OpenFGA

https://openfga.dev/docs
Admin
OpenFGA is an open-source authorization system that implements relationship-based access control for...
Tokens:578,059
Snippets:4,050
Trust Score:9.2
Update:5 days ago
Show doc for...
Tokens:
Raw
### Install Go SDK with go get

Source: https://openfga.dev/docs/getting-started/install-sdk

Install the Go SDK version v0.8.2. Requires Go 1.25 or newer.

```bash
go get github.com/openfga/go-sdk@v0.8.2

```

--------------------------------

### Install CLI with Go

Source: https://openfga.dev/docs/getting-started/install-sdk

Install the OpenFGA CLI using go install.

```bash
go install github.com/openfga/cli/cmd/fga@latest

```

--------------------------------

### Install Fiber Go packages with go get

Source: https://openfga.dev/docs/getting-started/framework

Install the gofiber/fiber, gofiber/jwt, and golang-jwt packages using go get.

```bash
go get -u github.com/gofiber/fiber/v2 github.com/gofiber/jwt/v3 github.com/golang-jwt/jwt/v4

```

--------------------------------

### Install CLI with Homebrew

Source: https://openfga.dev/docs/getting-started/install-sdk

Install the OpenFGA CLI using Homebrew.

```bash
brew install openfga/tap/fga

```

--------------------------------

### Environment Setup Comments

Source: https://openfga.dev/docs/modeling/contextual-time-based-authorization

Comments indicating required environment variables and that examples assume no authentication. For authenticated servers, see client setup documentation.

```plaintext
# Set FGA_API_URL to the URL of your OpenFGA server.
# Set FGA_STORE_ID to your store ID.
# These examples use a server with authentication disabled.
# For authenticated servers, see /docs/getting-started/setup-sdk-client.
```

--------------------------------

### Environment Setup Comments

Source: https://openfga.dev/docs/modeling/contextual-time-based-authorization

Comments indicating required environment variables and authentication assumptions for the examples.

```plaintext
# Set FGA_API_URL to the URL of your OpenFGA server.
# Set FGA_STORE_ID to your store ID.
# These examples use a server with authentication disabled.
# For authenticated servers, see /docs/getting-started/setup-sdk-client.
```

```plaintext
# Set FGA_API_URL to the URL of your OpenFGA server.
# Set FGA_STORE_ID to your store ID.
# These examples use a server with authentication disabled.
# For authenticated servers, see /docs/getting-started/setup-sdk-client.
```

--------------------------------

### Start Docker Compose services

Source: https://openfga.dev/docs/getting-started/setup-openfga/docker

Starts all services defined in the docker-compose.yaml file, which will run MySQL, migrate the database, and start the OpenFGA server.

```bash
docker-compose up

```

--------------------------------

### Start OpenFGA server

Source: https://openfga.dev/docs/getting-started/setup-openfga/docker

Starts the OpenFGA server with SQLite as the datastore. Exposes ports 3000, 8080, and 8081.

```bash
docker run --name openfga --network=openfga \
    -p 3000:3000 -p 8080:8080 -p 8081:8081 \
    -v openfga:/home/nonroot \
    -u nonroot \
    openfga/openfga run \
    --datastore-engine sqlite \
    --datastore-uri 'file:/home/nonroot/openfga.db'

```

--------------------------------

### Install Node.js SDK with npm

Source: https://openfga.dev/docs/getting-started/install-sdk

Install the @openfga/sdk package version 0.9.7 using npm.

```bash
npm install @openfga/sdk@0.9.7

```

--------------------------------

### Install CLI on Fedora

Source: https://openfga.dev/docs/getting-started/install-sdk

Install the OpenFGA CLI .rpm package on Fedora.

```bash
sudo dnf install ./fga_<version>_linux_<arch>.rpm

```

--------------------------------

### Start Docker Compose services

Source: https://openfga.dev/docs/getting-started/setup-openfga/docker

Starts all services defined in the docker-compose.yaml file, including Postgres, migrate, and OpenFGA.

```bash
docker-compose up
```

--------------------------------

### Install Node.js SDK with yarn

Source: https://openfga.dev/docs/getting-started/install-sdk

Install the @openfga/sdk package version 0.9.7 using yarn.

```bash
yarn add @openfga/sdk@0.9.7

```

--------------------------------

### Install .NET SDK with Package Manager Console

Source: https://openfga.dev/docs/getting-started/install-sdk

Install the OpenFGA.Sdk package version 0.10.4 using the Package Manager Console in Visual Studio.

```powershell
Install-Package OpenFGA.Sdk -Version 0.10.4

```

--------------------------------

### Install CLI on Alpine Linux

Source: https://openfga.dev/docs/getting-started/install-sdk

Install the OpenFGA CLI .apk package on Alpine Linux.

```bash
sudo apk add --allow-untrusted ./fga_<version>_linux_<arch>.apk

```

--------------------------------

### FGA Test file example for store import

Source: https://openfga.dev/docs/getting-started/cli

Example .fga.yaml file containing a model and tuples to be imported into a store.

```yaml
model: |
  model
    schema 1.1

  type user
  type organization
   relations
     define member : [user]
  }

tuples:
  # Anne is a member of the Acme organization
  - user: user:anne
    relation: member
    object: organization:acme
```

--------------------------------

### Node.js SDK example for Read API

Source: https://openfga.dev/docs/api/service/relationship-tuples/get-stored-relationship-tuples

Example using the OpenFgaClient from the @openfga/sdk package to call the read method. It sets the user, relation, and object in the body and passes a pageSize option.

```javascript
const { OpenFgaClient, ConsistencyPreference } = require('@openfga/sdk');

const fgaClient = new OpenFgaClient({
  apiUrl: process.env.FGA_API_URL,
  storeId: process.env.FGA_STORE_ID,
});

async function main() {
    const body = {
      "user": "user:anne",
      "relation": "reader",
      "object": "document:budget"
    };
    const options = {
      "pageSize": 20
    };
    const response = await fgaClient.read(body, options);
}

main().catch((error) => {
    console.error(error);
    process.exitCode = 1;
});

```

--------------------------------

### Initialize Go SDK

Source: https://openfga.dev/docs/getting-started/configure-model

Initialize the OpenFGA client in Go using NewSdkClient.

```go
// ApiTokenIssuer, ApiAudience, ClientId and ClientSecret are optional.
import (
    "context"
    "encoding/json"
    "os"

    . "github.com/openfga/go-sdk"
    . "github.com/openfga/go-sdk/client"
)

func main() {
    // Initialize the SDK with no auth - see "How to setup SDK client" for more options
    fgaClient, err := NewSdkClient(&ClientConfiguration{
        ApiUrl:               os.Getenv("FGA_API_URL"), // required, e.g. https://api.fga.example
        StoreId:              os.Getenv("FGA_STORE_ID"), // optional, not needed for `CreateStore` and `ListStores`, required before calling for all other methods
        AuthorizationModelId: os.Getenv("FGA_MODEL_ID"),  // Optional, can be overridden per request
    })

    if err != nil {
    // .. Handle error
    }
}
```

--------------------------------

### Initialize the SDK

Source: https://openfga.dev/docs/interacting/managing-relationships-between-objects

Shows how to initialize the OpenFGA client in various languages using environment variables for API URL, store ID, and optional authorization model ID.

```APIDOC
## Initialize the SDK

### Description
Initialize the OpenFGA client with the API URL, store ID, and optional authorization model ID.

### Language
Node.js

### Code
```javascript
const { OpenFgaClient, ConsistencyPreference } = require('@openfga/sdk');

const fgaClient = new OpenFgaClient({
  apiUrl: process.env.FGA_API_URL,
  storeId: process.env.FGA_STORE_ID,
  authorizationModelId: process.env.FGA_MODEL_ID, // Optional; requests can override this.
});
```
```

```APIDOC
## Initialize the SDK

### Description
Initialize the OpenFGA client with the API URL, store ID, and optional authorization model ID.

### Language
Go

### Code
```go
import (
  "context"
  "os"
  openfga "github.com/openfga/go-sdk"
  . "github.com/openfga/go-sdk/client"
)

fgaClient, err := NewSdkClient(&ClientConfiguration{
  ApiUrl: os.Getenv("FGA_API_URL"),
  StoreId: os.Getenv("FGA_STORE_ID"),
  AuthorizationModelId: os.Getenv("FGA_MODEL_ID"), // Optional; requests can override this.
})
if err != nil {
  panic(err)
}
```
```

```APIDOC
## Initialize the SDK

### Description
Initialize the OpenFGA client with the API URL, store ID, and optional authorization model ID.

### Language
.NET

### Code
```csharp
using System.Collections.Generic;
using OpenFga.Sdk.Client;
using OpenFga.Sdk.Client.Model;
using OpenFga.Sdk.Model;
using Environment = System.Environment;

var fgaClient = new OpenFgaClient(new ClientConfiguration() {
  ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL"),
  StoreId = Environment.GetEnvironmentVariable("FGA_STORE_ID"),
  AuthorizationModelId = Environment.GetEnvironmentVariable("FGA_MODEL_ID"), // Optional; requests can override this.
});
```
```

```APIDOC
## Initialize the SDK

### Description
Initialize the OpenFGA client with the API URL, store ID, and optional authorization model ID.

### Language
Python

### Code
```python
import asyncio
import os
from openfga_sdk.client import OpenFgaClient, ClientConfiguration
from openfga_sdk.client.models import ClientCheckRequest, ClientTuple
from openfga_sdk.models import RelationshipCondition

configuration = ClientConfiguration(
  api_url=os.environ.get("FGA_API_URL"),
  store_id=os.environ.get("FGA_STORE_ID"),
  authorization_model_id=os.environ.get("FGA_MODEL_ID"), # Optional; requests can override this.
)
fga_client = OpenFgaClient(configuration)
```
```

```APIDOC
## Initialize the SDK

### Description
Initialize the OpenFGA client with the API URL, store ID, and optional authorization model ID.

### Language
Java

### Code
```java
import dev.openfga.sdk.api.client.OpenFgaClient;
import dev.openfga.sdk.api.configuration.ClientConfiguration;
import dev.openfga.sdk.api.configuration.*;
import dev.openfga.sdk.api.client.model.*;
import dev.openfga.sdk.api.model.*;
import java.util.List;
import java.util.Map;
import java.util.ArrayList;

var config = new ClientConfiguration()
  .apiUrl(System.getenv("FGA_API_URL"))
  .storeId(System.getenv("FGA_STORE_ID"))
  .authorizationModelId(System.getenv("FGA_MODEL_ID")); // Optional; requests can override this.
var fgaClient = new OpenFgaClient(config);
```
```

--------------------------------

### Import and initialize Go SDK

Source: https://openfga.dev/docs/getting-started/install-sdk

Import the Go SDK module and create a configuration with the API URL. The ApiUrl is required, e.g., https://api.fga.example.

```go
import (
    openfga "github.com/openfga/go-sdk"
)

func main() {
    configuration, err := openfga.NewConfiguration(openfga.Configuration{
        ApiUrl: os.Getenv("FGA_API_URL"), // required, e.g. https://api.fga.example
    })
    if err != nil {
        // .. Handle error
    }
}

```

--------------------------------

### cURL: Get authorization model by ID

Source: https://openfga.dev/docs/api/service/authorization-models/get-an-authorization-model-by-its-id

Uses curl to call the GET authorization-models by ID API. Requires FGA_API_URL, FGA_STORE_ID, and FGA_MODEL_ID environment variables. These examples use a server with authentication disabled; for authenticated servers, see /docs/getting-started/setup-sdk-client.

```bash
# Set FGA_API_URL to the URL of your OpenFGA server.
# Set FGA_STORE_ID to your store ID.
# Set FGA_MODEL_ID to your authorization model ID.
# These examples use a server with authentication disabled.
# For authenticated servers, see /docs/getting-started/setup-sdk-client.

curl -X GET "$FGA_API_URL/stores/$FGA_STORE_ID/authorization-models/$FGA_MODEL_ID"
```

--------------------------------

### Sample config.yaml for Postgres and preshared auth

Source: https://openfga.dev/docs/getting-started/setup-openfga/configuration

Configuration file example that sets the datastore to Postgres and uses preshared key authentication. The file is searched in /etc/openfga, $HOME/.openfga, and the current working directory.

```yaml
datastore:
  engine: postgres
  uri: postgres://user:password@localhost:5432/mydatabase
authn:
  method: preshared
  preshared:
    keys: ["key1", "key2"]
playground:
  enabled: false

```

--------------------------------

### Java Check API example

Source: https://openfga.dev/docs/modeling/advanced/iot

Uses the OpenFGA Java SDK to check the relation. The example uses a fluent builder pattern for the request and options, then calls get() to execute synchronously. Expected response is {"allowed":false}.

```Java
var body = new ClientCheckRequest()
  .user("user:anne")
  .relation("device_renamer")
  ._object("device:1");
var options = new ClientCheckOptions()
  .authorizationModelId("01HVMMBCMGZNT3SED4Z17ECXCA");
var response = fgaClient.check(body, options).get();
// Expected response: {"allowed":false}
```

--------------------------------

### cURL Request: Get AuthZEN Configuration

Source: https://openfga.dev/docs/api/service/authzenservice/%5Bexperimental%5D-get-authzen-pdp-configuration-and-capabilities

Uses cURL to send a GET request to the AuthZEN configuration endpoint. Requires FGA_API_URL and FGA_STORE_ID environment variables. Assumes authentication is disabled; for authenticated servers, see the SDK client setup documentation.

```bash
# HTTP only: no named client or generated low-level operation in the audited SDK versions.
# Set FGA_API_URL to the URL of your OpenFGA server.
# Set FGA_STORE_ID to your store ID.
# These examples use a server with authentication disabled.
# For authenticated servers, see /docs/getting-started/setup-sdk-client.

curl -X GET "$FGA_API_URL/.well-known/authzen-configuration/$FGA_STORE_ID"
```

--------------------------------

### Example response for GET authorization model by ID

Source: https://openfga.dev/docs/api/service/authorization-models/get-an-authorization-model-by-its-id

The API returns the authorization model with the specified ID. The response includes the model ID and type definitions. In this example, there are 2 types (user and document) and the document type has 2 relations (writer and reader).

```json
{
  "authorization_model":{
    "id":"01G5JAVJ41T49E9TT3SKVS7X1J",
    "type_definitions":[
      {
        "type":"user"
      },
      {
        "type":"document",
        "relations":{
          "reader":{
            "union":{
              "child":[
                {
                  "this":{}
                },
                {
                  "computedUserset":{
                    "object":"",
                    "relation":"writer"
                  }
                }
              ]
            }
          },
          "writer":{
            "this":{}
          }
        }
      }
    ]
  }
}
```

--------------------------------

### Initialize .NET SDK

Source: https://openfga.dev/docs/getting-started/configure-model

Initialize the OpenFGA client in .NET using the OpenFgaClient class.

```csharp
// ApiTokenIssuer, ApiAudience, ClientId and ClientSecret are optional.
using OpenFga.Sdk.Client;
using OpenFga.Sdk.Client.Model;
using OpenFga.Sdk.Model;
using System.Text.Json;
using Environment = System.Environment;

namespace Example;

class Example {
    public static async Task Main() {
        // Initialize the SDK with no auth - see "How to setup SDK client" for more options
        var configuration = new ClientConfiguration() {
          ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL") ?? "http://localhost:8080", // required, e.g. https://api.fga.example
          StoreId = Environment.GetEnvironmentVariable("FGA_STORE_ID"), // optional, not needed for `CreateStore` and `ListStores`, required before calling for all other methods
          AuthorizationModelId = Environment.GetEnvironmentVariable("FGA_MODEL_ID"), // Optional, can be overridden per request
        };
        var fgaClient = new OpenFgaClient(configuration);
    }
}
```

--------------------------------

### Response 200: Store object

Source: https://openfga.dev/docs/api/service/stores/get-a-store

Example successful response body for GET /stores/{store_id}. Contains store metadata including id, name, and timestamps.

```json
{
  "created_at": "2023-11-07T05:31:56Z",
  "id": "01YCP46JKYM8FJCQ37NMBYHE5X",
  "name": "<string>",
  "updated_at": "2023-11-07T05:31:56Z",
  "deleted_at": "2023-11-07T05:31:56Z"
}
```

--------------------------------

### Initialize the OpenFGA Client

Source: https://openfga.dev/docs/modeling/advanced/github

Shows how to create an OpenFGA client instance using environment variables for API URL, store ID, and optional authorization model ID. This is the prerequisite for making API calls.

```APIDOC
## Initialize the OpenFGA Client

### Description
Creates an OpenFGA client instance configured with the API URL, store ID, and optional authorization model ID. This client is used to interact with the OpenFGA API.

### Method
N/A (SDK initialization)

### Endpoint
N/A

### Parameters
#### Configuration
- **apiUrl** (string) - Required - The URL of the OpenFGA server.
- **storeId** (string) - Required - The ID of the store.
- **authorizationModelId** (string) - Optional - The authorization model ID to use by default; can be overridden per request.

### Request Example
// Node.js
const { OpenFgaClient } = require('@openfga/sdk');
const fgaClient = new OpenFgaClient({
  apiUrl: process.env.FGA_API_URL,
  storeId: process.env.FGA_STORE_ID,
  authorizationModelId: process.env.FGA_MODEL_ID, // Optional
});

### Response
No response body is documented.

```

--------------------------------

### Enable experimental features via --experimentals flag

Source: https://openfga.dev/docs/getting-started/setup-openfga/configure-openfga

Starts OpenFGA with the specified experimental features enabled. Replace feature1, feature2 with actual feature names from the table.

```bash
openfga run --experimentals="feature1, feature2"
```

--------------------------------

### Successful response for Get All Tuple Changes

Source: https://openfga.dev/docs/api/service/relationship-tuples/get-all-tuple-changes

Example of a successful response containing a list of changes and a continuation token. The continuation token is identical if there are no new changes.

```json
{
  "changes": [
    {
      "operation": "TUPLE_OPERATION_WRITE",
      "timestamp": "2023-11-07T05:31:56Z",
      "tuple_key": {
        "object": "document:2021-budget",
        "relation": "reader",
        "user": "user:anne",
        "condition": {
          "name": "condition1",
          "context": {}
        }
      }
    }
  ],
  "continuation_token": "eyJwayI6IkxBVEVTVF9OU0NPTkZJR19hdXRoMHN0b3JlIiwic2siOiIxem1qbXF3MWZLZExTcUoyN01MdTdqTjh0cWgifQ=="
}
```

--------------------------------

### curl: POST /stores/{store_id}/list-objects

Source: https://openfga.dev/docs/api/service/relationship-queries/list-objects-a-user-is-related-to

Direct HTTP request to the ListObjects endpoint. Requires FGA_API_URL and FGA_STORE_ID environment variables. The example assumes authentication is disabled; for authenticated servers, see the setup SDK client documentation.

```bash
# Set FGA_API_URL to the URL of your OpenFGA server.
# Set FGA_STORE_ID to your store ID.
# These examples use a server with authentication disabled.
# For authenticated servers, see /docs/getting-started/setup-sdk-client.

curl -X POST "$FGA_API_URL/stores/$FGA_STORE_ID/list-objects" \
  -H "content-type: application/json" \
  -d '{
  "authorization_model_id": "'"$FGA_MODEL_ID"'",
  "user": "user:anne",
  "relation": "reader",
  "type": "document"
}'
```

--------------------------------

### Initialize OpenFGA Go Client with Client Credentials

Source: https://openfga.dev/docs/getting-started/setup-sdk-client

Configures the OpenFGA client in Go using the client credentials flow.

```go
import (
    "os"
    . "github.com/openfga/go-sdk/client"
    "github.com/openfga/go-sdk/credentials"
)
func main() {
    fgaClient, err := NewSdkClient(&ClientConfiguration{
        ApiUrl:               os.Getenv("FGA_API_URL"), // required, e.g. https://api.fga.example
        StoreId:              os.Getenv("FGA_STORE_ID"),   // optional, not needed for `CreateStore` and `ListStores`, required before calling for all other methods
        AuthorizationModelId: os.Getenv("FGA_MODEL_ID"),   // optional, can be overridden per request
        Credentials: &credentials.Credentials{
            Method: credentials.CredentialsMethodClientCredentials,
            Config: &credentials.Config{
                ClientCredentialsClientId:       os.Getenv("FGA_CLIENT_ID"),
                ClientCredentialsClientSecret:   os.Getenv("FGA_CLIENT_SECRET"),
                ClientCredentialsApiAudience:    os.Getenv("FGA_API_AUDIENCE"),
                ClientCredentialsApiTokenIssuer: os.Getenv("FGA_API_TOKEN_ISSUER"),
            },
        },
    })
    if err != nil {
        // .. Handle error
    }
}
```

--------------------------------

### Initialize OpenFGA .NET Client with Client Credentials

Source: https://openfga.dev/docs/getting-started/setup-sdk-client

Configures the OpenFGA client in .NET using the client credentials flow.

```csharp
using OpenFga.Sdk.Client;
using OpenFga.Sdk.Configuration;
using Environment = System.Environment;
namespace ExampleApp;
class MyProgram {
    static async Task Main() {
        var configuration = new ClientConfiguration() {
            ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL") ?? "http://localhost:8080", // required, e.g. https://api.fga.example
            StoreId = Environment.GetEnvironmentVariable("FGA_STORE_ID"), // optional, not needed for `CreateStore` and `ListStores`, required before calling for all other methods
            AuthorizationModelId = Environment.GetEnvironmentVariable("FGA_MODEL_ID"), // optional, can be overridden per request
            Credentials = new Credentials() {
                Method = CredentialsMethod.ClientCredentials,
                Config = new CredentialsConfig() {
                    ApiTokenIssuer = Environment.GetEnvironmentVariable("FGA_API_TOKEN_ISSUER"),
                    ApiAudience = Environment.GetEnvironmentVariable("FGA_API_AUDIENCE"),
                    ClientId = Environment.GetEnvironmentVariable("FGA_CLIENT_ID"),
                    ClientSecret = Environment.GetEnvironmentVariable("FGA_CLIENT_SECRET"),
                }
            }
        };
        var fgaClient = new OpenFgaClient(configuration);
    }
}
```

--------------------------------

### cURL: StreamedListObjects request

Source: https://openfga.dev/docs/api/service/relationship-queries/stream-all-objects-of-the-given-type-that-the-user-has-a-relation-with

Sends a POST request to the /streamed-list-objects endpoint with the required body parameters: user, relation, and type. The authorization_model_id is optional but recommended. This example assumes authentication is disabled; for authenticated servers, see the setup SDK client documentation.

```bash
curl --no-buffer -X POST "$FGA_API_URL/stores/$FGA_STORE_ID/streamed-list-objects" \
  -H "content-type: application/json" \
  -d '{
  "authorization_model_id": "'"$FGA_MODEL_ID"'",
  "user": "user:anne",
  "relation": "reader",
  "type": "document"
}'
```

--------------------------------

### Viewing the combined model DSL with CLI

Source: https://openfga.dev/docs/modeling/modular-models

Example output of `fga model get --store-id=$FGA_STORE_ID` showing DSL annotated with comments that define the source module and file for types, relations, and conditions. The organization type is defined in core.fga, can_create_project in issue-tracker/projects.fga, and can_create_space in wiki.fga.

```dsl
type organization
  # module: core, file: core.fga
  relations
    define admin: [user]
    define member: [user] or admin
    define can_create_project: admin
      # extended by: module: issue-tracker, file: issue-tracker/projects.fga
    define can_create_space: admin
      # extended by: module: wiki, file: wiki.fga
```

--------------------------------

### Create a store with the CLI

Source: https://openfga.dev/docs/getting-started/create-store

Uses the fga CLI to create a store named 'FGA Demo Store'. Requires FGA_API_URL to be set. Authentication is assumed disabled.

```bash
# Set FGA_API_URL to the URL of your OpenFGA server.
# These examples use a server with authentication disabled.
# For authenticated servers, see /docs/getting-started/setup-sdk-client.
fga store create --name 'FGA Demo Store'
```

--------------------------------

### Run OpenFGA with default configuration

Source: https://openfga.dev/docs/getting-started/setup-openfga/docker

Starts OpenFGA with default configuration, exposing HTTP (8080), gRPC (8081), and Playground (3000) ports.

```bash
docker run -p 8080:8080 -p 8081:8081 -p 3000:3000 openfga/openfga run
```

--------------------------------

### Initialize OpenFGA SDK clients

Source: https://openfga.dev/docs/modeling/user-groups

Initialize the OpenFGA client for Node.js, Go, .NET, Python, and Java. These examples use environment variables for configuration and no authentication.

```Node.js
const { OpenFgaClient, ConsistencyPreference, ClientWriteRequestOnDuplicateWrites, ClientWriteRequestOnMissingDeletes } = require('@openfga/sdk');

const fgaClient = new OpenFgaClient({
  apiUrl: process.env.FGA_API_URL,
  storeId: process.env.FGA_STORE_ID,
  authorizationModelId: process.env.FGA_MODEL_ID, // Optional; requests can override this.
});
```

```Go
import (
  "context"
  "os"
  openfga "github.com/openfga/go-sdk"
  . "github.com/openfga/go-sdk/client"
)

fgaClient, err := NewSdkClient(&ClientConfiguration{
  ApiUrl: os.Getenv("FGA_API_URL"),
  StoreId: os.Getenv("FGA_STORE_ID"),
  AuthorizationModelId: os.Getenv("FGA_MODEL_ID"), // Optional; requests can override this.
})
if err != nil {
  panic(err)
}
```

```.NET
using System.Collections.Generic;
using OpenFga.Sdk.Client;
using OpenFga.Sdk.Client.Model;
using OpenFga.Sdk.Model;
using Environment = System.Environment;

var fgaClient = new OpenFgaClient(new ClientConfiguration() {
  ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL"),
  StoreId = Environment.GetEnvironmentVariable("FGA_STORE_ID"),
  AuthorizationModelId = Environment.GetEnvironmentVariable("FGA_MODEL_ID"), // Optional; requests can override this.
});
```

```Python
import asyncio
import os
from openfga_sdk.client import OpenFgaClient, ClientConfiguration
from openfga_sdk.client.models import ClientWriteRequest, ClientTuple
from openfga_sdk.models import RelationshipCondition
from openfga_sdk.client.models import ConflictOptions, ClientWriteRequestOnDuplicateWrites, ClientWriteRequestOnMissingDeletes

configuration = ClientConfiguration(
    api_url=os.environ.get("FGA_API_URL"),
    store_id=os.environ.get("FGA_STORE_ID"),
    authorization_model_id=os.environ.get("FGA_MODEL_ID"), # Optional; requests can override this.
)
fga_client = OpenFgaClient(configuration)
```

```Java
import dev.openfga.sdk.api.client.OpenFgaClient;
import dev.openfga.sdk.api.configuration.ClientConfiguration;
import dev.openfga.sdk.api.configuration.*;
import dev.openfga.sdk.api.client.model.*;
import dev.openfga.sdk.api.model.*;
import java.util.List;
import java.util.Map;
import java.util.ArrayList;

var config = new ClientConfiguration()
    .apiUrl(System.getenv("FGA_API_URL"))
    .storeId(System.getenv("FGA_STORE_ID"))
    .authorizationModelId(System.getenv("FGA_MODEL_ID")); // Optional; requests can override this.
var fgaClient = new OpenFgaClient(config);
```

--------------------------------

### Initialize OpenFgaClient in Go

Source: https://openfga.dev/docs/concepts

Initializes the OpenFgaClient in Go using environment variables.

```go
import ( "context" "os" openfga "github.com/openfga/go-sdk" . "github.com/openfga/go-sdk/client" ) fgaClient, err := NewSdkClient(&ClientConfiguration{ ApiUrl: os.Getenv("FGA_API_URL"), StoreId: os.Getenv("FGA_STORE_ID"), AuthorizationModelId: os.Getenv("FGA_MODEL_ID"), // Optional; requests can override this. }) if err != nil { panic(err) }
```

--------------------------------

### Install CLI on Debian

Source: https://openfga.dev/docs/getting-started/install-sdk

Install the OpenFGA CLI .deb package on Debian.

```bash
sudo apt install ./fga_<version>_linux_<arch>.deb

```

--------------------------------

### Initialize SDK clients (Node.js, Go, .NET, Python, Java)

Source: https://openfga.dev/docs/modeling/advanced/entitlements

Initializes the OpenFGA client for each supported SDK. Requires FGA_API_URL and FGA_STORE_ID environment variables; FGA_MODEL_ID is optional. Go snippets run inside main; Python requests run inside an async function and the client must be closed afterward.

```javascript
const { OpenFgaClient, ConsistencyPreference, ClientWriteRequestOnDuplicateWrites, ClientWriteRequestOnMissingDeletes } = require('@openfga/sdk');

const fgaClient = new OpenFgaClient({
  apiUrl: process.env.FGA_API_URL,
  storeId: process.env.FGA_STORE_ID,
  authorizationModelId: process.env.FGA_MODEL_ID, // Optional; requests can override this.
});
```

```go
import (
  "context"
  "os"
  openfga "github.com/openfga/go-sdk"
  . "github.com/openfga/go-sdk/client"
)

fgaClient, err := NewSdkClient(&ClientConfiguration{
  ApiUrl: os.Getenv("FGA_API_URL"),
  StoreId: os.Getenv("FGA_STORE_ID"),
  AuthorizationModelId: os.Getenv("FGA_MODEL_ID"), // Optional; requests can override this.
})
if err != nil {
  panic(err)
}
```

```csharp
using System.Collections.Generic;
using OpenFga.Sdk.Client;
using OpenFga.Sdk.Client.Model;
using OpenFga.Sdk.Model;
using Environment = System.Environment;

var fgaClient = new OpenFgaClient(new ClientConfiguration() {
  ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL"),
  StoreId = Environment.GetEnvironmentVariable("FGA_STORE_ID"),
  AuthorizationModelId = Environment.GetEnvironmentVariable("FGA_MODEL_ID"), // Optional; requests can override this.
});
```

```python
import asyncio
import os
from openfga_sdk.client import OpenFgaClient, ClientConfiguration
from openfga_sdk.client.models import ClientWriteRequest, ClientTuple
from openfga_sdk.models import RelationshipCondition
from openfga_sdk.client.models import ConflictOptions, ClientWriteRequestOnDuplicateWrites, ClientWriteRequestOnMissingDeletes

configuration = ClientConfiguration(
    api_url=os.environ.get("FGA_API_URL"),
    store_id=os.environ.get("FGA_STORE_ID"),
    authorization_model_id=os.environ.get("FGA_MODEL_ID"),  # Optional; requests can override this.
)
fga_client = OpenFgaClient(configuration)
```

```java
import dev.openfga.sdk.api.client.OpenFgaClient;
import dev.openfga.sdk.api.configuration.ClientConfiguration;
import dev.openfga.sdk.api.configuration.*;
import dev.openfga.sdk.api.client.model.*;
import dev.openfga.sdk.api.model.*;
import java.util.List;
import java.util.Map;
import java.util.ArrayList;

var config = new ClientConfiguration()
    .apiUrl(System.getenv("FGA_API_URL"))
    .storeId(System.getenv("FGA_STORE_ID"))
    .authorizationModelId(System.getenv("FGA_MODEL_ID")); // Optional; requests can override this.
var fgaClient = new OpenFgaClient(config);
```

--------------------------------

### Install Fastify packages with yarn

Source: https://openfga.dev/docs/getting-started/framework

Install the fastify, fastify-plugin, and fastify-jwt packages using yarn.

```bash
yarn add fastify fastify-plugin fastify-jwt

```

--------------------------------

### Install Fastify packages with npm

Source: https://openfga.dev/docs/getting-started/framework

Install the fastify, fastify-plugin, and fastify-jwt packages using npm.

```bash
npm install fastify fastify-plugin fastify-jwt

```

--------------------------------

### Configure OpenFGA API Client in Go

Source: https://openfga.dev/docs/interacting/read-tuple-changes

Initialize the OpenFGA client using the Go SDK.

```go
import (
    "os"
    . "github.com/openfga/go-sdk"
    . "github.com/openfga/go-sdk/client"
)

func main() {
    // Initialize the SDK with no auth - see "How to setup SDK client" for more options
    fgaClient, err := NewSdkClient(&ClientConfiguration{
        ApiUrl:               os.Getenv("FGA_API_URL"), // required, e.g. https://api.fga.example
        StoreId:              os.Getenv("FGA_STORE_ID"), // optional, not needed for `CreateStore` and `ListStores`, required before calling for all other methods
        AuthorizationModelId: os.Getenv("FGA_MODEL_ID"),  // Optional, can be overridden per request
    })

    if err != nil {
    // .. Handle error
    }
}
```

--------------------------------

### Create Store with Go SDK

Source: https://openfga.dev/docs/api/service/stores/create-a-store

Uses the openfga/go-sdk client to create a store with the name 'FGA Demo Store'. Requires FGA_API_URL environment variable.

```go
package main

import (
    "context"
    "os"

    . "github.com/openfga/go-sdk/client"
)

func main() {
    fgaClient, err := NewSdkClient(&ClientConfiguration{
        ApiUrl: os.Getenv("FGA_API_URL"),
    })
    if err != nil {
        panic(err)
    }
    
    body := ClientCreateStoreRequest{
      Name: "FGA Demo Store",
    }
    data, err := fgaClient.CreateStore(context.Background()).Body(body).Execute()
    if err != nil {
        panic(err)
    }
    _ = data
}
```

--------------------------------

### Install Python SDK with pip3

Source: https://openfga.dev/docs/getting-started/install-sdk

Install the openfga_sdk package version 0.10.4 using pip3.

```bash
pip3 install openfga_sdk==0.10.4

```

--------------------------------

### Initialize OpenFGA SDK in Go

Source: https://openfga.dev/docs/concepts

Initializes the OpenFGA SDK client in Go using environment variables. Requires the openfga/go-sdk package and an OpenFGA server. The code is intended to run inside main.

```go
import (
  "context"
  "os"
  openfga "github.com/openfga/go-sdk"
  . "github.com/openfga/go-sdk/client"
)

fgaClient, err := NewSdkClient(&ClientConfiguration{
  ApiUrl: os.Getenv("FGA_API_URL"),
  StoreId: os.Getenv("FGA_STORE_ID"),
  AuthorizationModelId: os.Getenv("FGA_MODEL_ID"), // Optional; requests can override this.
})
if err != nil {
  panic(err)
}
```

--------------------------------

### Create Store with C# SDK

Source: https://openfga.dev/docs/api/service/stores/create-a-store

Uses the OpenFga.Sdk client to create a store with the name 'FGA Demo Store'. Requires FGA_API_URL environment variable.

```csharp
using System.Collections.Generic;
using OpenFga.Sdk.Client;
using OpenFga.Sdk.Client.Model;
using OpenFga.Sdk.Model;
using Environment = System.Environment;

var fgaClient = new OpenFgaClient(new ClientConfiguration() {
  ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL"),
});

var body = new ClientCreateStoreRequest {
  Name = "FGA Demo Store",
};
var response = await fgaClient.CreateStore(body);
```

--------------------------------

### Initialize OpenFGA SDK in .NET

Source: https://openfga.dev/docs/concepts

Initializes the OpenFgaClient for .NET using environment variables. Requires the OpenFga.Sdk package and an OpenFGA server.

```csharp
using System.Collections.Generic;
using OpenFga.Sdk.Client;
using OpenFga.Sdk.Client.Model;
using OpenFga.Sdk.Model;
using Environment = System.Environment;

var fgaClient = new OpenFgaClient(new ClientConfiguration()
{
    ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL"),
    StoreId = Environment.GetEnvironmentVariable("FGA_STORE_ID"),
    AuthorizationModelId = Environment.GetEnvironmentVariable("FGA_MODEL_ID"), // Optional; requests can override this.
});
```

--------------------------------

### Install OpenTelemetry auto-instrumentations

Source: https://openfga.dev/docs/getting-started/configure-telemetry

Install the @opentelemetry/auto-instrumentations-node package to enable zero-code instrumentation for a TypeScript application.

```bash
npm install --save @opentelemetry/auto-instrumentations-node

```

--------------------------------

### Successful response example

Source: https://openfga.dev/docs/api/service/authorization-models/get-all-authorization-models

Example of a successful response containing a list of authorization models and a continuation token.

```json
{
  "authorization_models": [
    {
      "id": "01G5JAVJ41T49E9TT3SKVS7X1J",
      "schema_version": "<string>",
      "type_definitions": [
        {
          "type": "user"
        },
        {
          "metadata": {
            "relations": {
              "reader": {
                "directly_related_user_types": [
                  {
                    "type": "user"
                  }
                ]
              },
              "writer": {
                "directly_related_user_types": [
                  {
                    "type": "user"
                  }
                ]
              }
            }
          },
          "relations": {
            "reader": {
              "union": {
                "child": [
                  {
                    "this": {}
                  },
                  {
                    "computedUserset": {
                      "object": "",
                      "relation": "writer"
                    }
                  }
                ]
              }
            },
            "writer": {
              "this": {}
            }
          },
          "type": "document"
        }
      ],
      "conditions": {}
    }
  ],
  "continuation_token": "eyJwayI6IkxBVEVTVF9OU0NPTkZJR19hdXRoMHN0b3JlIiwic2siOiIxem1qbXF3MWZLZExTcUoyN01MdTdqTjh0cWgifQ=="
}
```

--------------------------------

### OpenFGA JSON Equivalent of Zanzibar Example

Source: https://openfga.dev/docs/configuration-language

The OpenFGA JSON equivalent of the Zanzibar example, using the same relations and metadata.

```JSON
{
  "schema_version": "1.1",
  "type_definitions": [
    {
      "type": "doc",
      "relations": {
        "owner": {
          "this": {}
        },
        "editor": {
          "union": {
            "child": [
              {
                "this": {}
              },
              {
                "computedUserset": {
                  "relation": "owner"
                }
              }
            ]
          }
        },
        "viewer": {
          "union": {
            "child": [
              {
                "this": {}
              },
              {
                "computedUserset": {
                  "relation": "editor"
                }
              },
              {
                "tupleToUserset": {
                  "tupleset": {
                    "relation": "parent"
                  },
                  "computedUserset": {
                    "relation": "viewer"
                  }
                }
              }
            ]
          }
        }
      },
      "metadata": {
        "relations": {
          "owner": {
            "directly_related_user_types": [
              {
                "type": "user"
              }
            ]
          },
          "editor": {
            "directly_related_user_types": [
              {
                "type": "user"
              }
            ]
          },
          "viewer": {
            "directly_related_user_types": [
              {
                "type": "user"
              }
            ]
          }
        }
      }
    }
  ]
}
```

--------------------------------

### Initialize OpenFGA SDK in Go

Source: https://openfga.dev/docs/concepts

Initializes the OpenFGA client in Go using environment variables for API URL, store ID, and optional model ID.

```go
import (
  "context"
  "os"
  openfga "github.com/openfga/go-sdk"
  . "github.com/openfga/go-sdk/client"
)

fgaClient, err := NewSdkClient(&ClientConfiguration{
  ApiUrl: os.Getenv("FGA_API_URL"),
  StoreId: os.Getenv("FGA_STORE_ID"),
  AuthorizationModelId: os.Getenv("FGA_MODEL_ID"), // Optional; requests can override this.
})
if err != nil {
  panic(err)
}

```

--------------------------------

### Start Postgres container in OpenFGA network

Source: https://openfga.dev/docs/getting-started/setup-openfga/docker

Starts a Postgres 17 container in the 'openfga' network with specified user and password.

```bash
docker run -d --name postgres --network=openfga -e POSTGRES_USER=postgres -e POSTGRES_PASSWORD=password postgres:17
```

--------------------------------

### Initialize OpenFgaClient in .NET

Source: https://openfga.dev/docs/concepts

Initializes the OpenFgaClient in .NET using environment variables.

```csharp
using System.Collections.Generic; using OpenFga.Sdk.Client; using OpenFga.Sdk.Client.Model; using OpenFga.Sdk.Model; using Environment = System.Environment; var fgaClient = new OpenFgaClient(new ClientConfiguration() { ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL"), StoreId = Environment.GetEnvironmentVariable("FGA_STORE_ID"), AuthorizationModelId = Environment.GetEnvironmentVariable("FGA_MODEL_ID"), // Optional; requests can override this. });
```

--------------------------------

### Example relationship tuple for owner

Source: https://openfga.dev/docs/modeling/advanced/github

Shows an example relationship tuple that might be returned when reading all owner relationships for a repo.

```json
[{ "object": "repo:contoso/tooling", "relation": "owner", "user": "organization:contoso" }]
```

--------------------------------

### Enable AuthZEN with base URL via CLI flag

Source: https://openfga.dev/docs/interacting/authzen

Starts the server with both the `authzen` experimental flag and the `--authzen-base-url` flag to set the canonical base URL for discovery metadata.

```bash
openfga run --experimentals=authzen --authzen-base-url=https://api.example.com
```

--------------------------------

### Install .NET SDK with dotnet CLI

Source: https://openfga.dev/docs/getting-started/install-sdk

Add the OpenFGA.Sdk package version 0.10.4 to a .NET project using the dotnet CLI.

```bash
dotnet add package OpenFGA.Sdk --version 0.10.4

```
Tokens:
Raw