Retrieve all subjects (users and user sets) that have a relationship or attribute with given entity and permissionExpand API response is represented by a user set tree, whose leaf nodes are user IDs or user sets pointing to other ⟨object#relation⟩ pairs.
Expand is designed for reasoning the complete set of users that have access to their objects, which allows our users to build efficient search indices for access-controlled content.It is not designed to use as a check access. Expand request has a high latency which can cause a performance issues when its used as access check.
Identifier of the tenant, if you are not using multi-tenancy (have only one tenant) use pre-inserted tenant t1 for this field. Required, and must match the pattern \“[a-zA-Z0-9-,]+\“, max 64 bytes.
Body
application/json
PermissionExpandRequest is the request message for the Expand method in the Permission service.
Expand is used to define a hierarchical structure for permissions.
It has an entity, permission, and arguments. The node can be either another hierarchical structure or a set of subjects.
Show child attributes
{"docsConfig":{"theme":"mint","$schema":"https://mintlify.com/docs.json","name":"FGA Documentation","colors":{"primary":"#F58320","light":"#fb923c","dark":"#ea580c"},"logo":{"light":"https://mintcdn.com/permify/s--v0P7cOOW3QatA/logo/light.svg?fit=max\u0026auto=format\u0026n=s--v0P7cOOW3QatA\u0026q=85\u0026s=35df6af816b704ec52d1461bb85c5057","dark":"https://mintcdn.com/permify/s--v0P7cOOW3QatA/logo/dark.svg?fit=max\u0026auto=format\u0026n=s--v0P7cOOW3QatA\u0026q=85\u0026s=3cba8f1833c1058096bf4924e49f8931","href":"/"},"favicon":"https://mintcdn.com/permify/s--v0P7cOOW3QatA/favicon.png?fit=max\u0026auto=format\u0026n=s--v0P7cOOW3QatA\u0026q=85\u0026s=f88a89d54d5d30758364ce67ba61ef7f","appearance":{"default":"light","strict":false},"background":{"color":{"light":"#ffffff","dark":"#0f172a"}},"navbar":{"links":[{"href":"/docs/","label":"FusionAuth Documentation"}]},"footer":{"socials":{"twitter":"https://twitter.com/getPermify","github":"https://github.com/Permify/permify","linkedin":"https://www.linkedin.com/company/permifyco"}},"fonts":{"heading":{"family":"Inter","weight":600},"body":{"family":"Inter","weight":400}},"integrations":{"ga4":{"measurementId":"G-BSRXWHBYR1"}},"styling":{"latex":false},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"permify","hasAudioNarration":false,"actualSubdomain":"permify","customDomains":["proxy-docs.permify.co"],"gitSource":{"type":"github","owner":"permify","repo":"permify","deployBranch":"master","contentDirectory":"docs","isPrivate":false,"mountPath":"","label":""},"entitlements":{},"buildId":"6aec9854981b8170d4f27079","clientVersion":"0.0.4088","searchFilterCounts":[{"language":"default","tag":"FGA Documentation","count":57},{"language":"default","tag":"API References","count":24},{"language":"default","tag":"Getting Started","count":12},{"language":"default","tag":"Setting Up","count":12},{"language":"default","tag":"Deployment","count":11},{"language":"default","tag":"Modeling Guides","count":10},{"language":"default","tag":"Permission Service","count":7},{"language":"default","tag":"Real World Examples","count":7},{"language":"default","tag":"Operations","count":6},{"language":"default","tag":"Use Cases","count":6}]},"assistantConfig":{},"basePath":"","hasChatPermissions":false,"hasWebMcpPermissions":false,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"rbac-expansion","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-metadata","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-serve","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"live-agents","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"comment-mode","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[{"filePath":"custom.css","content":"/* cyrillic-ext */\n@font-face {\n font-family: 'Inter';\n font-style: normal;\n font-weight: 100 900;\n font-display: swap;\n src: url(/_mintlify/assets/fonts/google/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2JL7SUc.woff2) format('woff2');\n unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;\n}\n/* cyrillic */\n@font-face {\n font-family: 'Inter';\n font-style: normal;\n font-weight: 100 900;\n font-display: swap;\n src: url(/_mintlify/assets/fonts/google/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2) format('woff2');\n unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;\n}\n/* greek-ext */\n@font-face {\n font-family: 'Inter';\n font-style: normal;\n font-weight: 100 900;\n font-display: swap;\n src: url(/_mintlify/assets/fonts/google/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2ZL7SUc.woff2) format('woff2');\n unicode-range: U+1F00-1FFF;\n}\n/* greek */\n@font-face {\n font-family: 'Inter';\n font-style: normal;\n font-weight: 100 900;\n font-display: swap;\n src: url(/_mintlify/assets/fonts/google/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1pL7SUc.woff2) format('woff2');\n unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;\n}\n/* vietnamese */\n@font-face {\n font-family: 'Inter';\n font-style: normal;\n font-weight: 100 900;\n font-display: swap;\n src: url(/_mintlify/assets/fonts/google/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2pL7SUc.woff2) format('woff2');\n unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;\n}\n/* latin-ext */\n@font-face {\n font-family: 'Inter';\n font-style: normal;\n font-weight: 100 900;\n font-display: swap;\n src: url(/_mintlify/assets/fonts/google/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa25L7SUc.woff2) format('woff2');\n unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C4, U+2113, U+2C60-2C7F, U+A720-A7FF;\n}\n/* latin */\n@font-face {\n font-family: 'Inter';\n font-style: normal;\n font-weight: 100 900;\n font-display: swap;\n src: url(/_mintlify/assets/fonts/google/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2) format('woff2');\n unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;\n}\n*,*::before,*::after{font-family:'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', system-ui, sans-serif!important}pre,code,kbd,samp,tt{font-family:'JetBrains Mono', 'Fira Code', 'Menlo', 'Monaco', 'Consolas', monospace!important}html:not(.dark) span#background-color{background:transparent!important}html:not(.dark){background-color:#ffffff!important;background-image:radial-gradient(768px at right top, rgba(199, 210, 254, 0.65) 0%, rgba(255, 255, 255, 1.0) 80%),\n linear-gradient(rgba(99, 102, 241, 0.4) 1px, transparent 1px),\n linear-gradient(90deg, rgba(99, 102, 241, 0.4) 1px, transparent 1px)!important;background-size:100% 30000px, 34px 34px, 34px 34px!important;background-position:0 0, 0 0, 0 0!important;background-repeat:no-repeat, repeat, repeat!important;background-attachment:local, local, local!important}:root{--fa-orange: #F58320;--fa-orange-light: #fb923c;--fa-orange-dark: #ea580c;--fa-slate-800: #1e293b;--fa-slate-700: #334155;--fa-slate-100: #F1F5F9;--fa-slate-200: #E2E8F0}#banner{background-color:var(--fa-slate-800)!important;color:#fff!important;border-bottom:2px solid var(--fa-orange)!important}#banner a{color:var(--fa-orange-light)!important;text-decoration:underline!important}#banner a:hover{color:#fff!important}#navbar{background-color:#0f172a!important;border-bottom:1px solid #334155!important}#navbar #navbar-transition{background-color:transparent!important}#navbar a{color:#e2e8f0!important}#navbar a:hover{color:var(--fa-orange-light)!important}#navbar li.navbar-link a{color:#ffffff!important;font-size:0.875rem!important;font-weight:600!important;letter-spacing:-0.01em!important;opacity:1!important}#navbar li.navbar-link a:hover{color:var(--fa-orange-light)!important}#navbar button{color:#94a3b8!important}#navbar button:hover{color:#e2e8f0!important}#navbar a[data-slot=\"context-menu-trigger\"]{display:inline-flex!important;align-items:center!important}#navbar a[data-slot=\"context-menu-trigger\"] img{height:3rem!important;width:auto!important;order:1}#navbar a[data-slot=\"context-menu-trigger\"]::before{content:\"/\";color:#64748b;font-size:1.5rem;font-weight:300;margin-left:0.75rem;margin-right:0.375rem;line-height:1;order:2}#navbar a[data-slot=\"context-menu-trigger\"]::after{content:\"FGA Docs\";color:#ffffff;font-size:1.5rem;font-weight:700;letter-spacing:-0.025em;line-height:1;order:3}[data-testid=\"sidebar\"] a[aria-current=\"page\"],aside a[aria-current=\"page\"]{border-left:3px solid var(--fa-orange)!important;color:var(--fa-orange-dark)!important;font-weight:600!important;background-color:rgba(245, 131, 32, 0.06)!important}[data-testid=\"sidebar\"] h3,aside h3{color:var(--fa-slate-800)!important;text-transform:uppercase!important;font-size:0.7rem!important;letter-spacing:0.06em!important;font-weight:700!important}:is(.dark) [data-testid=\"sidebar\"] h3,:is(.dark) aside h3{color:var(--fa-slate-200)!important}[data-testid=\"sidebar\"] a,aside a{color:var(--fa-slate-700)!important;transition:color 0.15s ease!important}[data-testid=\"sidebar\"] a:hover,aside a:hover{color:var(--fa-orange)!important}:is(.dark) [data-testid=\"sidebar\"] a,:is(.dark) aside a{color:#cbd5e1!important}:is(.dark) [data-testid=\"sidebar\"] a:hover,:is(.dark) aside a:hover{color:var(--fa-orange-light)!important}a[class*=\"Button\"],button[class*=\"primary\"],.cta-button,[data-testid=\"cta-button\"]{background-color:var(--fa-orange)!important;border-color:var(--fa-orange)!important;color:#fff!important;border-radius:6px!important;transition:background-color 0.15s ease!important}a[class*=\"Button\"]:hover,button[class*=\"primary\"]:hover,.cta-button:hover,[data-testid=\"cta-button\"]:hover{background-color:var(--fa-orange-dark)!important;border-color:var(--fa-orange-dark)!important}article a,.prose a,main a:not([class]){color:var(--fa-orange-dark)!important;text-decoration-color:rgba(245, 131, 32, 0.3)!important}article a:hover,.prose a:hover,main a:not([class]):hover{color:var(--fa-orange)!important;text-decoration-color:var(--fa-orange)!important}:is(.dark) article a,:is(.dark) .prose a,:is(.dark) main a:not([class]){color:var(--fa-orange-light)!important}[class*=\"anchor-card\"],[class*=\"AnchorCard\"]{border:1px solid var(--fa-slate-200)!important;border-radius:8px!important;transition:border-color 0.15s ease, box-shadow 0.15s ease!important}[class*=\"anchor-card\"]:hover,[class*=\"AnchorCard\"]:hover{border-color:var(--fa-orange)!important;box-shadow:0 2px 8px rgba(245, 131, 32, 0.12)!important}article h1,article h2,article h3,.prose h1,.prose h2,.prose h3{color:var(--fa-slate-800)!important}:is(.dark) article h1,:is(.dark) article h2,:is(.dark) article h3,:is(.dark) .prose h1,:is(.dark) .prose h2,:is(.dark) .prose h3{color:#f1f5f9!important}pre,code{border-radius:6px!important}pre{background-color:#1f273b!important}:is(.dark) pre{background-color:#00081a!important}:not(pre)>code{background-color:#f1f5f9!important;color:var(--fa-slate-800)!important;padding:0.15em 0.4em!important;border-radius:4px!important;font-size:0.875em!important}:is(.dark) :not(pre)>code{background-color:#1e293b!important;color:#e2e8f0!important}table th{background-color:var(--fa-slate-800)!important;color:#fff!important;font-weight:600!important}:is(.dark) table th{background-color:#0f172a!important}table tr:nth-child(even){background-color:rgba(241, 245, 249, 0.5)!important}:is(.dark) table tr:nth-child(even){background-color:rgba(30, 41, 59, 0.3)!important}[role=\"tab\"][aria-selected=\"true\"]{color:var(--fa-orange)!important;border-bottom-color:var(--fa-orange)!important}::-webkit-scrollbar{width:6px;height:6px}::-webkit-scrollbar-thumb{background:#94a3b8;border-radius:3px}::-webkit-scrollbar-track{background:transparent}::selection{background-color:rgba(245, 131, 32, 0.2);color:inherit}[class*=\"feedback\"] button:hover,[class*=\"Feedback\"] button:hover{color:var(--fa-orange)!important}[class*=\"badge\"],[class*=\"Badge\"]{border-radius:4px!important}mark,[class*=\"highlight\"]{background-color:rgba(245, 131, 32, 0.15)!important}[class*=\"Card\"],[class*=\"card\"]{border-radius:8px!important}"}],"page":{"pagePath":"api-reference/permission/expand-api","slug":"/api-reference/permission/expand-api","pageMetadata":{"title":"Expand API","openapi":"post /v1/tenants/{tenant_id}/permissions/expand","description":null,"href":"/api-reference/permission/expand-api"},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){const _components={p:`p`,..._provideComponents(),...props.components},{Warning}=_components;if(!Warning)_missingMdxReference(`Warning`,true);return _jsxs(_Fragment,{children:[_jsx(_components.p,{children:`Retrieve all subjects (users and user sets) that have a relationship or attribute with given entity and permission`}),`\n`,_jsx(_components.p,{children:`Expand API response is represented by a user set tree, whose leaf nodes are user IDs or user sets pointing to other ⟨object#relation⟩ pairs.`}),`\n`,_jsxs(Warning,{children:[_jsx(_components.p,{children:`Expand is designed for reasoning the complete set of users that have access to their objects, which allows our users to build efficient search indices for access-controlled content.`}),_jsx(_components.p,{children:`It is not designed to use as a check access. Expand request has a high latency which can cause a performance issues when its used as access check.`})]})]})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"Expand API","openapi":"post /v1/tenants/{tenant_id}/permissions/expand","description":null,"href":"/api-reference/permission/expand-api"}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":["/_mintlify/custom/permify/03abf5c771cc7674/gurubase.js"],"openApiReferenceData":{"operation":{"summary":"expand api","operationId":"permissions.expand","responses":{"200":"9797bbe7-82c9-4c28-a5e7-6a83ae02f540","default":"059fb9b0-de72-46d3-a32d-aca3dbd725e0"},"parameters":["66a5093b-f700-4f1d-b858-0cd9a815ea82"],"requestBody":"fbc50fe7-5b0f-4628-8eac-8465474b9159","tags":["Permission"],"x-codeSamples":[{"label":"go","lang":"go","source":"cr, err := client.Permission.Expand(context.Background(), \u0026v1.PermissionExpandRequest{\n TenantId: \"t1\",\n Metadata: \u0026v1.PermissionExpandRequestMetadata{\n SnapToken: \"\",\n SchemaVersion: \"\",\n },\n Entity: \u0026v1.Entity{\n Type: \"repository\",\n Id: \"1\",\n },\n Permission: \"push\",\n})"},{"label":"node","lang":"javascript","source":"client.permission.expand({\n tenantId: \"t1\",\n metadata: {\n snapToken: \"\",\n schemaVersion: \"\"\n },\n entity: {\n type: \"repository\",\n id: \"1\"\n },\n permission: \"push\",\n})"},{"label":"cURL","lang":"curl","source":"curl --location --request POST 'localhost:3476/v1/tenants/{tenant_id}/permissions/expand' \\\n--header 'Content-Type: application/json' \\\n--data-raw '{\n \"metadata\": {\n \"schema_version\": \"\",\n \"snap_token\": \"\"\n },\n \"entity\": {\n \"type\": \"repository\",\n \"id\": \"1\"\n },\n \"permission\": \"push\"\n}'"}],"method":"post","type":"path","servers":[],"security":[],"path":"/v1/tenants/{tenant_id}/permissions/expand","baseUrlOptions":[],"title":"expand api","description":"","codeSamples":[{"label":"go","lang":"go","source":"cr, err := client.Permission.Expand(context.Background(), \u0026v1.PermissionExpandRequest{\n TenantId: \"t1\",\n Metadata: \u0026v1.PermissionExpandRequestMetadata{\n SnapToken: \"\",\n SchemaVersion: \"\",\n },\n Entity: \u0026v1.Entity{\n Type: \"repository\",\n Id: \"1\",\n },\n Permission: \"push\",\n})"},{"label":"node","lang":"javascript","source":"client.permission.expand({\n tenantId: \"t1\",\n metadata: {\n snapToken: \"\",\n schemaVersion: \"\"\n },\n entity: {\n type: \"repository\",\n id: \"1\"\n },\n permission: \"push\",\n})"},{"label":"cURL","lang":"curl","source":"curl --location --request POST 'localhost:3476/v1/tenants/{tenant_id}/permissions/expand' \\\n--header 'Content-Type: application/json' \\\n--data-raw '{\n \"metadata\": {\n \"schema_version\": \"\",\n \"snap_token\": \"\"\n },\n \"entity\": {\n \"type\": \"repository\",\n \"id\": \"1\"\n },\n \"permission\": \"push\"\n}'"}],"requiredOnlyExamples":false,"requestExampleType":"codeSamples","responseExampleType":"generated"},"dependencies":{"parameters":{"66a5093b-f700-4f1d-b858-0cd9a815ea82":{"name":"tenant_id","description":"Identifier of the tenant, if you are not using multi-tenancy (have only one tenant) use pre-inserted tenant \u003ccode>t1\u003c/code> for this field. Required, and must match the pattern \\“[a-zA-Z0-9-,]+\\“, max 64 bytes.","in":"path","required":true,"schema":{"type":"string","isRequired":true,"description":"Identifier of the tenant, if you are not using multi-tenancy (have only one tenant) use pre-inserted tenant \u003ccode>t1\u003c/code> for this field. Required, and must match the pattern \\“[a-zA-Z0-9-,]+\\“, max 64 bytes.","uniqueKey":"","typeLabel":"string"}}},"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"metadata":{"type":"object","properties":{"schema_version":{"type":"string","description":"Version of the schema.","uniqueKey":"metadata.schema_version","typeLabel":"string"},"snap_token":{"type":"string","description":"The snap token to avoid stale cache, see more details on [Snap Tokens](../../operations/snap-tokens).","uniqueKey":"metadata.snap_token","typeLabel":"string"}},"description":"PermissionExpandRequestMetadata metadata for the PermissionExpandRequest.","uniqueKey":"metadata","typeLabel":"object"},"entity":{"type":"object","properties":{"type":{"type":"string","uniqueKey":"entity.type","typeLabel":"string"},"id":{"type":"string","uniqueKey":"entity.id","typeLabel":"string"}},"description":"Entity represents an entity with a type and an identifier.","uniqueKey":"entity","typeLabel":"object"},"permission":{"type":"string","description":"Name of the permission to be expanded, not required, must start with a letter and can include alphanumeric and underscore, max 64 bytes.","uniqueKey":"permission","typeLabel":"string"},"context":{"type":"object","properties":{"tuples":{"type":"array","items":{"type":"object","properties":{"entity":{"type":"object","properties":{"type":{"type":"string","uniqueKey":"context.tuples.items.[INDEX].entity.type","typeLabel":"string"},"id":{"type":"string","uniqueKey":"context.tuples.items.[INDEX].entity.id","typeLabel":"string"}},"description":"Entity represents an entity with a type and an identifier.","uniqueKey":"context.tuples.items.[INDEX].entity","typeLabel":"object"},"relation":{"type":"string","uniqueKey":"context.tuples.items.[INDEX].relation","typeLabel":"string"},"subject":{"type":"object","properties":{"type":{"type":"string","uniqueKey":"context.tuples.items.[INDEX].subject.type","typeLabel":"string"},"id":{"type":"string","uniqueKey":"context.tuples.items.[INDEX].subject.id","typeLabel":"string"},"relation":{"type":"string","uniqueKey":"context.tuples.items.[INDEX].subject.relation","typeLabel":"string"}},"description":"Subject represents an entity subject with a type, an identifier, and a relation.","uniqueKey":"context.tuples.items.[INDEX].subject","typeLabel":"object"}},"description":"Tuple is a structure that includes an entity, a relation, and a subject.","uniqueKey":"context.tuples.items.[INDEX]","typeLabel":"object"},"description":"A repeated field of tuples involved in the operation.","uniqueKey":"context.tuples","typeLabel":"object[]"},"attributes":{"type":"array","items":{"type":"object","properties":{"entity":{"type":"object","properties":{"type":{"type":"string","uniqueKey":"context.attributes.items.[INDEX].entity.type","typeLabel":"string"},"id":{"type":"string","uniqueKey":"context.attributes.items.[INDEX].entity.id","typeLabel":"string"}},"description":"Entity represents an entity with a type and an identifier.","uniqueKey":"context.attributes.items.[INDEX].entity","typeLabel":"object"},"attribute":{"type":"string","title":"Name of the attribute","uniqueKey":"context.attributes.items.[INDEX].attribute","typeLabel":"string"},"value":{"type":"object","properties":{"@type":{"type":"string","description":"Identifies the type of the serialized Protobuf message with a URI reference\nconsisting of a prefix ending in a slash and the fully-qualified type name.\n\nExample: type.googleapis.com/google.protobuf.StringValue\n\nThis string must contain at least one `/` character, and the content after\nthe last `/` must be the fully-qualified name of the type in canonical\nform, without a leading dot. Do not write a scheme on these URI references\nso that clients do not attempt to contact them.\n\nThe prefix is arbitrary and Protobuf implementations are expected to\nsimply strip off everything up to and including the last `/` to identify\nthe type. `type.googleapis.com/` is a common default prefix that some\nlegacy implementations require. This prefix does not indicate the origin of\nthe type, and URIs containing it are not expected to respond to any\nrequests.\n\nAll type URL strings must be legal URI references with the additional\nrestriction (for the text format) that the content of the reference\nmust consist only of alphanumeric characters, percent-encoded escapes, and\ncharacters in the following set (not including the outer backticks):\n`/-.~_!$\u0026()*+,;=`. Despite our allowing percent encodings, implementations\nshould not unescape them to prevent confusion with existing parsers. For\nexample, `type.googleapis.com%2FFoo` should be rejected.\n\nIn the original design of `Any`, the possibility of launching a type\nresolution service at these type URLs was considered but Protobuf never\nimplemented one and considers contacting these URLs to be problematic and\na potential security issue. Do not attempt to contact type URLs.","uniqueKey":"context.attributes.items.[INDEX].value.@type","typeLabel":"string"}},"additionalProperties":{"oneOf":[{}],"uniqueKey":"context.attributes.items.[INDEX].value.additionalProperties","typeLabel":"any"},"description":"`Any` contains an arbitrary serialized protocol buffer message along with a\nURL that describes the type of the serialized message.\n\nIn its binary encoding, an `Any` is an ordinary message; but in other wire\nforms like JSON, it has a special encoding. The format of the type URL is\ndescribed on the `type_url` field.\n\nProtobuf APIs provide utilities to interact with `Any` values:\n\n- A 'pack' operation accepts a message and constructs a generic `Any` wrapper\n around it.\n- An 'unpack' operation reads the content of an `Any` message, either into an\n existing message or a new one. Unpack operations must check the type of the\n value they unpack against the declared `type_url`.\n- An 'is' operation decides whether an `Any` contains a message of the given\n type, i.e. whether it can 'unpack' that type.\n\nThe JSON format representation of an `Any` follows one of these cases:\n\n- For types without special-cased JSON encodings, the JSON format\n representation of the `Any` is the same as that of the message, with an\n additional `@type` field which contains the type URL.\n- For types with special-cased JSON encodings (typically called 'well-known'\n types, listed in https://protobuf.dev/programming-guides/json/#any), the\n JSON format representation has a key `@type` which contains the type URL\n and a key `value` which contains the JSON-serialized value.\n\nThe text format representation of an `Any` is like a message with one field\nwhose name is the type URL in brackets. For example, an `Any` containing a\n`foo.Bar` message may be written `[type.googleapis.com/foo.Bar] { a: 2 }`.","uniqueKey":"context.attributes.items.[INDEX].value","typeLabel":"object"}},"description":"Attribute represents an attribute of an entity with a specific type and value.","uniqueKey":"context.attributes.items.[INDEX]","typeLabel":"object"},"description":"A repeated field of attributes associated with the operation.","uniqueKey":"context.attributes","typeLabel":"object[]"},"data":{"type":"object","description":"Additional data associated with the context.","uniqueKey":"context.data","typeLabel":"object"}},"description":"Context encapsulates the information related to a single operation,\nincluding the tuples involved and the associated attributes.","uniqueKey":"context","typeLabel":"object"},"arguments":{"type":"array","items":{"type":"object","properties":{"computedAttribute":{"type":"object","properties":{"name":{"type":"string","title":"Name of the computed attribute","uniqueKey":"arguments.items.[INDEX].computedAttribute.name","typeLabel":"string"}},"description":"ComputedAttribute defines a computed attribute which includes its name.","uniqueKey":"arguments.items.[INDEX].computedAttribute","typeLabel":"object"}},"description":"Argument defines the type of argument in a Call. It can be either a ComputedAttribute or a ContextAttribute.","uniqueKey":"arguments.items.[INDEX]","typeLabel":"object"},"description":"Additional arguments associated with this request.","uniqueKey":"arguments","typeLabel":"object[]"}},"description":"PermissionExpandRequest is the request message for the Expand method in the Permission service.","uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"metadata":{"schema_version":"\u003cstring>","snap_token":"\u003cstring>"},"entity":{"type":"\u003cstring>","id":"\u003cstring>"},"permission":"\u003cstring>","context":{"tuples":[{"entity":{"type":"\u003cstring>","id":"\u003cstring>"},"relation":"\u003cstring>","subject":{"type":"\u003cstring>","id":"\u003cstring>","relation":"\u003cstring>"}}],"attributes":[{"entity":{"type":"\u003cstring>","id":"\u003cstring>"},"attribute":"\u003cstring>","value":{"@type":"\u003cstring>"}}],"data":{}},"arguments":[{"computedAttribute":{"name":"\u003cstring>"}}]}}},"exampleType":"generated"}},"required":true,"exampleType":"generated"},"responses":{"9797bbe7-82c9-4c28-a5e7-6a83ae02f540":{"description":"A successful response.","content":{"application/json":{"schema":{"type":"object","properties":{"tree":{"type":"object","properties":{"entity":{"type":"object","properties":{"type":{"type":"string","uniqueKey":"tree.entity.type","typeLabel":"string"},"id":{"type":"string","uniqueKey":"tree.entity.id","typeLabel":"string"}},"description":"Entity represents an entity with a type and an identifier.","uniqueKey":"tree.entity","typeLabel":"object"},"permission":{"type":"string","description":"permission is the permission applied to the entity.","uniqueKey":"tree.permission","typeLabel":"string"},"arguments":{"type":"array","items":{"type":"object","properties":{"computedAttribute":{"type":"object","properties":{"name":{"type":"string","title":"Name of the computed attribute","uniqueKey":"tree.arguments.items.[INDEX].computedAttribute.name","typeLabel":"string"}},"description":"ComputedAttribute defines a computed attribute which includes its name.","uniqueKey":"tree.arguments.items.[INDEX].computedAttribute","typeLabel":"object"}},"description":"Argument defines the type of argument in a Call. It can be either a ComputedAttribute or a ContextAttribute.","uniqueKey":"tree.arguments.items.[INDEX]","typeLabel":"object"},"description":"arguments are the additional information or context used to evaluate permissions.","uniqueKey":"tree.arguments","typeLabel":"object[]"},"expand":{"type":"object","properties":{"operation":{"type":"string","enum":["OPERATION_UNSPECIFIED","OPERATION_UNION","OPERATION_INTERSECTION","OPERATION_EXCLUSION"],"default":"OPERATION_UNSPECIFIED","description":"Operation is an enum representing the type of operation to be applied on the tree node.","uniqueKey":"tree.expand.operation","typeLabel":"enum\u003cstring>"},"children":{"type":"array","items":{"$circularRef":"038e65b9-3874-4b80-8481-b64e8279e156"},"title":"The children of this tree node","uniqueKey":"tree.expand.children","typeLabel":"The children of this tree node · array"}},"description":"ExpandTreeNode represents a node in an expansion tree with a specific operation and its children.","uniqueKey":"tree.expand","typeLabel":"object"},"leaf":{"type":"object","properties":{"subjects":{"type":"object","properties":{"subjects":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string","uniqueKey":"tree.leaf.subjects.subjects.items.[INDEX].type","typeLabel":"string"},"id":{"type":"string","uniqueKey":"tree.leaf.subjects.subjects.items.[INDEX].id","typeLabel":"string"},"relation":{"type":"string","uniqueKey":"tree.leaf.subjects.subjects.items.[INDEX].relation","typeLabel":"string"}},"description":"Subject represents an entity subject with a type, an identifier, and a relation.","uniqueKey":"tree.leaf.subjects.subjects.items.[INDEX]","typeLabel":"object"},"description":"A list of subjects.","uniqueKey":"tree.leaf.subjects.subjects","typeLabel":"object[]"}},"description":"Subjects holds a repeated field of Subject type.","uniqueKey":"tree.leaf.subjects","typeLabel":"object"},"values":{"type":"object","properties":{"values":{"type":"object","additionalProperties":{"type":"object","properties":{"@type":{"type":"string","description":"Identifies the type of the serialized Protobuf message with a URI reference\nconsisting of a prefix ending in a slash and the fully-qualified type name.\n\nExample: type.googleapis.com/google.protobuf.StringValue\n\nThis string must contain at least one `/` character, and the content after\nthe last `/` must be the fully-qualified name of the type in canonical\nform, without a leading dot. Do not write a scheme on these URI references\nso that clients do not attempt to contact them.\n\nThe prefix is arbitrary and Protobuf implementations are expected to\nsimply strip off everything up to and including the last `/` to identify\nthe type. `type.googleapis.com/` is a common default prefix that some\nlegacy implementations require. This prefix does not indicate the origin of\nthe type, and URIs containing it are not expected to respond to any\nrequests.\n\nAll type URL strings must be legal URI references with the additional\nrestriction (for the text format) that the content of the reference\nmust consist only of alphanumeric characters, percent-encoded escapes, and\ncharacters in the following set (not including the outer backticks):\n`/-.~_!$\u0026()*+,;=`. Despite our allowing percent encodings, implementations\nshould not unescape them to prevent confusion with existing parsers. For\nexample, `type.googleapis.com%2FFoo` should be rejected.\n\nIn the original design of `Any`, the possibility of launching a type\nresolution service at these type URLs was considered but Protobuf never\nimplemented one and considers contacting these URLs to be problematic and\na potential security issue. Do not attempt to contact type URLs.","uniqueKey":"tree.leaf.values.values.additionalProperties.@type","typeLabel":"string"}},"additionalProperties":{"oneOf":[{}],"uniqueKey":"tree.leaf.values.values.additionalProperties.additionalProperties","typeLabel":"any"},"description":"`Any` contains an arbitrary serialized protocol buffer message along with a\nURL that describes the type of the serialized message.\n\nIn its binary encoding, an `Any` is an ordinary message; but in other wire\nforms like JSON, it has a special encoding. The format of the type URL is\ndescribed on the `type_url` field.\n\nProtobuf APIs provide utilities to interact with `Any` values:\n\n- A 'pack' operation accepts a message and constructs a generic `Any` wrapper\n around it.\n- An 'unpack' operation reads the content of an `Any` message, either into an\n existing message or a new one. Unpack operations must check the type of the\n value they unpack against the declared `type_url`.\n- An 'is' operation decides whether an `Any` contains a message of the given\n type, i.e. whether it can 'unpack' that type.\n\nThe JSON format representation of an `Any` follows one of these cases:\n\n- For types without special-cased JSON encodings, the JSON format\n representation of the `Any` is the same as that of the message, with an\n additional `@type` field which contains the type URL.\n- For types with special-cased JSON encodings (typically called 'well-known'\n types, listed in https://protobuf.dev/programming-guides/json/#any), the\n JSON format representation has a key `@type` which contains the type URL\n and a key `value` which contains the JSON-serialized value.\n\nThe text format representation of an `Any` is like a message with one field\nwhose name is the type URL in brackets. For example, an `Any` containing a\n`foo.Bar` message may be written `[type.googleapis.com/foo.Bar] { a: 2 }`.","uniqueKey":"tree.leaf.values.values.additionalProperties","typeLabel":"object"},"uniqueKey":"tree.leaf.values.values","typeLabel":"object"}},"uniqueKey":"tree.leaf.values","typeLabel":"object"},"value":{"type":"object","properties":{"@type":{"type":"string","description":"Identifies the type of the serialized Protobuf message with a URI reference\nconsisting of a prefix ending in a slash and the fully-qualified type name.\n\nExample: type.googleapis.com/google.protobuf.StringValue\n\nThis string must contain at least one `/` character, and the content after\nthe last `/` must be the fully-qualified name of the type in canonical\nform, without a leading dot. Do not write a scheme on these URI references\nso that clients do not attempt to contact them.\n\nThe prefix is arbitrary and Protobuf implementations are expected to\nsimply strip off everything up to and including the last `/` to identify\nthe type. `type.googleapis.com/` is a common default prefix that some\nlegacy implementations require. This prefix does not indicate the origin of\nthe type, and URIs containing it are not expected to respond to any\nrequests.\n\nAll type URL strings must be legal URI references with the additional\nrestriction (for the text format) that the content of the reference\nmust consist only of alphanumeric characters, percent-encoded escapes, and\ncharacters in the following set (not including the outer backticks):\n`/-.~_!$\u0026()*+,;=`. Despite our allowing percent encodings, implementations\nshould not unescape them to prevent confusion with existing parsers. For\nexample, `type.googleapis.com%2FFoo` should be rejected.\n\nIn the original design of `Any`, the possibility of launching a type\nresolution service at these type URLs was considered but Protobuf never\nimplemented one and considers contacting these URLs to be problematic and\na potential security issue. Do not attempt to contact type URLs.","uniqueKey":"tree.leaf.value.@type","typeLabel":"string"}},"additionalProperties":{"oneOf":[{}],"uniqueKey":"tree.leaf.value.additionalProperties","typeLabel":"any"},"description":"`Any` contains an arbitrary serialized protocol buffer message along with a\nURL that describes the type of the serialized message.\n\nIn its binary encoding, an `Any` is an ordinary message; but in other wire\nforms like JSON, it has a special encoding. The format of the type URL is\ndescribed on the `type_url` field.\n\nProtobuf APIs provide utilities to interact with `Any` values:\n\n- A 'pack' operation accepts a message and constructs a generic `Any` wrapper\n around it.\n- An 'unpack' operation reads the content of an `Any` message, either into an\n existing message or a new one. Unpack operations must check the type of the\n value they unpack against the declared `type_url`.\n- An 'is' operation decides whether an `Any` contains a message of the given\n type, i.e. whether it can 'unpack' that type.\n\nThe JSON format representation of an `Any` follows one of these cases:\n\n- For types without special-cased JSON encodings, the JSON format\n representation of the `Any` is the same as that of the message, with an\n additional `@type` field which contains the type URL.\n- For types with special-cased JSON encodings (typically called 'well-known'\n types, listed in https://protobuf.dev/programming-guides/json/#any), the\n JSON format representation has a key `@type` which contains the type URL\n and a key `value` which contains the JSON-serialized value.\n\nThe text format representation of an `Any` is like a message with one field\nwhose name is the type URL in brackets. For example, an `Any` containing a\n`foo.Bar` message may be written `[type.googleapis.com/foo.Bar] { a: 2 }`.","uniqueKey":"tree.leaf.value","typeLabel":"object"}},"description":"ExpandLeaf is the leaf node of an Expand tree and can be either a set of Subjects or a set of Values.","uniqueKey":"tree.leaf","typeLabel":"object"}},"description":"Expand is used to define a hierarchical structure for permissions.\nIt has an entity, permission, and arguments. The node can be either another hierarchical structure or a set of subjects.","uniqueKey":"tree","typeLabel":"object"}},"description":"PermissionExpandResponse is the response message for the Expand method in the Permission service.","uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"tree":{"entity":{"type":"\u003cstring>","id":"\u003cstring>"},"permission":"\u003cstring>","arguments":[{"computedAttribute":{"name":"\u003cstring>"}}],"expand":{"operation":"OPERATION_UNSPECIFIED","children":"\u003carray>"},"leaf":{"subjects":{"subjects":[{"type":"\u003cstring>","id":"\u003cstring>","relation":"\u003cstring>"}]},"values":{"values":{}},"value":{"@type":"\u003cstring>"}}}}}},"exampleType":"generated"}},"exampleType":"generated"},"059fb9b0-de72-46d3-a32d-aca3dbd725e0":{"description":"An unexpected error response.","content":{"application/json":{"schema":{"type":"object","properties":{"code":{"type":"integer","format":"int32","uniqueKey":"code","typeLabel":"integer\u003cint32>"},"message":{"type":"string","uniqueKey":"message","typeLabel":"string"},"details":{"type":"array","items":{"type":"object","properties":{"@type":{"type":"string","description":"Identifies the type of the serialized Protobuf message with a URI reference\nconsisting of a prefix ending in a slash and the fully-qualified type name.\n\nExample: type.googleapis.com/google.protobuf.StringValue\n\nThis string must contain at least one `/` character, and the content after\nthe last `/` must be the fully-qualified name of the type in canonical\nform, without a leading dot. Do not write a scheme on these URI references\nso that clients do not attempt to contact them.\n\nThe prefix is arbitrary and Protobuf implementations are expected to\nsimply strip off everything up to and including the last `/` to identify\nthe type. `type.googleapis.com/` is a common default prefix that some\nlegacy implementations require. This prefix does not indicate the origin of\nthe type, and URIs containing it are not expected to respond to any\nrequests.\n\nAll type URL strings must be legal URI references with the additional\nrestriction (for the text format) that the content of the reference\nmust consist only of alphanumeric characters, percent-encoded escapes, and\ncharacters in the following set (not including the outer backticks):\n`/-.~_!$\u0026()*+,;=`. Despite our allowing percent encodings, implementations\nshould not unescape them to prevent confusion with existing parsers. For\nexample, `type.googleapis.com%2FFoo` should be rejected.\n\nIn the original design of `Any`, the possibility of launching a type\nresolution service at these type URLs was considered but Protobuf never\nimplemented one and considers contacting these URLs to be problematic and\na potential security issue. Do not attempt to contact type URLs.","uniqueKey":"details.items.[INDEX].@type","typeLabel":"string"}},"additionalProperties":{"oneOf":[{}],"uniqueKey":"details.items.[INDEX].additionalProperties","typeLabel":"any"},"description":"`Any` contains an arbitrary serialized protocol buffer message along with a\nURL that describes the type of the serialized message.\n\nIn its binary encoding, an `Any` is an ordinary message; but in other wire\nforms like JSON, it has a special encoding. The format of the type URL is\ndescribed on the `type_url` field.\n\nProtobuf APIs provide utilities to interact with `Any` values:\n\n- A 'pack' operation accepts a message and constructs a generic `Any` wrapper\n around it.\n- An 'unpack' operation reads the content of an `Any` message, either into an\n existing message or a new one. Unpack operations must check the type of the\n value they unpack against the declared `type_url`.\n- An 'is' operation decides whether an `Any` contains a message of the given\n type, i.e. whether it can 'unpack' that type.\n\nThe JSON format representation of an `Any` follows one of these cases:\n\n- For types without special-cased JSON encodings, the JSON format\n representation of the `Any` is the same as that of the message, with an\n additional `@type` field which contains the type URL.\n- For types with special-cased JSON encodings (typically called 'well-known'\n types, listed in https://protobuf.dev/programming-guides/json/#any), the\n JSON format representation has a key `@type` which contains the type URL\n and a key `value` which contains the JSON-serialized value.\n\nThe text format representation of an `Any` is like a message with one field\nwhose name is the type URL in brackets. For example, an `Any` containing a\n`foo.Bar` message may be written `[type.googleapis.com/foo.Bar] { a: 2 }`.","uniqueKey":"details.items.[INDEX]","typeLabel":"object"},"uniqueKey":"details","typeLabel":"object[]"}},"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"code":123,"message":"\u003cstring>","details":[{"@type":"\u003cstring>"}]}}},"exampleType":"generated"}},"exampleType":"generated"}},"security":{},"servers":{},"schemas":{"038e65b9-3874-4b80-8481-b64e8279e156":{"type":"object","properties":{"entity":{"type":"object","properties":{"type":{"type":"string"},"id":{"type":"string"}},"description":"Entity represents an entity with a type and an identifier."},"permission":{"type":"string","description":"permission is the permission applied to the entity."},"arguments":{"type":"array","items":{"type":"object","properties":{"computedAttribute":{"type":"object","properties":{"name":{"type":"string","title":"Name of the computed attribute"}},"description":"ComputedAttribute defines a computed attribute which includes its name."}},"description":"Argument defines the type of argument in a Call. It can be either a ComputedAttribute or a ContextAttribute."},"description":"arguments are the additional information or context used to evaluate permissions."},"expand":{"type":"object","properties":{"operation":{"type":"string","enum":["OPERATION_UNSPECIFIED","OPERATION_UNION","OPERATION_INTERSECTION","OPERATION_EXCLUSION"],"default":"OPERATION_UNSPECIFIED","description":"Operation is an enum representing the type of operation to be applied on the tree node."},"children":{"type":"array","items":{"$circularRef":"038e65b9-3874-4b80-8481-b64e8279e156"},"title":"The children of this tree node"}},"description":"ExpandTreeNode represents a node in an expansion tree with a specific operation and its children."},"leaf":{"type":"object","properties":{"subjects":{"type":"object","properties":{"subjects":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string"},"id":{"type":"string"},"relation":{"type":"string"}},"description":"Subject represents an entity subject with a type, an identifier, and a relation."},"description":"A list of subjects."}},"description":"Subjects holds a repeated field of Subject type."},"values":{"type":"object","properties":{"values":{"type":"object","additionalProperties":{"type":"object","properties":{"@type":{"type":"string","description":"Identifies the type of the serialized Protobuf message with a URI reference\nconsisting of a prefix ending in a slash and the fully-qualified type name.\n\nExample: type.googleapis.com/google.protobuf.StringValue\n\nThis string must contain at least one `/` character, and the content after\nthe last `/` must be the fully-qualified name of the type in canonical\nform, without a leading dot. Do not write a scheme on these URI references\nso that clients do not attempt to contact them.\n\nThe prefix is arbitrary and Protobuf implementations are expected to\nsimply strip off everything up to and including the last `/` to identify\nthe type. `type.googleapis.com/` is a common default prefix that some\nlegacy implementations require. This prefix does not indicate the origin of\nthe type, and URIs containing it are not expected to respond to any\nrequests.\n\nAll type URL strings must be legal URI references with the additional\nrestriction (for the text format) that the content of the reference\nmust consist only of alphanumeric characters, percent-encoded escapes, and\ncharacters in the following set (not including the outer backticks):\n`/-.~_!$\u0026()*+,;=`. Despite our allowing percent encodings, implementations\nshould not unescape them to prevent confusion with existing parsers. For\nexample, `type.googleapis.com%2FFoo` should be rejected.\n\nIn the original design of `Any`, the possibility of launching a type\nresolution service at these type URLs was considered but Protobuf never\nimplemented one and considers contacting these URLs to be problematic and\na potential security issue. Do not attempt to contact type URLs."}},"additionalProperties":{"oneOf":[{}]},"description":"`Any` contains an arbitrary serialized protocol buffer message along with a\nURL that describes the type of the serialized message.\n\nIn its binary encoding, an `Any` is an ordinary message; but in other wire\nforms like JSON, it has a special encoding. The format of the type URL is\ndescribed on the `type_url` field.\n\nProtobuf APIs provide utilities to interact with `Any` values:\n\n- A 'pack' operation accepts a message and constructs a generic `Any` wrapper\n around it.\n- An 'unpack' operation reads the content of an `Any` message, either into an\n existing message or a new one. Unpack operations must check the type of the\n value they unpack against the declared `type_url`.\n- An 'is' operation decides whether an `Any` contains a message of the given\n type, i.e. whether it can 'unpack' that type.\n\nThe JSON format representation of an `Any` follows one of these cases:\n\n- For types without special-cased JSON encodings, the JSON format\n representation of the `Any` is the same as that of the message, with an\n additional `@type` field which contains the type URL.\n- For types with special-cased JSON encodings (typically called 'well-known'\n types, listed in https://protobuf.dev/programming-guides/json/#any), the\n JSON format representation has a key `@type` which contains the type URL\n and a key `value` which contains the JSON-serialized value.\n\nThe text format representation of an `Any` is like a message with one field\nwhose name is the type URL in brackets. For example, an `Any` containing a\n`foo.Bar` message may be written `[type.googleapis.com/foo.Bar] { a: 2 }`."}}}},"value":{"type":"object","properties":{"@type":{"type":"string","description":"Identifies the type of the serialized Protobuf message with a URI reference\nconsisting of a prefix ending in a slash and the fully-qualified type name.\n\nExample: type.googleapis.com/google.protobuf.StringValue\n\nThis string must contain at least one `/` character, and the content after\nthe last `/` must be the fully-qualified name of the type in canonical\nform, without a leading dot. Do not write a scheme on these URI references\nso that clients do not attempt to contact them.\n\nThe prefix is arbitrary and Protobuf implementations are expected to\nsimply strip off everything up to and including the last `/` to identify\nthe type. `type.googleapis.com/` is a common default prefix that some\nlegacy implementations require. This prefix does not indicate the origin of\nthe type, and URIs containing it are not expected to respond to any\nrequests.\n\nAll type URL strings must be legal URI references with the additional\nrestriction (for the text format) that the content of the reference\nmust consist only of alphanumeric characters, percent-encoded escapes, and\ncharacters in the following set (not including the outer backticks):\n`/-.~_!$\u0026()*+,;=`. Despite our allowing percent encodings, implementations\nshould not unescape them to prevent confusion with existing parsers. For\nexample, `type.googleapis.com%2FFoo` should be rejected.\n\nIn the original design of `Any`, the possibility of launching a type\nresolution service at these type URLs was considered but Protobuf never\nimplemented one and considers contacting these URLs to be problematic and\na potential security issue. Do not attempt to contact type URLs."}},"additionalProperties":{"oneOf":[{}]},"description":"`Any` contains an arbitrary serialized protocol buffer message along with a\nURL that describes the type of the serialized message.\n\nIn its binary encoding, an `Any` is an ordinary message; but in other wire\nforms like JSON, it has a special encoding. The format of the type URL is\ndescribed on the `type_url` field.\n\nProtobuf APIs provide utilities to interact with `Any` values:\n\n- A 'pack' operation accepts a message and constructs a generic `Any` wrapper\n around it.\n- An 'unpack' operation reads the content of an `Any` message, either into an\n existing message or a new one. Unpack operations must check the type of the\n value they unpack against the declared `type_url`.\n- An 'is' operation decides whether an `Any` contains a message of the given\n type, i.e. whether it can 'unpack' that type.\n\nThe JSON format representation of an `Any` follows one of these cases:\n\n- For types without special-cased JSON encodings, the JSON format\n representation of the `Any` is the same as that of the message, with an\n additional `@type` field which contains the type URL.\n- For types with special-cased JSON encodings (typically called 'well-known'\n types, listed in https://protobuf.dev/programming-guides/json/#any), the\n JSON format representation has a key `@type` which contains the type URL\n and a key `value` which contains the JSON-serialized value.\n\nThe text format representation of an `Any` is like a message with one field\nwhose name is the type URL in brackets. For example, an `Any` containing a\n`foo.Bar` message may be written `[type.googleapis.com/foo.Bar] { a: 2 }`."}},"description":"ExpandLeaf is the leaf node of an Expand tree and can be either a set of Subjects or a set of Values."}},"description":"Expand is used to define a hierarchical structure for permissions.\nIt has an entity, permission, and arguments. The node can be either another hierarchical structure or a set of subjects."}}},"originalFileLocation":"api-reference/openapi.json"},"subdomain":"permify","siteName":"FGA Documentation","title":"Expand API - FGA Documentation","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-11-05T14:53:17.795Z","originalFileLocation":"api-reference/permission/expand-api.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"light\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"application-name\" content=\"FGA Documentation\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/permify/a_feQF0dT9qeMKZe/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/permify/a_feQF0dT9qeMKZe/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/permify/a_feQF0dT9qeMKZe/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/permify/a_feQF0dT9qeMKZe/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/permify/a_feQF0dT9qeMKZe/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/permify/a_feQF0dT9qeMKZe/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/permify/a_feQF0dT9qeMKZe/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/permify/a_feQF0dT9qeMKZe/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/permify/a_feQF0dT9qeMKZe/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"Expand API - FGA Documentation\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"FGA Documentation\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://proxy-docs.permify.co/api-reference/permission/expand-api\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://permify.mintlify.site/_mintlify/api/og/v2?division=Permission+Service\u0026amp;title=Expand+API\u0026amp;theme=9be289e78f6ac24dc5c5d06f\u0026amp;signature=000904a0f928c42293b6be2767a9b1b16da59ddd2498e558c480e6b86adf02ec\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Expand API - FGA Documentation\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://permify.mintlify.site/_mintlify/api/og/v2?division=Permission+Service\u0026amp;title=Expand+API\u0026amp;theme=9be289e78f6ac24dc5c5d06f\u0026amp;signature=000904a0f928c42293b6be2767a9b1b16da59ddd2498e558c480e6b86adf02ec\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/permify/a_feQF0dT9qeMKZe/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"FGA Documentation\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#F58320\">\u003clink data-mint-head rel=\"canonical\" href=\"https://proxy-docs.permify.co/api-reference/permission/expand-api\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/api-reference/permission/expand-api.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://proxy-docs.permify.co/#organization\",\"name\":\"FGA Documentation\",\"url\":\"https://proxy-docs.permify.co\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/permify/s--v0P7cOOW3QatA/logo/light.svg?fit=max\u0026auto=format\u0026n=s--v0P7cOOW3QatA\u0026q=85\u0026s=35df6af816b704ec52d1461bb85c5057\"}},{\"@type\":\"WebSite\",\"@id\":\"https://proxy-docs.permify.co#website\",\"name\":\"FGA Documentation\",\"url\":\"https://proxy-docs.permify.co\",\"publisher\":{\"@id\":\"https://proxy-docs.permify.co/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://proxy-docs.permify.co/api-reference/permission/expand-api#webpage\",\"url\":\"https://proxy-docs.permify.co/api-reference/permission/expand-api\",\"name\":\"Expand API\",\"dateModified\":\"2026-11-05T14:53:17.795Z\",\"isPartOf\":{\"@id\":\"https://proxy-docs.permify.co#website\"},\"breadcrumb\":{\"@id\":\"https://proxy-docs.permify.co/api-reference/permission/expand-api#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://proxy-docs.permify.co/api-reference/permission/expand-api#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Permission Service\",\"item\":\"https://proxy-docs.permify.co/api-reference/permission/check-api\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Expand API\",\"item\":\"https://proxy-docs.permify.co/api-reference/permission/expand-api\"}]},{\"@type\":[\"TechArticle\",\"APIReference\"],\"@id\":\"https://proxy-docs.permify.co/api-reference/permission/expand-api#apireference\",\"headline\":\"Expand API\",\"name\":\"Expand API\",\"url\":\"https://proxy-docs.permify.co/api-reference/permission/expand-api\",\"mainEntityOfPage\":{\"@id\":\"https://proxy-docs.permify.co/api-reference/permission/expand-api#webpage\"},\"dateModified\":\"2026-11-05T14:53:17.795Z\",\"publisher\":{\"@id\":\"https://proxy-docs.permify.co/#organization\"},\"isPartOf\":{\"@id\":\"https://proxy-docs.permify.co#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"FGA Documentation\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"FGA Documentation","nav":{"global":null,"tabs":[{"tab":"FGA Documentation","pages":[{"title":"FGA Documentation","href":"/permify-overview/intro"}]},{"tab":"API References","groups":[{"group":"API Documentation","pages":[{"title":"Introduction","href":"/api-reference/introduction"}]},{"group":"Schema Service","pages":[{"title":"Write Schema","openapi":"post /v1/tenants/{tenant_id}/schemas/write","href":"/api-reference/schema/write-schema"},{"title":"List Schema","openapi":"post /v1/tenants/{tenant_id}/schemas/list","href":"/api-reference/schema/list-schema"},{"title":"Partial Schema Update","openapi":"patch /v1/tenants/{tenant_id}/schemas/partial-write","href":"/api-reference/schema/partial-write"},{"title":"Read Schema","openapi":"post /v1/tenants/{tenant_id}/schemas/read","href":"/api-reference/schema/read-schema"}]},{"group":"Data Service","pages":[{"title":"Write Authorization Data","openapi":"post /v1/tenants/{tenant_id}/data/write","href":"/api-reference/data/write-data"},{"title":"Read Relationships","openapi":"post /v1/tenants/{tenant_id}/data/relationships/read","href":"/api-reference/data/read-relationships"},{"title":"Read Attributes","openapi":"post /v1/tenants/{tenant_id}/data/attributes/read","href":"/api-reference/data/read-attributes"},{"title":"Run Bundle","openapi":"post /v1/tenants/{tenant_id}/data/run-bundle","href":"/api-reference/data/run-bundle"},{"title":"Delete Data","openapi":"post /v1/tenants/{tenant_id}/data/delete","href":"/api-reference/data/delete-data"}]},{"group":"Permission Service","pages":[{"title":"Check Access Control","openapi":"post /v1/tenants/{tenant_id}/permissions/check","href":"/api-reference/permission/check-api"},{"title":"Bulk Check","openapi":"post /v1/tenants/{tenant_id}/permissions/bulk-check","description":"Check multiple permissions in a single request. Maximum 100 requests allowed.","href":"/api-reference/permission/bulk-check"},{"title":"Expand API","openapi":"post /v1/tenants/{tenant_id}/permissions/expand","href":"/api-reference/permission/expand-api"},{"title":"Subject Filtering","openapi":"post /v1/tenants/{tenant_id}/permissions/lookup-subject","description":null,"href":"/api-reference/permission/lookup-subject"},{"title":"Lookup Entity (Data Filtering)","openapi":"post /v1/tenants/{tenant_id}/permissions/lookup-entity","href":"/api-reference/permission/lookup-entity"},{"title":"Lookup Entity (Streaming)","openapi":"post /v1/tenants/{tenant_id}/permissions/lookup-entity-stream","href":"/api-reference/permission/lookup-entity-stream"},{"title":"Subject Permission List","openapi":"post /v1/tenants/{tenant_id}/permissions/subject-permission","href":"/api-reference/permission/subject-permission"}]},{"group":"Tenancy Service","pages":[{"title":"List Tenants","openapi":"post /v1/tenants/list","href":"/api-reference/tenancy/list-tenants"},{"title":"Create Tenant","openapi":"post /v1/tenants/create","href":"/api-reference/tenancy/create-tenant"},{"title":"Delete Tenant","openapi":"delete /v1/tenants/{id}","href":"/api-reference/tenancy/delete-tenant"}]},{"group":"Bundle Service","pages":[{"title":"Write Bundle","openapi":"post /v1/tenants/{tenant_id}/bundle/write","href":"/api-reference/bundle/write-bundle"},{"title":"Read Bundle","openapi":"post /v1/tenants/{tenant_id}/bundle/read","href":"/api-reference/bundle/read-bundle"},{"title":"Delete Bundle","openapi":"post /v1/tenants/{tenant_id}/bundle/delete","href":"/api-reference/bundle/delete-bundle"}]},{"group":"Watch Service","pages":[{"title":"Watch API","openapi":"post /v1/tenants/{tenant_id}/watch","href":"/api-reference/watch/watch-changes"}]}]}]},"basePath":"","title":"Expand API - FGA Documentation","buildId":"dpl_DTau1J5HqS9UTgVSDwGksstFWtPa","deploymentId":"dpl_DTau1J5HqS9UTgVSDwGksstFWtPa","dynamics":["c2aa737661","2b790eda92","b0f84f53ff","a9bb46feb3"],"chunks":["OpenApiReferenceProvider-5FCzAcfS.js","utils-SLtAG4EZ.js","cloneDeep-izs3Hzxb.js","_Uint8Array-BVIqJ90l.js","isObjectLike-C8vmzPEN.js","isArray-Dcu1dQ5t.js","utils-2DZi8ZMu.js","toString-BX-iyh8G.js","isSymbol-CSH9U2Gm.js","addUniqueKeysToSchema-D7J3nkzE.js","snippetPresets-D0Alv0AH.js","style-to-object-BY3JEAdk.js","v4-DIgz8zy6.js","conditional-requirements-CFM0id0Q.js","ApiExamples-BI4qNJ2c.js","isEqual-BfaiBbcl.js","usePlaygroundInputsStore-BD3uyr8j.js","shallow-D8iEBr5z.js","getApiPlaygroundDisplay-CgNP4lzR.js","CodeSnippet-CX-QHuMs.js","CodeSnippets-VlXE-ZUf.js","Page-D9ithiIZ.js","getPastedJson-DYNQkZ1M.js","icon-CzacdwOi.js","MethodPill-2JVqoYKi.js","DuplicateIcon-_xVXs-U8.js","createIcon-BRHrweLo.js","DynamicMarkdown-mQG_iQiE.js","SectionHeading-DMpJzv8f.js","axios-vUo_bRtp.js","Markdown-5FGIym-8.js","clsx-D-TRO5q5.js","lib-DuNMoZ05.js","lib-B8HbPgcC.js","html-void-elements-mCSPHezU.js","dist-CdrJecqK.js","katex-YMM-FMeD.js","marked.esm-CZWythHk.js","AssistantPageLink-CHlcWBLM.js"]}