openapi: 3.0.3
info:
  title: Warrant Check Warrants API
  description: 'Warrant was a centralized, fine-grained authorization (FGA) service inspired by Google Zanzibar. Applications defined an authorization model (object types and relations), wrote relationship tuples called warrants between objects, and then ran real-time access checks and relationship queries. The service supported ReBAC, RBAC, and ABAC, plus entitlements (features and pricing tiers). The core engine is open source (Apache-2.0, github.com/warrant-dev/warrant) and self-hostable against MySQL, Postgres, or SQLite; the self-hosted server listens on port 8000 by default. The hosted service used base URL https://api.warrant.dev with API-key authentication via the `Authorization: ApiKey <key>` header.

    STATUS - RETIRED. Warrant was acquired by WorkOS on 2024-04-23 and folded into WorkOS FGA. The standalone hosted Warrant API (api.warrant.dev) and the Warrant-based WorkOS FGA were deprecated and sunset on 2025-11-15. The paths below are MODELED from Warrant''s publicly documented v1/v2 API for historical and access-control reference; they are not a live contract. Verify current fine-grained authorization at https://workos.com/docs/fga.'
  version: '1.0'
  contact:
    name: Warrant (now WorkOS FGA)
    url: https://warrant.dev
  license:
    name: Apache-2.0
    url: https://github.com/warrant-dev/warrant/blob/main/LICENSE
servers:
- url: https://api.warrant.dev
  description: Warrant hosted API (RETIRED - sunset 2025-11-15)
- url: http://localhost:8000
  description: Self-hosted open-source Warrant server (default port)
security:
- apiKeyAuth: []
tags:
- name: Warrants
  description: Relationship tuples (access rules) between subjects and objects.
paths:
  /v1/warrants:
    get:
      operationId: queryWarrants
      tags:
      - Warrants
      summary: List / query warrants
      description: Lists warrants, optionally filtered by object type, object id, relation, or subject. RETIRED / modeled.
      parameters:
      - name: objectType
        in: query
        schema:
          type: string
      - name: objectId
        in: query
        schema:
          type: string
      - name: relation
        in: query
        schema:
          type: string
      - name: subject.objectType
        in: query
        schema:
          type: string
      - name: subject.objectId
        in: query
        schema:
          type: string
      responses:
        '200':
          description: A list of warrants.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Warrant'
        '401':
          $ref: '#/components/responses/Unauthorized'
    post:
      operationId: createWarrant
      tags:
      - Warrants
      summary: Create a warrant
      description: Assigns a relation between a subject and an object (grants access). RETIRED / modeled.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Warrant'
      responses:
        '200':
          description: The created warrant.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Warrant'
    delete:
      operationId: deleteWarrant
      tags:
      - Warrants
      summary: Delete a warrant
      description: Removes a relation between a subject and an object (revokes access). RETIRED / modeled.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Warrant'
      responses:
        '200':
          description: The warrant was deleted.
components:
  schemas:
    Subject:
      type: object
      required:
      - objectType
      - objectId
      properties:
        objectType:
          type: string
        objectId:
          type: string
        relation:
          type: string
    Error:
      type: object
      properties:
        code:
          type: integer
        message:
          type: string
    Warrant:
      type: object
      required:
      - objectType
      - objectId
      - relation
      - subject
      properties:
        objectType:
          type: string
        objectId:
          type: string
        relation:
          type: string
        subject:
          $ref: '#/components/schemas/Subject'
        policy:
          type: string
          description: Optional ABAC condition (boolean expression) that must hold for the warrant to apply.
  responses:
    Unauthorized:
      description: Missing or invalid API key.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: header
      name: Authorization
      description: 'API key passed as `Authorization: ApiKey YOUR_API_KEY`. Self-hosted deployments configure the key via ApiKey in the server config.'