swagger: '2.0' info: title: OpenFGA Assertions AuthZenService API description: A high performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. version: 1.x contact: name: OpenFGA url: https://openfga.dev email: community@openfga.dev license: name: Apache-2.0 url: https://github.com/openfga/openfga/blob/main/LICENSE schemes: - https consumes: - application/json produces: - application/json tags: - name: AuthZenService paths: /.well-known/authzen-configuration/{store_id}: get: summary: '[Experimental] Get AuthZEN PDP configuration and capabilities' description: "[Experimental] The GetConfiguration API returns metadata about the Policy Decision Point (PDP) including its name, version, supported endpoints, and capabilities. This endpoint follows the AuthZEN specification for PDP discovery.\n\nFollowing the AuthZEN spec's multi-tenant pattern, OpenFGA provides a per-store discovery endpoint at `/.well-known/authzen-configuration/{store_id}`. This returns absolute endpoint URLs specific to that store.\n\n## Example Response\n```json\n{\n \"policy_decision_point\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV\",\n \"access_evaluation_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/evaluation\",\n \"access_evaluations_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/evaluations\",\n \"search_subject_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/subject\",\n \"search_resource_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/resource\",\n \"search_action_endpoint\": \"https://example.com/stores/01ARZ3NDEKTSV4RRFFQ69G5FAV/access/v1/search/action\"\n}\n```\n" operationId: GetConfiguration responses: '200': description: A successful response. schema: $ref: '#/definitions/GetConfigurationResponse' '400': description: Request failed due to invalid input. schema: $ref: '#/definitions/ValidationErrorMessageResponse' '401': description: Not authenticated. schema: $ref: '#/definitions/UnauthenticatedResponse' '403': description: Forbidden. schema: $ref: '#/definitions/ForbiddenResponse' '404': description: Request failed due to incorrect path. schema: $ref: '#/definitions/PathUnknownErrorMessageResponse' '409': description: Request was aborted due a transaction conflict. schema: $ref: '#/definitions/AbortedMessageResponse' '422': description: Request timed out due to excessive request throttling. schema: $ref: '#/definitions/UnprocessableContentMessageResponse' '500': description: Request failed due to internal server error. schema: $ref: '#/definitions/InternalErrorMessageResponse' parameters: - name: store_id description: 'The store ID for which to retrieve configuration. Following the AuthZEN spec''s multi-tenant pattern, each store has its own discovery endpoint.' in: path required: true type: string tags: - AuthZenService /stores/{store_id}/access/v1/evaluation: post: summary: '[Experimental] Evaluate whether a subject can perform an action on a resource' description: "[Experimental] The Evaluation API determines whether a subject is authorized to perform an action on a resource. This endpoint implements the AuthZEN Access Evaluation API specification.\n\n## Request Structure\nThe request requires three components:\n- **subject**: The entity requesting access (e.g., a user or service)\n- **action**: The operation being performed (maps to a relation in the authorization model)\n- **resource**: The object being accessed\n\nEach component has a `type` and `id` field, and may include optional `properties` for ABAC (Attribute-Based Access Control) conditions.\n\n## Response\nThe response contains a `decision` field (boolean) indicating whether access is permitted, and an optional `context` object with additional information such as the evaluation ID or error details.\n\n## ABAC Support\nProperties on subject, action, and resource are automatically merged into the evaluation context with prefixes:\n- Subject properties: `subject_`\n- Resource properties: `resource_`\n- Action properties: `action_`\n\nThese merged properties can be used in conditions defined in your authorization model.\n\n## Examples\n### Basic authorization check\nCheck if user Anne can read a document:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"}\n}\n```\nResponse when authorized:\n```json\n{\n \"decision\": true\n}\n```\n### Using properties for ABAC\nCheck access with subject and resource attributes:\n```json\n{\n \"subject\": {\n \"type\": \"user\",\n \"id\": \"anne\",\n \"properties\": {\"department\": \"engineering\", \"clearance_level\": 3}\n },\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\n \"type\": \"document\",\n \"id\": \"secret-project\",\n \"properties\": {\"classification\": \"confidential\", \"required_clearance\": 2}\n }\n}\n```\n### Using request context\nProvide additional context for time-based or environmental conditions:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n \"action\": {\"name\": \"can_access\"},\n \"resource\": {\"type\": \"system\", \"id\": \"production\"},\n \"context\": {\n \"current_time\": \"2024-01-15T14:30:00Z\",\n \"ip_address\": \"192.168.1.100\",\n \"is_vpn_connected\": true\n }\n}\n```\n### Specifying authorization model\nPin the evaluation to a specific authorization model version using the `Openfga-Authorization-Model-Id` header:\n```\nPOST /stores/{store_id}/access/v1/evaluation\nOpenfga-Authorization-Model-Id: 01G50QVV17PECNVAHX1GG4Y5NC\n\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_write\"},\n \"resource\": {\"type\": \"document\", \"id\": \"budget-2024\"}\n}\n```\n" operationId: Evaluation responses: '200': description: A successful response. schema: $ref: '#/definitions/EvaluationResponse' '400': description: Request failed due to invalid input. schema: $ref: '#/definitions/ValidationErrorMessageResponse' '401': description: Not authenticated. schema: $ref: '#/definitions/UnauthenticatedResponse' '403': description: Forbidden. schema: $ref: '#/definitions/ForbiddenResponse' '404': description: Request failed due to incorrect path. schema: $ref: '#/definitions/PathUnknownErrorMessageResponse' '409': description: Request was aborted due a transaction conflict. schema: $ref: '#/definitions/AbortedMessageResponse' '422': description: Request timed out due to excessive request throttling. schema: $ref: '#/definitions/UnprocessableContentMessageResponse' '500': description: Request failed due to internal server error. schema: $ref: '#/definitions/InternalErrorMessageResponse' parameters: - name: store_id in: path required: true type: string - name: body in: body required: true schema: type: object properties: subject: $ref: '#/definitions/Subject' resource: $ref: '#/definitions/Resource' action: $ref: '#/definitions/Action' context: type: object required: - subject - resource - action tags: - AuthZenService /stores/{store_id}/access/v1/evaluations: post: summary: '[Experimental] Check whether one or more users are authorized to access resources' description: "[Experimental] The Evaluations API allows batch authorization checks in a single request. It supports request-level defaults for subject, action, resource, and context that can be overridden per evaluation item.\n\n## Evaluation Semantics\nThe `options.evaluations_semantic` field controls how evaluations are processed:\n- `execute_all` (default): Execute all evaluations and return all results\n- `deny_on_first_deny`: Stop processing on first deny decision\n- `permit_on_first_permit`: Stop processing on first permit decision\n\nWhen using `deny_on_first_deny` or `permit_on_first_permit`, the response may include fewer items than the request because processing short-circuits when the condition is met.\n\n## Authorization Model Selection\nTo pin evaluations to a specific authorization model version, send the `Openfga-Authorization-Model-Id` header. If the header is not provided, the latest model is used.\n\n## Examples\n### Basic batch evaluation\nCheck if a user can perform multiple actions on a document:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n \"evaluations\": [\n {\"action\": {\"name\": \"can_read\"}},\n {\"action\": {\"name\": \"can_write\"}},\n {\"action\": {\"name\": \"can_delete\"}}\n ]\n}\n```\n### Using evaluation semantics\nStop on first permitted action (useful for finding any valid permission):\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n \"evaluations\": [\n {\"action\": {\"name\": \"can_read\"}},\n {\"action\": {\"name\": \"can_write\"}}\n ],\n \"options\": {\n \"evaluations_semantic\": \"permit_on_first_permit\"\n }\n}\n```\n### Overriding defaults per evaluation\nCheck permissions across multiple resources:\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"evaluations\": [\n {\"resource\": {\"type\": \"document\", \"id\": \"doc1\"}},\n {\"resource\": {\"type\": \"document\", \"id\": \"doc2\"}},\n {\"resource\": {\"type\": \"folder\", \"id\": \"folder1\"}}\n ]\n}\n```\n" operationId: Evaluations responses: '200': description: A successful response. schema: $ref: '#/definitions/EvaluationsResponse' '400': description: Request failed due to invalid input. schema: $ref: '#/definitions/ValidationErrorMessageResponse' '401': description: Not authenticated. schema: $ref: '#/definitions/UnauthenticatedResponse' '403': description: Forbidden. schema: $ref: '#/definitions/ForbiddenResponse' '404': description: Request failed due to incorrect path. schema: $ref: '#/definitions/PathUnknownErrorMessageResponse' '409': description: Request was aborted due a transaction conflict. schema: $ref: '#/definitions/AbortedMessageResponse' '422': description: Request timed out due to excessive request throttling. schema: $ref: '#/definitions/UnprocessableContentMessageResponse' '500': description: Request failed due to internal server error. schema: $ref: '#/definitions/InternalErrorMessageResponse' parameters: - name: store_id in: path required: true type: string - name: body in: body required: true schema: type: object properties: subject: $ref: '#/definitions/Subject' action: $ref: '#/definitions/Action' resource: $ref: '#/definitions/Resource' context: type: object evaluations: type: array items: type: object $ref: '#/definitions/EvaluationsItemRequest' description: Optional. If omitted or empty, behaves like a single Access Evaluation request. options: $ref: '#/definitions/EvaluationsOptions' title: Options for batch evaluation semantics tags: - AuthZenService /stores/{store_id}/access/v1/search/action: post: summary: '[Experimental] Search for actions a subject can perform on a resource' description: "[Experimental] The ActionSearch API returns all actions (relations) that a subject can perform on a specific resource. This is useful for answering questions like \"What can Anne do with this document?\" or building dynamic UIs that show only the actions a user is permitted to perform.\n\n## Examples\n### Find all actions a user can perform on a document\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"}\n}\n```\nResponse:\n```json\n{\n \"results\": [\n {\"name\": \"can_read\"},\n {\"name\": \"can_write\"},\n {\"name\": \"can_share\"}\n ],\n \"page\": {\"count\": 3}\n}\n```\n### Search with ABAC context for time-based permissions\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n \"resource\": {\"type\": \"report\", \"id\": \"quarterly-financials\"},\n \"context\": {\n \"current_time\": \"2024-01-15T14:30:00Z\",\n \"user_department\": \"finance\"\n }\n}\n```\n### Paginated action search\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"admin\"},\n \"resource\": {\"type\": \"system\", \"id\": \"production\"},\n \"page\": {\"limit\": 50}\n}\n```\n" operationId: ActionSearch responses: '200': description: A successful response. schema: $ref: '#/definitions/ActionSearchResponse' '400': description: Request failed due to invalid input. schema: $ref: '#/definitions/ValidationErrorMessageResponse' '401': description: Not authenticated. schema: $ref: '#/definitions/UnauthenticatedResponse' '403': description: Forbidden. schema: $ref: '#/definitions/ForbiddenResponse' '404': description: Request failed due to incorrect path. schema: $ref: '#/definitions/PathUnknownErrorMessageResponse' '409': description: Request was aborted due a transaction conflict. schema: $ref: '#/definitions/AbortedMessageResponse' '422': description: Request timed out due to excessive request throttling. schema: $ref: '#/definitions/UnprocessableContentMessageResponse' '500': description: Request failed due to internal server error. schema: $ref: '#/definitions/InternalErrorMessageResponse' parameters: - name: store_id in: path required: true type: string - name: body in: body required: true schema: type: object properties: subject: $ref: '#/definitions/Subject' resource: $ref: '#/definitions/Resource' context: type: object page: $ref: '#/definitions/PageRequest' title: ActionSearch request required: - subject - resource tags: - AuthZenService /stores/{store_id}/access/v1/search/resource: post: summary: '[Experimental] Search for resources a subject has access to' description: "[Experimental] The ResourceSearch API returns all resources of a given type that a subject has a specific action (relation) on. This is useful for answering questions like \"What documents can Anne read?\" or \"What folders can Bob administer?\"\n\nThe resource type filter is required. Results support pagination for large result sets.\n\n## Examples\n### Find all documents a user can read\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\"type\": \"document\"}\n}\n```\nResponse:\n```json\n{\n \"results\": [\n {\"type\": \"document\", \"id\": \"roadmap\"},\n {\"type\": \"document\", \"id\": \"budget-2024\"},\n {\"type\": \"document\", \"id\": \"team-roster\"}\n ],\n \"page\": {\"count\": 3}\n}\n```\n### Find folders a user can administer with pagination\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"bob\"},\n \"action\": {\"name\": \"can_admin\"},\n \"resource\": {\"type\": \"folder\"},\n \"page\": {\"limit\": 25}\n}\n```\n### Search with ABAC context\n```json\n{\n \"subject\": {\"type\": \"user\", \"id\": \"anne\"},\n \"action\": {\"name\": \"can_read\"},\n \"resource\": {\"type\": \"document\"},\n \"context\": {\n \"current_time\": \"2024-01-15T10:00:00Z\",\n \"ip_address\": \"192.168.1.100\"\n }\n}\n```\n" operationId: ResourceSearch responses: '200': description: A successful response. schema: $ref: '#/definitions/ResourceSearchResponse' '400': description: Request failed due to invalid input. schema: $ref: '#/definitions/ValidationErrorMessageResponse' '401': description: Not authenticated. schema: $ref: '#/definitions/UnauthenticatedResponse' '403': description: Forbidden. schema: $ref: '#/definitions/ForbiddenResponse' '404': description: Request failed due to incorrect path. schema: $ref: '#/definitions/PathUnknownErrorMessageResponse' '409': description: Request was aborted due a transaction conflict. schema: $ref: '#/definitions/AbortedMessageResponse' '422': description: Request timed out due to excessive request throttling. schema: $ref: '#/definitions/UnprocessableContentMessageResponse' '500': description: Request failed due to internal server error. schema: $ref: '#/definitions/InternalErrorMessageResponse' parameters: - name: store_id in: path required: true type: string - name: body in: body required: true schema: type: object properties: subject: $ref: '#/definitions/Subject' action: $ref: '#/definitions/Action' resource: $ref: '#/definitions/ResourceFilter' title: Filter by resource type context: type: object page: $ref: '#/definitions/PageRequest' title: ResourceSearch request required: - subject - action - resource tags: - AuthZenService /stores/{store_id}/access/v1/search/subject: post: summary: '[Experimental] Search for subjects with access to a resource' description: "[Experimental] The SubjectSearch API returns all subjects that have a specific action (relation) on a given resource. This is useful for answering questions like \"Who can read this document?\" or \"Who can administer this folder?\"\n\nResults can be filtered by subject type and support pagination for large result sets.\n\n## Examples\n### Find all users who can read a document\n```json\n{\n \"resource\": {\"type\": \"document\", \"id\": \"roadmap\"},\n \"action\": {\"name\": \"can_read\"},\n \"subject\": {\"type\": \"user\"}\n}\n```\nResponse:\n```json\n{\n \"results\": [\n {\"type\": \"user\", \"id\": \"anne\"},\n {\"type\": \"user\", \"id\": \"bob\"},\n {\"type\": \"user\", \"id\": \"charlie\"}\n ],\n \"page\": {\"count\": 3}\n}\n```\n### Paginated search with limit\n```json\n{\n \"resource\": {\"type\": \"folder\", \"id\": \"engineering\"},\n \"action\": {\"name\": \"can_view\"},\n \"subject\": {\"type\": \"user\"},\n \"page\": {\"limit\": 10}\n}\n```\n### Continue from previous page\n```json\n{\n \"resource\": {\"type\": \"folder\", \"id\": \"engineering\"},\n \"action\": {\"name\": \"can_view\"},\n \"subject\": {\"type\": \"user\"},\n \"page\": {\"token\": \"eyJsYXN0X2lkIjoiMTAwIn0=\", \"limit\": 10}\n}\n```\n" operationId: SubjectSearch responses: '200': description: A successful response. schema: $ref: '#/definitions/SubjectSearchResponse' '400': description: Request failed due to invalid input. schema: $ref: '#/definitions/ValidationErrorMessageResponse' '401': description: Not authenticated. schema: $ref: '#/definitions/UnauthenticatedResponse' '403': description: Forbidden. schema: $ref: '#/definitions/ForbiddenResponse' '404': description: Request failed due to incorrect path. schema: $ref: '#/definitions/PathUnknownErrorMessageResponse' '409': description: Request was aborted due a transaction conflict. schema: $ref: '#/definitions/AbortedMessageResponse' '422': description: Request timed out due to excessive request throttling. schema: $ref: '#/definitions/UnprocessableContentMessageResponse' '500': description: Request failed due to internal server error. schema: $ref: '#/definitions/InternalErrorMessageResponse' parameters: - name: store_id in: path required: true type: string - name: body in: body required: true schema: type: object properties: resource: $ref: '#/definitions/Resource' action: $ref: '#/definitions/Action' subject: $ref: '#/definitions/SubjectFilter' description: REQUIRED by AuthZEN Subject Search. Subject `id` may be provided but is ignored. context: type: object page: $ref: '#/definitions/PageRequest' title: SubjectSearch request required: - resource - action - subject tags: - AuthZenService definitions: Subject: type: object properties: type: type: string example: user id: type: string example: anne properties: type: object required: - type - id NotFoundErrorCode: type: string enum: - no_not_found_error - undefined_endpoint - store_id_not_found - unimplemented default: no_not_found_error ErrorCode: type: string enum: - no_error - validation_error - authorization_model_not_found - authorization_model_resolution_too_complex - invalid_write_input - cannot_allow_duplicate_tuples_in_one_request - cannot_allow_duplicate_types_in_one_request - cannot_allow_multiple_references_to_one_relation - invalid_continuation_token - invalid_tuple_set - invalid_check_input - invalid_expand_input - unsupported_user_set - invalid_object_format - write_failed_due_to_invalid_input - authorization_model_assertions_not_found - latest_authorization_model_not_found - type_not_found - relation_not_found - empty_relation_definition - invalid_user - invalid_tuple - unknown_relation - store_id_invalid_length - assertions_too_many_items - id_too_long - authorization_model_id_too_long - tuple_key_value_not_specified - tuple_keys_too_many_or_too_few_items - page_size_invalid - param_missing_value - difference_base_missing_value - subtract_base_missing_value - object_too_long - relation_too_long - type_definitions_too_few_items - type_invalid_length - type_invalid_pattern - relations_too_few_items - relations_too_long - relations_invalid_pattern - object_invalid_pattern - query_string_type_continuation_token_mismatch - exceeded_entity_limit - invalid_contextual_tuple - duplicate_contextual_tuple - invalid_authorization_model - unsupported_schema_version - cancelled - invalid_start_time default: no_error AbortedMessageResponse: type: object example: code: '10' message: transaction conflict properties: code: type: string message: type: string ResourceSearchResponse: type: object properties: results: type: array items: type: object $ref: '#/definitions/Resource' page: $ref: '#/definitions/PageResponse' title: Optional per AuthZEN spec - omit if pagination not supported AuthErrorCode: type: string enum: - no_auth_error - auth_failed_invalid_subject - auth_failed_invalid_audience - auth_failed_invalid_issuer - invalid_claims - auth_failed_invalid_bearer_token - bearer_token_missing - unauthenticated - forbidden default: no_auth_error GetConfigurationResponse: type: object properties: policy_decision_point: type: string description: REQUIRED. The PDP identifier URL (HTTPS, no query or fragment). access_evaluation_endpoint: type: string description: REQUIRED. The access evaluation endpoint URL. access_evaluations_endpoint: type: string description: OPTIONAL. The batch evaluations endpoint URL. search_subject_endpoint: type: string description: OPTIONAL. The subject search endpoint URL. search_resource_endpoint: type: string description: OPTIONAL. The resource search endpoint URL. search_action_endpoint: type: string description: OPTIONAL. The action search endpoint URL. capabilities: type: array items: type: string description: OPTIONAL. Supported capabilities as URN strings. signed_metadata: type: string description: OPTIONAL. Signed metadata JWT per AuthZEN metadata specification. title: GetConfiguration response - PDP metadata per AuthZEN spec required: - policy_decision_point - access_evaluation_endpoint EvaluationsItemRequest: type: object properties: subject: $ref: '#/definitions/Subject' resource: $ref: '#/definitions/Resource' action: $ref: '#/definitions/Action' context: type: object EvaluationsSemantic: type: string enum: - execute_all - deny_on_first_deny - permit_on_first_permit default: execute_all description: "- execute_all: Execute all evaluations (default behavior)\n - deny_on_first_deny: Stop on first deny decision\n - permit_on_first_permit: Stop on first permit decision" title: Enum for evaluation semantics EvaluationsResponse: type: object properties: evaluations: type: array items: type: object $ref: '#/definitions/EvaluationResponse' UnprocessableContentErrorCode: type: string enum: - no_throttled_error_code - throttled_timeout_error default: no_throttled_error_code SubjectFilter: type: object properties: type: type: string example: user id: type: string description: Optional subject id. If present in Subject Search, it is ignored per AuthZEN spec. properties: type: object title: SubjectFilter is used for search operations where only type is required required: - type Action: type: object properties: name: type: string example: can_read properties: type: object required: - name InternalErrorMessageResponse: type: object example: code: internal_error message: Internal Server Error properties: code: $ref: '#/definitions/InternalErrorCode' message: type: string PageResponse: type: object properties: next_token: type: string title: Token to retrieve next page (empty if no more results) count: type: integer format: int64 title: Number of results in this page total: type: integer format: int64 title: Total number of results (if known, otherwise 0) title: Pagination response parameters SubjectSearchResponse: type: object properties: results: type: array items: type: object $ref: '#/definitions/Subject' page: $ref: '#/definitions/PageResponse' title: Optional per AuthZEN spec - omit if pagination not supported PageRequest: type: object properties: token: type: string title: Continuation token from previous response limit: type: integer format: int64 title: 'Maximum number of results to return (default: 50, max: 1000)' title: Pagination request parameters for search operations EvaluationResponse: type: object properties: decision: type: boolean context: type: object ResourceFilter: type: object properties: type: type: string example: document id: type: string description: Optional resource id. If present in Resource Search, it is ignored per AuthZEN spec. properties: type: object title: ResourceFilter is used for search operations where only type is required required: - type ForbiddenResponse: type: object example: code: forbidden message: the principal is not authorized to perform the action properties: code: $ref: '#/definitions/AuthErrorCode' message: type: string Resource: type: object properties: type: type: string example: document id: type: string example: roadmap properties: type: object required: - type - id EvaluationsOptions: type: object properties: evaluations_semantic: $ref: '#/definitions/EvaluationsSemantic' title: Controls how batch evaluations are processed title: Options for batch evaluations ActionSearchResponse: type: object properties: results: type: array items: type: object $ref: '#/definitions/Action' page: $ref: '#/definitions/PageResponse' title: Optional per AuthZEN spec - omit if pagination not supported UnprocessableContentMessageResponse: type: object example: code: throttled_timeout_error message: timeout due to throttling on complex request properties: code: $ref: '#/definitions/UnprocessableContentErrorCode' message: type: string UnauthenticatedResponse: type: object example: code: unauthenticated message: unauthenticated properties: code: $ref: '#/definitions/ErrorCode' message: type: string ValidationErrorMessageResponse: type: object example: code: validation_error message: Generic validation error properties: code: $ref: '#/definitions/ErrorCode' message: type: string InternalErrorCode: type: string enum: - no_internal_error - internal_error - deadline_exceeded - already_exists - resource_exhausted - failed_precondition - aborted - out_of_range - unavailable - data_loss default: no_internal_error PathUnknownErrorMessageResponse: type: object example: code: undefined_endpoint message: Endpoint not enabled properties: code: $ref: '#/definitions/NotFoundErrorCode' message: type: string