path": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "context": {
          "type": "string",
          "description": "context holds the context for the error. For schema issues, this will be the\nname of the object type. For relationship issues, the full relationship string."
        }
      }
    },
    "v0DirectUserset": {
      "type": "object",
      "properties": {
        "users": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v0User"
          }
        }
      }
    },
    "v0EditCheckResponse": {
      "type": "object",
      "properties": {
        "requestErrors": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v0DeveloperError"
          }
        },
        "checkResults": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v0EditCheckResult"
          }
        }
      }
    },
    "v0EditCheckResult": {
      "type": "object",
      "properties": {
        "relationship": {
          "$ref": "#/definitions/v0RelationTuple"
        },
        "isMember": {
          "type": "boolean"
        },
        "error": {
          "$ref": "#/definitions/v0DeveloperError"
        }
      }
    },
    "v0ExpandResponse": {
      "type": "object",
      "properties": {
        "treeNode": {
          "$ref": "#/definitions/v0RelationTupleTreeNode",
          "description": "The result is represented by a userset tree whose leaf nodes are user IDs\nor usersets pointing to other ⟨object#relation⟩ pairs, and intermediate\nnodes represent union, intersection, or exclusion operators."
        },
        "revision": {
          "$ref": "#/definitions/v0Zookie"
        }
      }
    },
    "v0FormatSchemaResponse": {
      "type": "object",
      "properties": {
        "error": {
          "$ref": "#/definitions/v0DeveloperError"
        },
        "formattedSchema": {
          "type": "string"
        }
      }
    },
    "v0LookupResponse": {
      "type": "object",
      "properties": {
        "resolvedObjectIds": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "nextPageReference": {
          "type": "string"
        },
        "revision": {
          "$ref": "#/definitions/v0Zookie"
        }
      }
    },
    "v0LookupShareResponse": {
      "type": "object",
      "properties": {
        "status": {
          "$ref": "#/definitions/LookupShareResponseLookupStatus"
        },
        "schema": {
          "type": "string"
        },
        "relationshipsYaml": {
          "type": "string"
        },
        "validationYaml": {
          "type": "string"
        },
        "assertionsYaml": {
          "type": "string"
        }
      }
    },
    "v0Metadata": {
      "type": "object",
      "properties": {
        "metadataMessage": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/protobufAny"
          }
        }
      }
    },
    "v0NamespaceDefinition": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string"
        },
        "relation": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v0Relation"
          }
        },
        "metadata": {
          "$ref": "#/definitions/v0Metadata"
        }
      }
    },
    "v0ObjectAndRelation": {
      "type": "object",
      "properties": {
        "namespace": {
          "type": "string"
        },
        "objectId": {
          "type": "string"
        },
        "relation": {
          "type": "string"
        }
      }
    },
    "v0ReadConfigResponse": {
      "type": "object",
      "properties": {
        "namespace": {
          "type": "string"
        },
        "config": {
          "$ref": "#/definitions/v0NamespaceDefinition"
        },
        "revision": {
          "$ref": "#/definitions/v0Zookie"
        }
      }
    },
    "v0ReadResponse": {
      "type": "object",
      "properties": {
        "tuplesets": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v0ReadResponseTupleset"
          }
        },
        "revision": {
          "$ref": "#/definitions/v0Zookie"
        }
      }
    },
    "v0ReadResponseTupleset": {
      "type": "object",
      "properties": {
        "tuples": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v0RelationTuple"
          }
        }
      }
    },
    "v0Relation": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string"
        },
        "usersetRewrite": {
          "$ref": "#/definitions/v0UsersetRewrite"
        },
        "typeInformation": {
          "$ref": "#/definitions/v0TypeInformation"
        },
        "metadata": {
          "$ref": "#/definitions/v0Metadata"
        }
      }
    },
    "v0RelationReference": {
      "type": "object",
      "properties": {
        "namespace": {
          "type": "string"
        },
        "relation": {
          "type": "string"
        }
      }
    },
    "v0RelationTuple": {
      "type": "object",
      "properties": {
        "objectAndRelation": {
          "$ref": "#/definitions/v0ObjectAndRelation",
          "description": "Each tupleset specifies keys of a set of relation tuples. The set can\ninclude a single tuple key, or all tuples with a given object ID or\nuserset in a namespace, optionally constrained by a relation name.\n\nexamples:\ndoc:readme#viewer@group:eng#member (fully specified)\ndoc:*#*#group:eng#member (all tuples that this userset relates to)\ndoc:12345#*#* (all tuples with a direct relationship to a document)\ndoc:12345#writer#* (all tuples with direct write relationship with the\ndocument) doc:#writer#group:eng#member (all tuples that eng group has write\nrelationship)"
        },
        "user": {
          "$ref": "#/definitions/v0User"
        }
      }
    },
    "v0RelationTupleFilter": {
      "type": "object",
      "properties": {
        "namespace": {
          "type": "string"
        },
        "objectId": {
          "type": "string",
          "title": "Setting any of these fields requires the appropriate filter type to be\nadded to the filters list as well"
        },
        "relation": {
          "type": "string"
        },
        "userset": {
          "$ref": "#/definitions/v0ObjectAndRelation"
        },
        "filters": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/RelationTupleFilterFilter"
          }
        }
      }
    },
    "v0RelationTupleTreeNode": {
      "type": "object",
      "properties": {
        "intermediateNode": {
          "$ref": "#/definitions/v0SetOperationUserset"
        },
        "leafNode": {
          "$ref": "#/definitions/v0DirectUserset"
        },
        "expanded": {
          "$ref": "#/definitions/v0ObjectAndRelation"
        }
      }
    },
    "v0RelationTupleUpdate": {
      "type": "object",
      "properties": {
        "operation": {
          "$ref": "#/definitions/v0RelationTupleUpdateOperation"
        },
        "tuple": {
          "$ref": "#/definitions/v0RelationTuple"
        }
      }
    },
    "v0RelationTupleUpdateOperation": {
      "type": "string",
      "enum": [
        "UNKNOWN",
        "CREATE",
        "TOUCH",
        "DELETE"
      ],
      "default": "UNKNOWN"
    },
    "v0RequestContext": {
      "type": "object",
      "properties": {
        "schema": {
          "type": "string"
        },
        "relationships": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v0RelationTuple"
          }
        },
        "legacyNsConfigs": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v0NamespaceDefinition"
          }
        }
      }
    },
    "v0SetOperation": {
      "type": "object",
      "properties": {
        "child": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/SetOperationChild"
          }
        }
      }
    },
    "v0SetOperationUserset": {
      "type": "object",
      "properties": {
        "operation": {
          "$ref": "#/definitions/v0SetOperationUsersetOperation"
        },
        "childNodes": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v0RelationTupleTreeNode"
          }
        }
      }
    },
    "v0SetOperationUsersetOperation": {
      "type": "string",
      "enum": [
        "INVALID",
        "UNION",
        "INTERSECTION",
        "EXCLUSION"
      ],
      "default": "INVALID"
    },
    "v0ShareResponse": {
      "type": "object",
      "properties": {
        "shareReference": {
          "type": "string"
        }
      }
    },
    "v0TupleToUserset": {
      "type": "object",
      "properties": {
        "tupleset": {
          "$ref": "#/definitions/v0TupleToUsersetTupleset"
        },
        "computedUserset": {
          "$ref": "#/definitions/v0ComputedUserset"
        }
      }
    },
    "v0TupleToUsersetTupleset": {
      "type": "object",
      "properties": {
        "relation": {
          "type": "string"
        }
      }
    },
    "v0TypeInformation": {
      "type": "object",
      "properties": {
        "allowedDirectRelations": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v0RelationReference"
          }
        }
      }
    },
    "v0UpgradeSchemaResponse": {
      "type": "object",
      "properties": {
        "error": {
          "$ref": "#/definitions/v0DeveloperError"
        },
        "upgradedSchema": {
          "type": "string"
        }
      }
    },
    "v0User": {
      "type": "object",
      "properties": {
        "userset": {
          "$ref": "#/definitions/v0ObjectAndRelation"
        }
      }
    },
    "v0UsersetRewrite": {
      "type": "object",
      "properties": {
        "union": {
          "$ref": "#/definitions/v0SetOperation"
        },
        "intersection": {
          "$ref": "#/definitions/v0SetOperation"
        },
        "exclusion": {
          "$ref": "#/definitions/v0SetOperation"
        }
      }
    },
    "v0ValidateResponse": {
      "type": "object",
      "properties": {
        "requestErrors": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v0DeveloperError"
          }
        },
        "validationErrors": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v0DeveloperError"
          }
        },
        "updatedValidationYaml": {
          "type": "string"
        }
      }
    },
    "v0WriteConfigResponse": {
      "type": "object",
      "properties": {
        "revision": {
          "$ref": "#/definitions/v0Zookie"
        }
      }
    },
    "v0WriteResponse": {
      "type": "object",
      "properties": {
        "revision": {
          "$ref": "#/definitions/v0Zookie"
        }
      }
    },
    "v0Zookie": {
      "type": "object",
      "properties": {
        "token": {
          "type": "string"
        }
      }
    },
    "v1AlgebraicSubjectSet": {
      "type": "object",
      "properties": {
        "operation": {
          "$ref": "#/definitions/v1AlgebraicSubjectSetOperation"
        },
        "children": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v1PermissionRelationshipTree"
          }
        }
      },
      "description": "AlgebraicSubjectSet is a subject set which is computed based on applying the\nspecified operation to the operands according to the algebra of sets.\n\nUNION is a logical set containing the subject members from all operands.\n\nINTERSECTION is a logical set containing only the subject members which are\npresent in all operands.\n\nEXCLUSION is a logical set containing only the subject members which are\npresent in the first operand, and none of the other operands."
    },
    "v1AlgebraicSubjectSetOperation": {
      "type": "string",
      "enum": [
        "OPERATION_UNSPECIFIED",
        "OPERATION_UNION",
        "OPERATION_INTERSECTION",
        "OPERATION_EXCLUSION"
      ],
      "default": "OPERATION_UNSPECIFIED"
    },
    "v1CheckPermissionRequest": {
      "type": "object",
      "properties": {
        "consistency": {
          "$ref": "#/definitions/v1Consistency"
        },
        "resource": {
          "$ref": "#/definitions/v1ObjectReference",
          "description": "resource is the resource on which to check the permission or relation."
        },
        "permission": {
          "type": "string",
          "description": "permission is the name of the permission (or relation) on which to execute\nthe check."
        },
        "subject": {
          "$ref": "#/definitions/v1SubjectReference",
          "description": "subject is the subject that will be checked for the permission or relation."
        }
      },
      "description": "CheckPermissionRequest issues a check on whether a subject has a permission\nor is a member of a relation, on a specific resource."
    },
    "v1CheckPermissionResponse": {
      "type": "object",
      "properties": {
        "checkedAt": {
          "$ref": "#/definitions/v1ZedToken"
        },
        "permissionship": {
          "$ref": "#/definitions/CheckPermissionResponsePermissionship",
          "description": "Permissionship communicates whether or not the subject has the requested\npermission or has a relationship with the given resource, over the given\nrelation.\n\nThis value will be authzed.api.v1.PERMISSIONSHIP_HAS_PERMISSION if the\nrequested subject is a member of the computed permission set or there\nexists a relationship with the requested relation from the given resource\nto the given subject."
        }
      }
    },
    "v1Consistency": {
      "type": "object",
      "properties": {
        "minimizeLatency": {
          "type": "boolean",
          "description": "minimize_latency indicates that the latency for the call should be\nminimized by having the system select the fastest snapshot available."
        },
        "atLeastAsFresh": {
          "$ref": "#/definitions/v1ZedToken",
          "description": "at_least_as_fresh indicates that all data used in the API call must be\n*at least as fresh* as that found in the ZedToken; more recent data might\nbe used if available or faster."
        },
        "atExactSnapshot": {
          "$ref": "#/definitions/v1ZedToken",
          "description": "at_exact_snapshot indicates that all data used in the API call must be\n*at the given* snapshot in time; if the snapshot is no longer available,\nan error will be returned to the caller."
        },
        "fullyConsistent": {
          "type": "boolean",
          "description": "fully_consistent indicates that all data used in the API call *must* be\nat the most recent snapshot found.\n\nNOTE: using this method can be *quite slow*, so unless there is a need to\ndo so, it is recommended to use `at_least_as_fresh` with a stored\nZedToken."
        }
      },
      "description": "Consistency will define how a request is handled by the backend.\nBy defining a consistency requirement, and a token at which those\nrequirements should be applied, where applicable."
    },
    "v1DeleteRelationshipsRequest": {
      "type": "object",
      "properties": {
        "relationshipFilter": {
          "$ref": "#/definitions/v1RelationshipFilter"
        },
        "optionalPreconditions": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v1Precondition"
          }
        }
      },
      "description": "DeleteRelationshipsRequest specifies which Relationships should be deleted,\nrequesting the delete of *ALL* relationships that match the specified\nfilters. If the optional_preconditions parameter is included, all of the\nspecified preconditions must also be satisfied before the delete will be\nexecuted."
    },
    "v1DeleteRelationshipsResponse": {
      "type": "object",
      "properties": {
        "deletedAt": {
          "$ref": "#/definitions/v1ZedToken"
        }
      }
    },
    "v1DirectSubjectSet": {
      "type": "object",
      "properties": {
        "subjects": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v1SubjectReference"
          }
        }
      },
      "description": "DirectSubjectSet is a subject set which is simply a collection of subjects."
    },
    "v1ExpandPermissionTreeRequest": {
      "type": "object",
      "properties": {
        "consistency": {
          "$ref": "#/definitions/v1Consistency"
        },
        "resource": {
          "$ref": "#/definitions/v1ObjectReference",
          "description": "resource is the resource over which to run the expansion."
        },
        "permission": {
          "type": "string",
          "description": "permission is the name of the permission or relation over which to run the\nexpansion for the resource."
        }
      },
      "description": "ExpandPermissionTreeRequest returns a tree representing the expansion of all\nrelationships found accessible from a permission or relation on a particular\nresource.\n\nExpandPermissionTreeRequest is typically used to determine the full set of\nsubjects with a permission, along with the relationships that grant said\naccess."
    },
    "v1ExpandPermissionTreeResponse": {
      "type": "object",
      "properties": {
        "expandedAt": {
          "$ref": "#/definitions/v1ZedToken"
        },
        "treeRoot": {
          "$ref": "#/definitions/v1PermissionRelationshipTree",
          "description": "tree_root is a tree structure whose leaf nodes are subjects, and\nintermediate nodes represent the various operations (union, intersection,\nexclusion) to reach those subjects."
        }
      }
    },
    "v1LookupResourcesRequest": {
      "type": "object",
      "properties": {
        "consistency": {
          "$ref": "#/definitions/v1Consistency"
        },
        "resourceObjectType": {
          "type": "string",
          "description": "resource_object_type is the type of resource object for which the IDs will\nbe returned."
        },
        "permission": {
          "type": "string",
          "description": "permission is the name of the permission or relation for which the subject\nmust Check."
        },
        "subject": {
          "$ref": "#/definitions/v1SubjectReference",
          "description": "subject is the subject with access to the resources."
        }
      },
      "description": "LookupResourcesRequest performs a lookup of all resources of a particular\nkind on which the subject has the specified permission or the relation in\nwhich the subject exists, streaming back the IDs of those resources."
    },
    "v1LookupResourcesResponse": {
      "type": "object",
      "properties": {
        "lookedUpAt": {
          "$ref": "#/definitions/v1ZedToken"
        },
        "resourceObjectId": {
          "type": "string"
        }
      },
      "description": "LookupResourcesResponse contains a single matching resource object ID for the\nrequested object type, permission, and subject."
    },
    "v1ObjectReference": {
      "type": "object",
      "properties": {
        "objectType": {
          "type": "string"
        },
        "objectId": {
          "type": "string"
        }
      },
      "description": "ObjectReference is used to refer to a specific object in the system."
    },
    "v1PermissionRelationshipTree": {
      "type": "object",
      "properties": {
        "intermediate": {
          "$ref": "#/definitions/v1AlgebraicSubjectSet"
        },
        "leaf": {
          "$ref": "#/definitions/v1DirectSubjectSet"
        },
        "expandedObject": {
          "$ref": "#/definitions/v1ObjectReference"
        },
        "expandedRelation": {
          "type": "string"
        }
      },
      "description": "PermissionRelationshipTree is used for representing a tree of a resource and\nits permission relationships with other objects."
    },
    "v1Precondition": {
      "type": "object",
      "properties": {
        "operation": {
          "$ref": "#/definitions/v1PreconditionOperation"
        },
        "filter": {
          "$ref": "#/definitions/v1RelationshipFilter"
        }
      },
      "description": "Precondition specifies how and the existence or absence of certain\nrelationships as expressed through the accompanying filter should affect\nwhether or not the operation proceeds.\n\nMUST_NOT_MATCH will fail the parent request if any relationships match the\nrelationships filter.\nMUST_MATCH will fail the parent request if there are no\nrelationships that match the filter."
    },
    "v1PreconditionOperation": {
      "type": "string",
      "enum": [
        "OPERATION_UNSPECIFIED",
        "OPERATION_MUST_NOT_MATCH",
        "OPERATION_MUST_MATCH"
      ],
      "default": "OPERATION_UNSPECIFIED"
    },
    "v1ReadRelationshipsRequest": {
      "type": "object",
      "properties": {
        "consistency": {
          "$ref": "#/definitions/v1Consistency"
        },
        "relationshipFilter": {
          "$ref": "#/definitions/v1RelationshipFilter"
        }
      },
      "description": "ReadRelationshipsRequest specifies one or more filters used to read matching\nrelationships within the system."
    },
    "v1ReadRelationshipsResponse": {
      "type": "object",
      "properties": {
        "readAt": {
          "$ref": "#/definitions/v1ZedToken"
        },
        "relationship": {
          "$ref": "#/definitions/v1Relationship"
        }
      },
      "description": "ReadRelationshipsResponse contains a Relationship found that matches the\nspecified relationship filter(s). A instance of this response message will\nbe streamed to the client for each relationship found."
    },
    "v1Relationship": {
      "type": "object",
      "properties": {
        "resource": {
          "$ref": "#/definitions/v1ObjectReference",
          "title": "resource is the resource to which the subject is related, in some manner"
        },
        "relation": {
          "type": "string",
          "description": "relation is how the resource and subject are related."
        },
        "subject": {
          "$ref": "#/definitions/v1SubjectReference",
          "description": "subject is the subject to which the resource is related, in some manner."
        }
      },
      "description": "Relationship specifies how a resource relates to a subject. Relationships\nform the data for the graph over which all permissions questions are\nanswered."
    },
    "v1RelationshipFilter": {
      "type": "object",
      "properties": {
        "resourceType": {
          "type": "string"
        },
        "optionalResourceId": {
          "type": "string"
        },
        "optionalRelation": {
          "type": "string"
        },
        "optionalSubjectFilter": {
          "$ref": "#/definitions/v1SubjectFilter"
        }
      },
      "description": "RelationshipFilter is a collection of filters which when applied to a\nrelationship will return relationships that have exactly matching fields.\n\nresource_type is required. All other fields are optional and if left\nunspecified will not filter relationships."
    },
    "v1RelationshipUpdate": {
      "type": "object",
      "properties": {
        "operation": {
          "$ref": "#/definitions/v1RelationshipUpdateOperation"
        },
        "relationship": {
          "$ref": "#/definitions/v1Relationship"
        }
      },
      "description": "RelationshipUpdate is used for mutating a single relationship within the\nservice.\n\nCREATE will create the relationship only if it doesn't exist, and error\notherwise.\n\nTOUCH will upsert the relationship, and will not error if it\nalready exists.\n\nDELETE will delete the relationship and error if it doesn't\nexist."
    },
    "v1RelationshipUpdateOperation": {
      "type": "string",
      "enum": [
        "OPERATION_UNSPECIFIED",
        "OPERATION_CREATE",
        "OPERATION_TOUCH",
        "OPERATION_DELETE"
      ],
      "default": "OPERATION_UNSPECIFIED"
    },
    "v1SubjectFilter": {
      "type": "object",
      "properties": {
        "subjectType": {
          "type": "string"
        },
        "optionalSubjectId": {
          "type": "string"
        },
        "optionalRelation": {
          "$ref": "#/definitions/SubjectFilterRelationFilter"
        }
      },
      "description": "SubjectFilter specifies a filter on the subject of a relationship.\n\nsubject_type is required and all other fields are optional, and will not\nimpose any additional requirements if left unspecified."
    },
    "v1SubjectReference": {
      "type": "object",
      "properties": {
        "object": {
          "$ref": "#/definitions/v1ObjectReference"
        },
        "optionalRelation": {
          "type": "string"
        }
      },
      "title": "SubjectReference is used for referring to the subject portion of a\nRelationship. The relation component is optional and is used for defining a\nsub-relation on the subject, e.g. group:123#members"
    },
    "v1WriteRelationshipsRequest": {
      "type": "object",
      "properties": {
        "updates": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v1RelationshipUpdate"
          }
        },
        "optionalPreconditions": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v1Precondition"
          }
        }
      },
      "description": "WriteRelationshipsRequest contains a list of Relationship mutations that\nshould be applied to the service. If the optional_preconditions parameter\nis included, all of the specified preconditions must also be satisfied before\nthe write will be committed."
    },
    "v1WriteRelationshipsResponse": {
      "type": "object",
      "properties": {
        "writtenAt": {
          "$ref": "#/definitions/v1ZedToken"
        }
      }
    },
    "v1ZedToken": {
      "type": "object",
      "properties": {
        "token": {
          "type": "string"
        }
      },
      "description": "ZedToken is used to provide causality metadata between Write and Check\nrequests.\n\nSee the authzed.api.v1.Consistency message for more information."
    }
  },
  "securityDefinitions": {
    "ApiKeyAuth": {
      "type": "apiKey",
      "name": "Authorization",
      "in": "header"
    }
  },
  "externalDocs": {
    "description": "More about the Authzed API.",
    "url": "https://docs.authzed.com/reference/api"
  }
}