Open Policy Agent

https://www.openpolicyagent.org/docs
Admin
Open Policy Agent (OPA) is an open-source, general-purpose policy engine that unifies policy...
Tokens:520,968
Snippets:4,065
Trust Score:9.4
Update:1 month ago
Show doc for...
Tokens:
Raw
### Setup and Configure Gloo Edge

Source: https://www.openpolicyagent.org/docs/envoy/tutorial-gloo-edge

Adds the Gloo Edge Helm repository, installs Gloo Edge into the gloo-system namespace, and sets the current kubectl context to that namespace. Ensure all pods are running with `kubectl get pod`.

```bash
helm repo add gloo https://storage.googleapis.com/solo-public-helmhelm upgrade --install --namespace gloo-system --create-namespace gloo gloo/glookubectl config set-context $(kubectl config current-context) --namespace=gloo-system
```

--------------------------------

### Start minikube and enable ingress addon

Source: https://www.openpolicyagent.org/docs/kubernetes/tutorial

Starts minikube and enables the ingress addon, which is required for the Kubernetes admission controller setup.

```bash
minikube start
```

```bash
minikube addons enable ingress
```

--------------------------------

### GET /v1/sources Example Response

Source: https://www.openpolicyagent.org/docs/ocp/api-reference

Returns a list of all configured sources with pagination support.

```json
{  "result": [    {      "name": "myorg-git-policies",      "git": {        "repo": "https://github.com/myorg/policies.git",        "reference": "refs/heads/main",        "path": "src/policies",        "included_files": ["*.rego"],        "excluded_files": ["*.test.rego"],        "credentials": "github-creds"      },      "requirements": [        {          "source": "base-policies"        }      ]    },    {      "name": "local-policies",      "directory": "/local/policies",      "paths": [        "authz.rego",        "utils.rego"      ],      "datasources": [        {          "name": "user-data",          "path": "external/users",          "type": "http",          "config": {            "url": "https://api.example.com/users"          },          "credentials": "api-creds"        }      ]    }  ],  "next_cursor": null}
```

--------------------------------

### Example Request: GET /v1/data/opa/examples/public_servers

Source: https://www.openpolicyagent.org/docs/rest-api

Example HTTP request to retrieve a document from OPA.

```http
GET /v1/data/opa/examples/public_servers HTTP/1.1
```

--------------------------------

### Start OPA with Configuration

Source: https://www.openpolicyagent.org/docs/extensions

Command to start the OPA server using the custom configuration file.

```bash
./opa++ run --server --config-file opa-config.yaml
```

--------------------------------

### Sample input (input.json)

Source: https://www.openpolicyagent.org/docs/envoy/tutorial-istio

Example input received by OPA for a GET request to /productpage with Basic authorization header.

```json
{  "attributes": {    "request": {      "http": {        "method": "GET",        "path": "/productpage",        "headers": {          "authorization": "Basic YWxpY2U6cGFzc3dvcmQ="        }      }    }  }}
```

--------------------------------

### Bundle and Stack Configuration Example

Source: https://www.openpolicyagent.org/docs/ocp/concepts

Example configuration showing how bundles and stacks are defined with labels and requirements.

```yaml
bundles:  petshop-svc:    labels:      environment: prod    requirements:    - source: petshop-svc  notifications-svc:    labels:      environment: prod    requirements:    - source: notifications-svcstacks:  mandatory:    selector:      environment: [prod]    requirements:    - source: main      automount: false    - source: globalsecuritysources:  petshop-svc: ...  notifications-svc: ...  globalsecurity: ...  main: ...
```

--------------------------------

### Download OPA GitHub Action

Source: https://www.openpolicyagent.org/docs/cicd

The setup step to install the OPA binary within a GitHub Actions workflow.

```yaml
- name: Download OPA  uses: open-policy-agent/setup-opa  with:    version: latest # install the latest version
```

--------------------------------

### Start OPA server

Source: https://www.openpolicyagent.org/docs/filtering/tutorial-sql-filtering

Command to start the OPA server with the specified policy file.

```bash
opa run --server policy.rego
```

--------------------------------

### Start OPA server

Source: https://www.openpolicyagent.org/docs/cli

Starts the OPA runtime in server mode, exposing an HTTP API.

```bash
$ opa run -s
```

--------------------------------

### Define example sites, apps, and containers data

Source: https://www.openpolicyagent.org/docs/policy-language

Provides the example dataset used throughout the references examples. It defines a site with server hostnames and an apps and containers array for use in policy rules.

```rego
package examplesites := [    {        "region": "east",        "name": "prod",        "servers": [            {                "name": "web-0",                "hostname": "hydrogen"            },            {                "name": "web-1",                "hostname": "helium"            },            {                "name": "db-0",                "hostname": "lithium"            }        ]    },    {        "region": "west",        "name": "smoke",        "servers": [            {                "name": "web-1000",                "hostname": "beryllium"            },            {                "name": "web-1001",                "hostname": "boron"            },            {                "name": "db-1000",                "hostname": "carbon"            }        ]    },    {        "region": "west",        "name": "dev",        "servers": [            {                "name": "web-dev",                "hostname": "nitrogen"            },            {                "name": "db-dev",                "hostname": "oxygen"            }        ]    }]apps := [    {        "name": "web",        "servers": ["web-0", "web-1", "web-1000", "web-1001", "web-dev"]    },    {        "name": "mysql",        "servers": ["db-0", "db-1000"]    },    {        "name": "mongodb",        "servers": ["db-dev"]    }]containers := [    {        "image": "redis",        "ipaddress": "10.0.0.1",        "name": "big_stallman"    },    {        "image": "nginx",        "ipaddress": "10.0.0.2",        "name": "cranky_euclid"    }]
```

--------------------------------

### Install opa-docker-authz plugin

Source: https://www.openpolicyagent.org/docs/docker-authorization

Installs the plugin with alias 'opa-docker-authz' and passes the config file path as an argument.

```bash
docker plugin install --alias opa-docker-authz ghcr.io/open-policy-agent/opa-docker-authz:v0.10 opa-args="-config-file /opa/config/opa-config.yaml"
```

--------------------------------

### Complete main.go Implementation

Source: https://www.openpolicyagent.org/docs

A full command-line program example that evaluates policies using OPA as a library.

```go
package mainimport (    "context"    "encoding/json"    "fmt"    "log"    "os"    "github.com/open-policy-agent/opa/v1/rego")func main() {    ctx := context.Background()    // Construct a Rego object that can be prepared or evaluated.    r := rego.New(        rego.Query(os.Args[2]),        rego.Load([]string{os.Args[1]}, nil))    // Create a prepared query that can be evaluated.    query, err := r.PrepareForEval(ctx)    if err != nil {        log.Fatal(err)    }    // Load the input document from stdin.    var input any    dec := json.NewDecoder(os.Stdin)    dec.UseNumber()    if err := dec.Decode(&input); err != nil {        log.Fatal(err)    }    // Execute the prepared query.    rs, err := query.Eval(ctx, rego.EvalInput(input))    if err != nil {        log.Fatal(err)    }    // Do something with the result.    fmt.Println(rs)}
```

--------------------------------

### Ad hoc Query Example Request - GET with q Parameter

Source: https://www.openpolicyagent.org/docs/rest-api

Example GET request for an ad hoc query. The query is URL encoded in the q parameter.

```HTTP
GET /v1/query?q=data.servers[i].ports[_] = "p2"; data.servers[i].name = name HTTP/1.1
```

--------------------------------

### Launch Tutorial Containers

Source: https://www.openpolicyagent.org/docs/kafka-authorization

Command to start the Kafka tutorial environment using Docker Compose.

```bash
docker-compose --project-name opa-kafka-tutorial up
```

--------------------------------

### Create tutorial-docker-compose.yaml

Source: https://www.openpolicyagent.org/docs/ssh-and-sudo-authorization

Defines the OPA service, dummy SSH hosts, and a bundle server for the tutorial environment.

```yaml
version: "2"services:  opa:    image: openpolicyagent/opa:1.20.2    ports:    - "8181:8181"    # WARNING: OPA is NOT running with an authorization policy configured. This    # means that clients can read and write policies in OPA. If you are    # deploying OPA in an insecure environment, be sure to configure    # authentication and authorization on the daemon. See the Security page for    # details: https://www.openpolicyagent.org/docs/security.html.    command:    - "run"    - "--server"    - "--addr=0.0.0.0:8181"    - "--set=decision_logs.console=true"    - "--set=services.nginx.url=http://bundle_server"    - "--set=bundles.nginx.service=nginx"    - "--set=bundles.nginx.resource=bundles/bundle.tar.gz"    depends_on:    - bundle_server  frontend:    image: openpolicyagent/demo-pam    ports:    - "2222:22"    volumes:    - ./frontend_host_id.json:/etc/host_identity.json  backend:    image: openpolicyagent/demo-pam    ports:    - "2223:22"    volumes:    - ./backend_host_id.json:/etc/host_identity.json  bundle_server:    image: nginx:1.20.0-alpine    ports:    - 8888:80    volumes:    - ./bundles:/usr/share/nginx/html/bundles
```

--------------------------------

### Health API Request Examples

Source: https://www.openpolicyagent.org/docs/rest-api

Example HTTP GET requests for the ready and live health endpoints.

```http
GET /health/ready HTTP/1.1
```

```http
GET /health/live HTTP/1.1
```

--------------------------------

### Run Docker Compose

Source: https://www.openpolicyagent.org/docs/http-api-authorization

Starts the tutorial environment using Docker Compose. On Docker Desktop, you may use 'docker compose' instead.

```bash
docker-compose -f docker-compose.yaml up
```

--------------------------------

### Bootstrap tutorial directories

Source: https://www.openpolicyagent.org/docs/kafka-authorization

Create the necessary directories for policy files, bundles, and the OPA authorizer plugin.

```bash
mkdir policies bundles plugin
```

--------------------------------

### GET /v1/bundles/{bundle} Example Response

Source: https://www.openpolicyagent.org/docs/ocp/api-reference

Example JSON response for retrieving a specific bundle by name.

```json
{  "result": {    "name": "my-app-bundle",    "labels": {      "env": "production",      "version": "1.0.0"    },    "object_storage": {      "filesystem": {        "path": "/bundles/my-app/bundle.tar.gz"      }    },    "requirements": [      {        "source": "my-app-policies"      },      {        "git": {          "commit": "abc123def456"        }      }    ],    "excluded_files": [      "*.md",      "docs/*"    ]  }}
```

--------------------------------

### GET bundles - JSON response

Source: https://www.openpolicyagent.org/docs/ocp/guide-deploy-as-a-service

Example response from the GET /v1/bundles endpoint, showing bundle configurations.

```json
{  "result": [    {      "object_storage": {        "aws": {          "bucket": "my-aws-bucket-name",          "key": "bundles/my-alpha-app/bundle.tar.gz",          "region": "us-east-2"        }      },      "requirements": [        {          "source": "my-alpha-app",          "git": {}        },        {          "source": "my-shared-datasource",          "git": {}        }      ]    },    {      "object_storage": {        "filesystem": {          "path": "bundles/my-beta-app/bundle.tar.gz"        }      },      "requirements": [        {          "source": "my-beta-app",          "git": {}        },        {          "source": "my-shared-datasource",          "git": {}        }      ]    }  ]}
```

--------------------------------

### GET /v1/bundles/{bundle}/status Example Response

Source: https://www.openpolicyagent.org/docs/ocp/api-reference

Example response showing a list of status records for a bundle.

```json
{  "result": [    {      "bundle_name": "my-app-bundle",      "revision": "1.0.0",      "phase": "PUSH",      "status": "PUSH_FAILED",      "error_message": "push failed",      "created_at": "2025-08-07T10:30:00Z"    },    {      "bundle_name": "my-app-bundle",      "revision": "2.0.0",      "phase": "BUILD",      "status": "SUCCESS",      "created_at": "2025-08-07T09:15:00Z"    }  ]}
```

--------------------------------

### GET /v1/bundles/{bundle}/status/latest Example Response

Source: https://www.openpolicyagent.org/docs/ocp/api-reference

Example response showing the latest status record for a bundle.

```json
{  "result": {    "bundle_name": "my-app-bundle",    "revision": "1.0.0",    "phase": "BUILD",    "status": "SUCCESS",    "created_at": "2025-08-07T10:30:00Z"  }}
```

--------------------------------

### Install OPA-Envoy with kubectl apply

Source: https://www.openpolicyagent.org/docs/envoy/tutorial-istio

Applies the quick_start.yaml manifest from the opa-envoy-plugin repository to install OPA-Envoy on Istio. Requires Kubernetes 1.20+ and Istio v1.19.0+.

```bash
kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/opa-envoy-plugin/main/examples/istio/quick_start.yaml
```

--------------------------------

### Bundle Configuration Example

Source: https://www.openpolicyagent.org/docs/management-bundles

Example configuration for enabling bundle downloading, including service definition, polling, and signing keys.

```yaml
services:
  - name: acmecorp
    url: https://example.com/service/v1
    credentials:
      bearer:
        token: "bGFza2RqZmxha3NkamZsa2Fqc2Rsa2ZqYWtsc2RqZmtramRmYWxkc2tm"
bundles:
  authz:
    service: acmecorp
    resource: somedir/bundle.tar.gz
    persist: true
    polling:
      min_delay_seconds: 10
      max_delay_seconds: 20
    signing:
      keyid: my_global_key
      scope: read
keys:
  my_global_key:
    algorithm: RS256
    key: |
      -----BEGIN PUBLIC KEY-----
      MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
      -----END PUBLIC KEY-----
```

--------------------------------

### Get Policy Response Example (JSON)

Source: https://www.openpolicyagent.org/docs/rest-api

An example response body returned by GET /v1/policies/<id>, showing the policy module content and the detailed body representation. The response includes the module's AST representation with terms and indices.

```json
{
  "result": {
    "id": "<id>",
    "raw": "package example\n\nimport data.servers\nimport data.networks\n\npublic_servers[server] {\n  server := servers[_]\n  server.ports[_] == ports[k].id\n  ports[k].networks[_] == networks[m].id\n  networks[m].public\n}",
    "ast": {
      "package": {
        "path": [
          {
            "type": "var",
            "value": "data"
          },
          {
            "type": "string",
            "value": "example"
          }
        ]
      },
      "rules": [
        {
          "head": {
            "name": "public_servers",
            "key": {
              "type": "var",
              "value": "server"
            },
            "value": null
          },
          "body": [
            {
              "index": 0,
              "terms": [
                {
                  "type": "string",
                  "value": "eq"
                },
                {
                  "type": "var",
                  "value": "server"
                },
                {
                  "type": "ref",
                  "value": [
                    {
                      "type": "var",
                      "value": "data"
                    },
                    {
                      "type": "string",
                      "value": "servers"
                    },
                    {
                      "type": "var",
                      "value": "$0"
                    }
                  ]
                }
              ]
            },
            {
              "index": 1,
              "terms": [
                {
                  "type": "string",
                  "value": "eq"
                },
                {
                  "type": "ref",
                  "value": [
                    {
                      "type": "var",
                      "value": "server"
                    },
                    {
                      "type": "string",
                      "value": "ports"
                    },
                    {
                      "type": "var",
                      "value": "$1"
                    }
                  ]
                },
                {
                  "type": "ref",
                  "value": [
                    {
                      "type": "var",
                      "value": "data"
                    },
                    {
                      "type": "string",
                      "value": "ports"
                    },
                    {
                      "type": "var",
                      "value": "k"
                    },
                    {
                      "type": "string",
                      "value": "id"
                    }
                  ]
                }
              ]
            },
            {
              "index": 2,
              "terms": [
                {
                  "type": "string",
                  "value": "eq"
                },
                {
                  "type": "ref",
                  "value": [
                    {
                      "type": "var",
                      "value": "data"
                    },
                    {
                      "type": "string",
                      "value": "ports"
                    },
                    {
                      "type": "var",
                      "value": "k"
                    },
                    {
                      "type": "string",
                      "value": "networks"
                    },
                    {
                      "type": "var",
                      "value": "$2"
                    }
                  ]
                },
                {
                  "type": "ref",
                  "value": [
                    {
                      "type": "var",
                      "value": "data"
                    },
                    {
                      "type": "string",
                      "value": "networks"
                    },
                    {
                      "type": "var",
                      "value": "m"
                    },
                    {
                      "type": "string",
                      "value": "id"
                    }
                  ]
                }
              ]
            },
            {
              "index": 3,
              "terms": [
                {
                  "type": "string",
                  "value": "eq"
                },
                {
                  "type": "ref",
                  "value": [
                    {
                      "type": "var",
                      "value": "data"
                    },
                    {
                      "type": "string",
                      "value": "networks"
                    },
                    {
                      "type": "var",
                      "value": "m"
                    },
                    {
                      "type": "string",
                      "value": "public"
                    }
                  ]
                },
                {
                  "type": "boolean",
                  "value": true
                }
              ]
            }
          ]
        }
      ]
    }
  }
}
```

--------------------------------

### Create ConfigMap from file (kubectl create configmap)

Source: https://www.openpolicyagent.org/docs/deploy/docker

Creates a ConfigMap named example-policy from the example.rego file. Run after creating the policy file.

```bash
kubectl create configmap example-policy --from-file example.rego
```

--------------------------------

### Start OPA with a remote bundle

Source: https://www.openpolicyagent.org/docs/debugging

Use this command to quickly start an OPA instance and load a bundle from a remote URL.

```bash
opa run -s https://example.com/bundles/bundle.tar.gz
```

--------------------------------

### GET /v1/stacks Response

Source: https://www.openpolicyagent.org/docs/ocp/api-reference

Example response listing stacks with pagination support.

```json
{  "result": [    {      "name": "prod-stack",      "selector": {        "environment": ["production"],        "service": ["auth-service", "api-gateway"]      },      "exclude_selector": {        "region": ["us-west-1"]      },      "requirements": [        {          "source": "production-policies"        },        {          "source": "security-baseline"        }      ]    }  ],  "next_cursor": "eyJpZCI6IjQ1NiIsInRzIjoxNjkwMjM0NTY3fQ=="}
```

--------------------------------

### GET /v1/data/{path:.*} with Bearer Token

Source: https://www.openpolicyagent.org/docs/rest-api

Example of a GET request to the OPA Data API with a Bearer token in the Authorization header. This endpoint is used to query policy decisions.

```APIDOC
## GET /v1/data/{path:.*}

### Description
Retrieves policy decisions from the OPA Data API. Requires a Bearer token when OPA is started with the --authentication=token flag.

### Method
GET

### Endpoint
/v1/data/{path:.*}

### Parameters
#### Path Parameters
- **path** (string) - Required - The path to the policy decision.

#### Headers
- **Authorization** (string) - Required - Bearer token for authentication.

### Request Example
GET /v1/data/exempli-gratia HTTP/1.1
Authorization: Bearer my-secret-token

### Response
#### Success Response (200)
- **result** (object) - The policy decision result.

#### Response Example
{
  "result": {}
}
```

--------------------------------

### Set OPA binary permissions and verify

Source: https://www.openpolicyagent.org/docs?current-os=linux

Make the downloaded OPA binary executable and verify the installation.

```bash
chmod 755 ./opa
```

```bash
opa version
```

--------------------------------

### Download and Execute Certificate Script

Source: https://www.openpolicyagent.org/docs/kafka-authorization

Commands to download and run the example script for generating client certificates.

```bash
curl -O https://raw.githubusercontent.com/StyraInc/opa-kafka-plugin/main/example/opa_tutorial/create_cert.shchmod +x create_cert.sh./create_cert.sh
```

--------------------------------

### GET /v1/stacks/{stack} Response

Source: https://www.openpolicyagent.org/docs/ocp/api-reference

Example response for retrieving a specific stack by name.

```json
{  "result": {    "name": "default-stack",    "selector": {      "team": ["platform", "security"],      "environment": ["staging", "production"]    },    "requirements": [      {        "source": "team-policies"      },      {        "source": "compliance-rules"      }    ]  }}
```

--------------------------------

### Run OPA CLI with configuration

Source: https://www.openpolicyagent.org/docs/management-bundles

Command to start an interactive OPA REPL with the given configuration, showing the loaded bundle.

```bash
opa run -c configuration.yaml
```

--------------------------------

### Get annotation chain for a rule

Source: https://www.openpolicyagent.org/docs/policy-language

Go code that uses ast.Chain to get the chain of annotations for a rule and its path ancestry, printing each link. Includes example output and the corresponding modules.

```go
var rule *ast.Rule...chain := ast.Chain(rule)for _, link := range chain {    fmt.Printf("link at %v has annotations %v\n",        link.Path,        link.Annotations)}// Output:// data.foo.bar.p at mod:7 has annotations {"scope":"rule","title":"My Rule P"}// data.foo.bar at mod:3 has annotations {"scope":"package","description":"A couple of useful rules"}// data.foo at foo.rego:5 has annotations {"scope":"subpackages","organizations":["Acme Corp."]}//// For modules:// # METADATA// # scope: subpackages// # organizations:// # - Acme Corp.// package foo// ---// # METADATA// # description: A couple of useful rules// package foo.bar//// # METADATA// # title: My Rule P// p := 7
```

--------------------------------

### Start OPA as a server

Source: https://www.openpolicyagent.org/docs/management-bundles

Command to run OPA as a server with the given configuration and default decision.

```bash
opa run --server --set default_decision=policies -c configuration.yaml
```

--------------------------------

### GET /v1/sources/{source} Example Response

Source: https://www.openpolicyagent.org/docs/ocp/api-reference

Returns the details of a specific source identified by its URL-encoded name.

```json
{  "result": {    "name": "entitlements",    "builtin": "styra.entitlements.v1",    "requirements": [      {        "source": "foundation-policies"      }    ]  }}
```

--------------------------------

### Access example.com using System Cert Pool

Source: https://www.openpolicyagent.org/docs/policy-reference/builtins/http

Demonstrates how to perform an HTTP GET request to example.com while utilizing the system's certificate pool for TLS verification.

```rego
http.send({  "method": "get",  "url": "https://www.example.com",  "tls_use_system_certs": true,})
```

--------------------------------

### Defining and preparing a custom built-in function

Source: https://www.openpolicyagent.org/docs/extensions

Example of creating a 'hello' function that accepts a string and returns a string.

```go
r := rego.New(    rego.Query(`x = hello("bob")`),    rego.Function1(        &rego.Function{            Name: "hello",            Decl: types.NewFunction(types.Args(types.S), types.S),        },        func(_ rego.BuiltinContext, a *ast.Term) (*ast.Term, error) {            if str, ok := a.Value.(ast.String); ok {                return ast.StringTerm("hello, " + string(str)), nil            }            return nil, nil        }),)query, err := r.PrepareForEval(ctx)if err != nil {    // handle error.}
```

--------------------------------

### Integrate with OPA Go SDK using a mock bundle server

Source: https://www.openpolicyagent.org/docs/integration

Initializes the OPA SDK with a mock bundle server, fetches a policy bundle, and evaluates a decision. The decision log event is printed to the console by default. Setting an ID in sdk.Options is optional but recommended; without it, a random ID is generated each time the SDK is initialized.

```go
package main

import (
    "bytes"
    "context"
    "fmt"
    "github.com/open-policy-agent/opa/v1/sdk"
    sdktest "github.com/open-policy-agent/opa/v1/sdk/test"
)

func main() {
    ctx := context.Background()

    // create a mock HTTP bundle server
    server, err := sdktest.NewServer(sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
        "example.rego": `
                package authz

                default allow := false

                allow if input.open == "sesame"
            `,
    }))
    if err != nil {
        // handle error.
    }
    defer server.Stop()

    // provide the OPA configuration which specifies
    // fetching policy bundles from the mock server
    // and logging decisions locally to the console
    config := []byte(fmt.Sprintf(`{
        "services": {
            "test": {
                "url": %q
            }
        },
        "bundles": {
            "test": {
                "resource": "/bundles/bundle.tar.gz"
            }
        },
        "decision_logs": {
            "console": true
        }
    }`, server.URL()))

    // create an instance of the OPA object
    opa, err := sdk.New(ctx, sdk.Options{
        ID:     "opa-test-1",
        Config: bytes.NewReader(config),
    })
    if err != nil {
        // handle error.
    }
    defer opa.Stop(ctx)

    // get the named policy decision for the specified input
    if result, err := opa.Decision(ctx, sdk.DecisionOptions{Path: "/authz/allow", Input: map[string]any{"open": "sesame"}}); err != nil {
        // handle error.
    } else if decision, ok := result.Result.(bool); !ok || !decision {
        // handle error.
    }
}
```

--------------------------------

### GET /v1/sources/{source}/data/{path} Response

Source: https://www.openpolicyagent.org/docs/ocp/api-reference

Example JSON response for retrieving data from a source at a specific path.

```json
{  "result": {    "users": [      {        "id": "user123",        "name": "John Doe",        "roles": ["admin", "user"]      },      {        "id": "user456",        "name": "Jane Smith",        "roles": ["user"]      }    ],    "last_updated": "2025-08-07T10:30:00Z"  }}
```

--------------------------------

### OPA Boot Configuration for Discovery

Source: https://www.openpolicyagent.org/docs/management-discovery

Example of an OPA configuration file enabling discovery by specifying the service and resource path.

```yaml
services:  acmecorp:    url: https://example.com/control-plane-api/v1    credentials:      bearer:        token: "bGFza2RqZmxha3NkamZsa2Fqc2Rsa2ZqYWtsc2RqZmtramRmYWxkc2tm"discovery:  service: acmecorp  resource: /configuration/example/discovery.tar.gz
```

--------------------------------

### Get Status Response

Source: https://www.openpolicyagent.org/docs/rest-api

Example response from the /v1/status endpoint. The result includes labels, bundle activation details, metrics, and plugin states.

```HTTP
HTTP/1.1 200 OKContent-Type: application/json
```

```JSON
{  "result": {    "labels": {      "id": "7da62ac6-42e0-4b3c-b6d5-199239ad436e",      "version": "99.9.9-dev"    },    "bundles": {      "play": {        "name": "play",        "active_revision": "b3BlbnBvbGljeWFnZW50Lm9yZw==",        "last_successful_activation": "2021-12-08T01:36:14.201927Z",        "last_successful_download": "2021-12-08T01:36:14.20038Z",        "last_successful_request": "2021-12-08T01:36:23.131346Z",        "last_request": "2021-12-08T01:36:23.131346Z",        "metrics": {          "timer_bundle_request_ns": 168273779        }      }    },    "metrics": {      "prometheus": {<------------------8<------------------>      }    },    "plugins": {      "bundle": {        "state": "OK"      },      "decision_logs": {        "state": "OK"      },      "discovery": {        "state": "OK"      },      "status": {        "state": "OK"      }    }  }}
```

--------------------------------

### Check Test Coverage with OPA

Source: https://www.openpolicyagent.org/docs/cicd

A GitHub Actions workflow example that installs OPA and evaluates test coverage results, failing the job if coverage drops below 70%.

```yaml
name: OPA Checkson: [ pull_request ]jobs:  validate-configs:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v6      - name: Download OPA        uses: open-policy-agent/setup-opa        with:          version: edge      - name: Check tests results coverage remains above 70%        run: |          my test command |            opa eval --fail-defined \            --stdin-input \            'input.results[_].coverage < 0.7'
```

--------------------------------

### Configure OPA on Windows

Source: https://www.openpolicyagent.org/docs?current-os=linux

Create a directory for OPA and move the binary into it.

```powershell
mkdir C:\Tools\OPA

move opa.exe C:\Tools\OPA\
```

--------------------------------

### Test Gloo with curl

Source: https://www.openpolicyagent.org/docs/envoy/tutorial-gloo-edge

Tests the Gloo Edge setup by sending GET and POST requests to the forwarded port. The expected output shows HTTP/1.1 200 OK for both requests.

```bash
curl -XGET -Is localhost:8080/get | head -n 1HTTP/1.1 200 OKcurl http -XPOST -Is localhost:8080/post | head -n1HTTP/1.1 200 OK
```

--------------------------------

### Alternative command using repeated --profile-sort flags

Source: https://www.openpolicyagent.org/docs/policy-performance

Alternative way to get the same output as the comma-separated --profile-sort num_eval,num_redo example, using repeated --profile-sort flags.

```bash
opa eval --data rbac.rego --profile-limit 5 --profile-sort num_eval --profile-sort num_redo --format=pretty 'data.rbac.allow'
```

--------------------------------

### Start OPA with TLS enabled

Source: https://www.openpolicyagent.org/docs/security

Starts OPA with TLS enabled using the generated certificate and private key. Requires both --tls-cert-file and --tls-private-key-file.

```bash
opa run --server --log-level debug \
    --tls-cert-file public.crt \
    --tls-private-key-file private.key
```

--------------------------------

### Get Config Response

Source: https://www.openpolicyagent.org/docs/rest-api

Example response from the /v1/config endpoint. The response omits credentials, private_key, and key fields. The result includes services, labels, keys, decision_logs, status, bundles, and default decisions.

```HTTP
HTTP/1.1 200 OKContent-Type: application/json
```

```JSON
{  "result": {    "services": {      "acmecorp": {        "url": "https://example.com/control-plane-api/v1"      }    },    "labels": {      "id": "test-id",      "version": "0.27.0"    },    "keys": {      "global_key": {        "scope": "read"      }    },    "decision_logs": {      "service": "acmecorp"    },    "status": {      "service": "acmecorp"    },    "bundles": {      "authz": {        "service": "acmecorp"      }    },    "default_authorization_decision": "/system/authz/allow",    "default_decision": "/system/main"  }}
```

--------------------------------

### Objects: Extracting Data with object.get and object.keys

Source: https://www.openpolicyagent.org/docs/cheatsheet

Demonstrates extracting data from objects using object.get with paths that can include array indexes, and object.keys to get all keys. The example shows a default value when a path is missing.

```rego
obj := {"userid": "18472", "roles": [{"name": "admin"}]}
# paths can contain array indexes too
val := object.get(obj, ["roles", 0, "name"], "missing")
defaulted_val := object.get(
	obj,
	["roles", 0, "permissions"], # path
	"unknown", # default if path is missing
)
keys := object.keys(obj)
```

--------------------------------

### Example OCI Bundle Download Configuration

Source: https://www.openpolicyagent.org/docs/configuration

A complete configuration example for downloading a bundle from an OCI repository using the OCI service type.

```yaml
services:  ghcr-registry:    url: https://ghcr.io    type: ocibundles:  authz:    service: ghcr-registry    resource: ghcr.io/${ORGANIZATION}/${REPOSITORY}:${TAG}    persist: true    polling:      min_delay_seconds: 60      max_delay_seconds: 120persistence_directory: ${PERSISTENCE_PATH}
```
Tokens:
Raw