@openfga/sdk
Advanced tools
This is an autogenerated JavaScript SDK for OpenFGA. It provides a wrapper around the OpenFGA API definition, and includes TS typings.
OpenFGA is an open source Fine-Grained Authorization solution inspired by Google's Zanzibar paper. It was created by the FGA team at Auth0 based on Auth0 Fine-Grained Authorization (FGA), available under a permissive license (Apache-2) and welcomes community contributions.
OpenFGA is designed to make it easy for application builders to model their permission layer, and to add and integrate fine-grained authorization into their applications. OpenFGA’s design is optimized for reliability and low latency at a high scale.
Using npm:
npm install @openfga/sdk
Using yarn:
yarn add @openfga/sdk
For details on the supported Node.js versions and our support policy, see SUPPORTED_RUNTIMES.md.
Learn how to initialize your SDK
We strongly recommend you initialize the OpenFgaClient only once and then re-use it throughout your app, otherwise you will incur the cost of having to re-initialize multiple times or at every request, the cost of reduced connection pooling and re-use, and would be particularly costly in the client credentials flow, as that flow will be performed on every request.
The
OpenFgaClientwill by default retry API requests up to 3 times on 429 and 5xx errors.
const { OpenFgaClient } = require('@openfga/sdk'); // OR import { OpenFgaClient } from '@openfga/sdk';
const fgaClient = new OpenFgaClient({
apiUrl: process.env.FGA_API_URL, // required
storeId: process.env.FGA_STORE_ID, // not needed when calling `CreateStore` or `ListStores`
authorizationModelId: process.env.FGA_MODEL_ID, // Optional, can be overridden per request
});
const { OpenFgaClient, CredentialsMethod } = require('@openfga/sdk'); // OR import { OpenFgaClient, CredentialsMethod } from '@openfga/sdk';
const fgaClient = new OpenFgaClient({
apiUrl: process.env.FGA_API_URL, // required
storeId: process.env.FGA_STORE_ID, // not needed when calling `CreateStore` or `ListStores`
authorizationModelId: process.env.FGA_MODEL_ID, // Optional, can be overridden per request
credentials: {
method: CredentialsMethod.ApiToken,
config: {
token: process.env.FGA_API_TOKEN, // will be passed as the "Authorization: Bearer ${ApiToken}" request header
}
}
});
const { OpenFgaClient, CredentialsMethod } = require('@openfga/sdk'); // OR import { OpenFgaClient, CredentialsMethod } from '@openfga/sdk';
const fgaClient = new OpenFgaClient({
apiUrl: process.env.FGA_API_URL, // required
storeId: process.env.FGA_STORE_ID, // not needed when calling `CreateStore` or `ListStores`
authorizationModelId: process.env.FGA_MODEL_ID, // Optional, can be overridden per request
credentials: {
method: CredentialsMethod.ClientCredentials,
config: {
apiTokenIssuer: process.env.FGA_API_TOKEN_ISSUER,
apiAudience: process.env.FGA_API_AUDIENCE,
clientId: process.env.FGA_CLIENT_ID,
clientSecret: process.env.FGA_CLIENT_SECRET,
}
}
});
You can set default headers that will be sent with every request during client initialization:
const { OpenFgaClient } = require('@openfga/sdk'); // OR import { OpenFgaClient } from '@openfga/sdk';
const fgaClient = new OpenFgaClient({
apiUrl: process.env.FGA_API_URL,
storeId: process.env.FGA_STORE_ID,
authorizationModelId: process.env.FGA_MODEL_ID,
baseOptions: {
headers: {
"X-Custom-Header": "default-value",
"X-Request-Source": "my-app",
}
}
});
You can also send custom headers on a per-request basis by using the options parameter. Custom headers will override any default headers set in the client configuration.
// Add custom headers to a specific request
const result = await fgaClient.check({
user: "user:anne",
relation: "viewer",
object: "document:roadmap",
}, {
headers: {
"X-Request-ID": "123e4567-e89b-12d3-a456-426614174000",
"X-Custom-Header": "custom-value", // these override any default headers set
}
});
You need your store id to call the OpenFGA API (unless it is to call the CreateStore or ListStores methods).
If your server is configured with authentication enabled, you also need to have your credentials ready.
Note regarding casing in the OpenFgaClient: All input parameters are in
camelCase, all response parameters will match the API and are insnake_case.
Note: The Client interface might see several changes over the next few months as we get more feedback before it stabilizes.
Get a paginated list of stores.
const options = { pageSize: 10, continuationToken: "..." };
const { stores } = await fgaClient.listStores(options);
// stores = [{ "id": "01FQH7V8BEG3GPQW93KTRFR8JB", "name": "FGA Demo Store", "created_at": "2022-01-01T00:00:00.000Z", "updated_at": "2022-01-01T00:00:00.000Z" }]
Initialize a store.
const { id: storeId } = await fgaClient.createStore({
name: "FGA Demo Store",
});
// storeId = "01FQH7V8BEG3GPQW93KTRFR8JB"
Get information about the current store.
const store = await fgaClient.getStore();
// store = { "id": "01FQH7V8BEG3GPQW93KTRFR8JB", "name": "FGA Demo Store", "created_at": "2022-01-01T00:00:00.000Z", "updated_at": "2022-01-01T00:00:00.000Z" }
Delete a store.
await fgaClient.deleteStore();
Read all authorization models in the store.
Requires a client initialized with a storeId
const options = { pageSize: 10, continuationToken: "..." };
const { authorization_models: authorizationModels } = await fgaClient.readAuthorizationModels(options);
/*
authorizationModels = [
{ id: "01GXSA8YR785C4FYS3C0RTG7B1", schema_version: "1.1", type_definitions: [...] },
{ id: "01GXSBM5PVYHCJNRNKXMB4QZTW", schema_version: "1.1", type_definitions: [...] }];
*/
Create a new authorization model.
Note: To learn how to build your authorization model, check the Docs at https://openfga.dev/docs.
Learn more about the OpenFGA configuration language.
You can use the OpenFGA Syntax Transformer to convert between the friendly DSL and the JSON authorization model.
const { authorization_model_id: id } = await fgaClient.writeAuthorizationModel({
schema_version: "1.1",
type_definitions: [{
type: "user",
}, {
type: "document",
relations: {
"writer": { "this": {} },
"viewer": {
"union": {
"child": [
{ "this": {} },
{ "computedUserset": {
"object": "",
"relation": "writer" }
}
]
}
}
} }],
});
// id = "01GXSA8YR785C4FYS3C0RTG7B1"
Read a particular authorization model.
const options = {};
// To override the authorization model id for this request
options.authorizationModelId = "01GXSA8YR785C4FYS3C0RTG7B1";
const { authorization_model: authorizationModel } = await fgaClient.readAuthorizationModel(options);
// authorizationModel = { id: "01GXSA8YR785C4FYS3C0RTG7B1", schema_version: "1.1", type_definitions: [...] }
Reads the latest authorization model (note: this ignores the model id in configuration).
const { authorization_model: authorizationModel } = await fgaClient.readLatestAuthorizationModel();
// authorizationModel = { id: "01GXSA8YR785C4FYS3C0RTG7B1", schema_version: "1.1", type_definitions: [...] }
Reads the list of historical relationship tuple writes and deletes.
const type = 'document';
const startTime = "2022-01-01T00:00:00Z"
const options = {
pageSize: 25,
continuationToken: 'eyJwayI6IkxBVEVTVF9OU0NPTkZJR19hdXRoMHN0b3JlIiwic2siOiIxem1qbXF3MWZLZExTcUoyN01MdTdqTjh0cWgifQ==',
};
const response = await fgaClient.readChanges({ type, startTime }, options);
// response.continuation_token = ...
// response.changes = [
// { tuple_key: { user, relation, object }, operation: "writer", timestamp: ... },
// { tuple_key: { user, relation, object }, operation: "viewer", timestamp: ... }
// ]
Reads the relationship tuples stored in the database. It does not evaluate nor exclude invalid tuples according to the authorization model.
// Find if a relationship tuple stating that a certain user is a viewer of a certain document
const body = {
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "viewer",
object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a",
};
// Find all relationship tuples where a certain user has any relation to a certain document
const body = {
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a",
};
// Find all relationship tuples where a certain user is a viewer of any document
const body = {
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "viewer",
object: "document:",
};
// Find all relationship tuples where a certain user has any relation with any document
const body = {
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
object: "document:",
};
// Find all relationship tuples where any user has any relation with a particular document
const body = {
object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a",
};
// Read all stored relationship tuples
const body = {};
const { tuples } = await fgaClient.read(body);
// In all the above situations, the response will be of the form:
// tuples = [{ key: { user, relation, object }, timestamp: ... }]
Create and/or delete relationship tuples to update the system state.
By default, write runs in a transaction mode where any invalid operation (deleting a non-existing tuple, creating an existing tuple, one of the tuples was invalid) or a server error will fail the entire operation.
const options = {};
// To override the authorization model id for this request
options.authorizationModelId = "01GXSA8YR785C4FYS3C0RTG7B1";
await fgaClient.write({
writes: [{ user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b", relation: "viewer", object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a" }],
deletes: [{ user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b", relation: "editor", object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a" }],
}, options);
// Convenience functions are available
await fgaClient.writeTuples([{ user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b", relation: "viewer", object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a" }], options);
await fgaClient.deleteTuples([{ user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b", relation: "editor", object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a" }], options);
// if any error is encountered in the transaction mode, an error will be thrown
The SDK will split the writes into separate requests and send them in parallel chunks (default = 1 item per chunk, each chunk is a transaction).
// if you'd like to disable the transaction mode for writes (requests will be sent in parallel writes)
options.transaction = {
disable: true,
maxPerChunk: 1, // defaults to 1 - each chunk is a transaction (even in non-transaction mode)
maxParallelRequests: 10, // max requests to issue in parallel
};
const response = await fgaClient.write({
writes: [{ user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b", relation: "viewer", object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a" }],
deletes: [{ user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b", relation: "editor", object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a" }],
}, options);
/*
response = {
writes: [{ tuple_key: { user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b", relation: "viewer", object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a", status: "success" } }],
deletes: [{ tuple_key: { user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b", relation: "editor", object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a", status: "failure", err: <FgaError ...> } }],
};
*/
The SDK supports conflict options for write operations, allowing you to control how the API handles duplicate writes and missing deletes.
Note: This requires OpenFGA v1.10.0 or later.
const options = {
conflict: {
// Control what happens when writing a tuple that already exists
onDuplicateWrites: ClientWriteRequestOnDuplicateWrites.Ignore, // or ClientWriteRequestOnDuplicateWrites.Error (the current default behavior)
// Control what happens when deleting a tuple that doesn't exist
onMissingDeletes: ClientWriteRequestOnMissingDeletes.Ignore, // or ClientWriteRequestOnMissingDeletes.Error (the current default behavior)
}
};
const body = {
writes: [{
user: 'user:anne',
relation: 'writer',
object: 'document:2021-budget',
}],
deletes: [{
user: 'user:bob',
relation: 'reader',
object: 'document:2021-budget',
}],
};
const response = await fgaClient.write(body, options);
const tuples = [{
user: 'user:anne',
relation: 'writer',
object: 'document:2021-budget',
}];
const options = {
conflict: {
onDuplicateWrites: ClientWriteRequestOnDuplicateWrites.Ignore,
}
};
const response = await fgaClient.writeTuples(tuples, options);
const tuples = [{
user: 'user:bob',
relation: 'reader',
object: 'document:2021-budget',
}];
const options = {
conflict: {
onMissingDeletes: OnMissingDelete.Ignore,
}
};
const response = await fgaClient.deleteTuples(tuples, options);
onDuplicateWrites:
ClientWriteRequestOnDuplicateWrites.Error (default): Returns an error if an identical tuple already exists (matching on user, relation, object, and condition)ClientWriteRequestOnDuplicateWrites.Ignore: Treats duplicate writes as no-ops, allowing idempotent write operationsonMissingDeletes:
ClientWriteRequestOnMissingDeletes.Error (default): Returns an error when attempting to delete a tuple that doesn't existClientWriteRequestOnMissingDeletes.Ignore: Treats deletes of non-existent tuples as no-ops, allowing idempotent delete operationsImportant: If a Write request contains both idempotent (ignore) and non-idempotent (error) operations, the most restrictive action (error) will take precedence. If a condition fails for a sub-request with an error flag, the entire transaction will be rolled back.
Check if a user has a particular relation with an object.
const options = {
// if you'd like to override the authorization model id for this request
authorizationModelId: "01GXSA8YR785C4FYS3C0RTG7B1",
};
const result = await fgaClient.check({
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "viewer",
object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a",
}, options);
// result = { allowed: true }
Similar to check, but instead of checking a single user-object relationship, accepts a list of relationships to check. Requires OpenFGA version 1.8.0 or greater.
Note: The order of
batchCheckresults is not guaranteed to match the order of the checks provided. UsecorrelationIdto pair responses with requests.
const options = {
// if you'd like to override the authorization model id for this request
authorizationModelId: "01GXSA8YR785C4FYS3C0RTG7B1",
}
const corrId = randomUUID();
const { result } = await fgaClient.batchCheck({
checks: [
{
// should have access
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "viewer",
object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a",
context: {
ViewCount: 100
},
// optional correliationId to associate request and response. One will be generated
// if not provided
correlationId: corrId,
},
{
// should NOT have access
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "viewer",
object: "document:7772ab2a-d83f-756d-9397-c5ed9f3cb888",
}
]
}, options);
const userAllowed = result.filter(r => r.correlationId === corrId);
console.log(`User is allowed access to ${userAllowed.length} documents`);
userAllowed.forEach(item => {
console.log(`User is allowed access to ${item.request.object}`);
});
/*
{
"result": [
{
"allowed": true,
"request": {
"user": "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
"relation": "viewer",
"object": "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a",
"correlationId": "4187674b-0ec0-4ed5-abb5-327bd21c89a3"
},
"correlationId": "4187674b-0ec0-4ed5-abb5-327bd21c89a3"
},
{
"allowed": true,
"request": {
"user": "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
"relation": "viewer",
"object": "document:7772ab2a-d83f-756d-9397-c5ed9f3cb888",
"context": {
"ViewCount": 100
},
"correlationId": "5874b4fb-10f1-4e0c-ae32-559220b06dc8"
},
"correlationId": "5874b4fb-10f1-4e0c-ae32-559220b06dc8"
}
]
}
*/
If you are using an OpenFGA version less than 1.8.0, you can use the clientBatchCheck function,
which calls check in parallel. It will return allowed: false if it encounters an error, and will return the error in the body.
If 429s or 5xxs are encountered, the underlying check will retry up to 3 times before giving up.
const { responses } = await fgaClient.clientBatchCheck([{
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "viewer",
object: "document:0192ab2d-d36e-7cb3-a4a8-5d1d67a300c5",
}, {
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "member",
object: "document:0192ab2d-d36e-7cb3-a4a8-5d1d67a300c5",
}, {
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "viewer",
object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a",
contextualTuples: [{
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "writer",
object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a"
}],
}], options);
/*
result = [{
allowed: false,
_request: {
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "viewer",
object: "document:0192ab2d-d36e-7cb3-a4a8-5d1d67a300c5",
}
}, {
allowed: false,
_request: {
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "member",
object: "document:0192ab2d-d36e-7cb3-a4a8-5d1d67a300c5",
},
err: <FgaError ...>
}, {
allowed: true,
_request: {
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "viewer",
object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a",
contextualTuples: [{
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "writer",
object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a"
}],
}},
]
*/
Expands the relationships in userset tree format.
const options = {};
// To override the authorization model id for this request
options.authorizationModelId = "01GXSA8YR785C4FYS3C0RTG7B1";
const { tree } = await fgaClient.expand({
relation: "viewer",
object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a",
}, options);
// tree = { root: { name: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a#viewer", leaf: { users: { users: ["user:81684243-9356-4421-8fbf-a4f8d36aa31b", "user:f52a4f7a-054d-47ff-bb6e-3ac81269988f"] } } } }
List the objects of a particular type that the user has a certain relation to.
const options = {};
// To override the authorization model id for this request
options.authorizationModelId = "01GXSA8YR785C4FYS3C0RTG7B1";
const response = await fgaClient.listObjects({
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "viewer",
type: "document",
contextualTuples: [{
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "writer",
object: "document:0192ab2d-d36e-7cb3-a4a8-5d1d67a300c5"
}],
}, options);
// response.objects = ["document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a"]
List objects of a particular type that the user has access to, using the streaming API.
The Streamed ListObjects API is very similar to the ListObjects API, with two key differences:
This is particularly useful when querying computed relations that may return large result sets.
const options = {};
// To override the authorization model id for this request
options.authorizationModelId = "01GXSA8YR785C4FYS3C0RTG7B1";
const objects = [];
for await (const response of fgaClient.streamedListObjects(
{ user: "user:anne", relation: "can_read", type: "document" },
{ consistency: ConsistencyPreference.HigherConsistency }
)) {
objects.push(response.object);
}
// objects = ["document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a"]
List the relations a user has with an object. This wraps around BatchCheck to allow checking multiple relationships at once.
Note: Any error encountered when checking any relation will be treated as allowed: false;
const options = {};
// To override the authorization model id for this request
options.authorization_model_id = "1uHxCSuTP0VKPYSnkq1pbb1jeZw";
const response = await fgaClient.listRelations({
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a",
relations: ["can_view", "can_edit", "can_delete"],
contextualTuples: [{
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "writer",
object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a"
}],
}, options);
// response.relations = ["can_view", "can_edit"]
List the users who have a certain relation to a particular type.
const options = {};
// To override the authorization model id for this request
options.authorization_model_id = "1uHxCSuTP0VKPYSnkq1pbb1jeZw";
// Only a single filter is allowed for the time being
const userFilters = [{type: "user"}];
// user filters can also be of the form
// const userFilters = [{type: "team", relation: "member"}];
const response = await fgaClient.listUsers({
object: {
type: "document",
id: "roadmap"
},
relation: "can_read",
user_filters: userFilters,
context: {
"view_count": 100
},
contextualTuples:
[{
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "editor",
object: "folder:product"
}, {
user: "folder:product",
relation: "parent",
object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a"
}]
}, options);
// response.users = [{object: {type: "user", id: "81684243-9356-4421-8fbf-a4f8d36aa31b"}}, {userset: { type: "user" }}, ...]
Read assertions for a particular authorization model.
const options = {};
// To override the authorization model id for this request
options.authorizationModelId = "01GXSA8YR785C4FYS3C0RTG7B1";
const response = await fgaClient.readAssertions(options);
/*
response.assertions = [{
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "viewer",
object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a",
expectation: true,
}];
*/
Update the assertions for a particular authorization model.
const options = {};
// To override the authorization model id for this request
options.authorizationModelId = "01GXSA8YR785C4FYS3C0RTG7B1";
const response = await fgaClient.writeAssertions([{
user: "user:81684243-9356-4421-8fbf-a4f8d36aa31b",
relation: "viewer",
object: "document:0192ab2a-d83f-756d-9397-c5ed9f3cb69a",
expectation: true,
}], options);
In certain cases you may want to call other APIs not yet wrapped by the SDK. You can do so by using the executeApiRequest method available on the OpenFgaClient. It allows you to make raw HTTP calls to any OpenFGA endpoint by specifying the HTTP method, path, body, query parameters, and path parameters, while still honoring the client configuration (authentication, telemetry, retries, and error handling).
For streaming endpoints, use executeStreamedApiRequest instead.
This is useful when:
const { OpenFgaClient } = require('@openfga/sdk');
const fgaClient = new OpenFgaClient({
apiUrl: process.env.FGA_API_URL,
storeId: process.env.FGA_STORE_ID,
});
// Call a custom endpoint using path parameters
const response = await fgaClient.executeApiRequest({
operationName: 'CustomEndpoint', // For telemetry/logging
method: 'POST',
path: '/stores/{store_id}/custom-endpoint',
pathParams: { store_id: process.env.FGA_STORE_ID },
body: {
user: 'user:bob',
action: 'custom_action',
resource: 'resource:123',
},
queryParams: {
page_size: 20,
},
});
console.log('Response:', response);
// Get a list of stores with query parameters
const stores = await fgaClient.executeApiRequest({
operationName: 'ListStores',
method: 'GET',
path: '/stores',
queryParams: {
page_size: 10,
continuation_token: 'eyJwayI6...',
},
});
console.log('Stores:', stores);
Path parameters are specified in the path using {param_name} syntax and are replaced with URL-encoded values from the pathParams object:
const response = await fgaClient.executeApiRequest({
operationName: 'GetAuthorizationModel',
method: 'GET',
path: '/stores/{store_id}/authorization-models/{model_id}',
pathParams: {
store_id: 'your-store-id',
model_id: 'your-model-id',
},
});
If a network request fails with a 429 or 5xx error from the server, the SDK will automatically retry the request up to 3 times with a minimum wait time of 100 milliseconds between each attempt.
To customize this behavior, create an object with maxRetry and minWaitInMs properties. maxRetry determines the maximum number of retries (up to 15), while minWaitInMs sets the minimum wait time between retries in milliseconds.
Apply your custom retry values by setting to retryParams on the configuration object passed to the OpenFgaClient call.
const { OpenFgaClient } = require('@openfga/sdk'); // OR import { OpenFgaClient } from '@openfga/sdk';
const fgaClient = new OpenFgaClient({
apiUrl: process.env.FGA_API_URL, // required
storeId: process.env.FGA_STORE_ID, // not needed when calling `CreateStore` or `ListStores`
authorizationModelId: process.env.FGA_MODEL_ID, // Optional, can be overridden per request
retryParams: {
maxRetry: 3, // retry up to 3 times on API requests
minWaitInMs: 250 // wait a minimum of 250 milliseconds between requests
}
});
| Method | HTTP request | Description |
|---|---|---|
| ListStores | GET /stores | List all stores |
| CreateStore | POST /stores | Create a store |
| GetStore | GET /stores/{store_id} | Get a store |
| DeleteStore | DELETE /stores/{store_id} | Delete a store |
| ReadAuthorizationModels | GET /stores/{store_id}/authorization-models | Return all the authorization models for a particular store |
| WriteAuthorizationModel | POST /stores/{store_id}/authorization-models | Create a new authorization model |
| ReadAuthorizationModel | GET /stores/{store_id}/authorization-models/{id} | Return a particular version of an authorization model |
| ReadChanges | GET /stores/{store_id}/changes | Return a list of all the tuple changes |
| Read | POST /stores/{store_id}/read | Get tuples from the store that matches a query, without following userset rewrite rules |
| Write | POST /stores/{store_id}/write | Add or delete tuples from the store |
| Check | POST /stores/{store_id}/check | Check whether a user is authorized to access an object |
| BatchCheck | POST /stores/{store_id}/batch-check | Similar to check, but accepts a list of relations to check |
| Expand | POST /stores/{store_id}/expand | Expand all relationships in userset tree format, and following userset rewrite rules. Useful to reason about and debug a certain relationship |
| ListObjects | POST /stores/{store_id}/list-objects | [EXPERIMENTAL] Get all objects of the given type that the user has a relation with |
| ReadAssertions | GET /stores/{store_id}/assertions/{authorization_model_id} | Read assertions for an authorization model ID |
| WriteAssertions | PUT /stores/{store_id}/assertions/{authorization_model_id} | Upsert assertions for an authorization model ID |
This SDK supports producing metrics that can be consumed as part of an OpenTelemetry setup. For more information, please see the documentation
See CONTRIBUTING for details.
This project is licensed under the Apache-2.0 license. See the LICENSE file for more info.
The code in this repo was auto generated by OpenAPI Generator from a template based on the typescript-axios template and go template, licensed under the Apache License 2.0.
FAQs
JavaScript and Node.js SDK for OpenFGA
The npm package @openfga/sdk receives a total of 89,176 weekly downloads. As such, @openfga/sdk popularity was classified as popular.
We found that @openfga/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.