FGA (Fine-Grained Authorization)

The FGA API provides endpoints for managing fine-grained authorization in your WorkOS environment. Use these endpoints to create resources, assign roles, and check access permissions for your users.

Resources are instances of resource types that represent entities in your application – workspaces, projects, apps, or any other object that users can access. Resources form a hierarchy where permissions can be inherited from parent to child.

Role assignments connect organization memberships to roles on specific resources. When a role is assigned to a user on a resource, they gain all permissions included in that role on that resource and its descendants.

Access check endpoints let you determine whether a user has a specific permission on a resource. You can also discover which resources a user can access, or which users have access to a specific resource.

Set the priority order of roles for an organization using role slugs.

curl --request PUT \
  --url "https://api.workos.com/authorization/organizations/org_01EHZNVPK3SFK441A1RGBFSHRT/roles/priority" \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "role_priority_order": [
            "role_01EHQMYV6MBK39QC5PZXHY59C3"
        ]
    }
BODY

Get a list of all authorization resource types.

curl "https://api.workos.com/authorization/resource-types" \
  --header "Authorization: Bearer sk_example_123456789"

Create a new authorization resource type.

curl --request POST \
  --url "https://api.workos.com/authorization/resource-types" \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "name": "Document",
        "slug": "document",
        "description": "Represents a document resource",
        "parent_type_slugs": [
            "organization"
        ]
    }
BODY

Get the details of an authorization resource type by slug.

curl "https://api.workos.com/authorization/resource-types/project" \
  --header "Authorization: Bearer sk_example_123456789"

Delete an authorization resource type.

curl --request DELETE \
  --url "https://api.workos.com/authorization/resource-types/project" \
  --header "Authorization: Bearer sk_example_123456789"