AuthZEN

OpenID AuthZEN (Authorization API 1.0) defines a standard API for authorization decisions. A Policy Enforcement Point (PEP) asks a Policy Decision Point (PDP) whether a subject can perform an action on a resource.

ThunderID supports AuthZEN as a policy decision point. Your gateway, adapter, service, or application acts as the PEP and sends the subject, resource, action, and request context to ThunderID. ThunderID evaluates the request against resource servers, resources, actions, roles, and role assignments, then returns an allow or deny decision.

Use AuthZEN when the authorization decision needs more than token validation or static scope checks. For example, use AuthZEN when an API gateway must ask ThunderID for a request-time decision before it forwards a request to an upstream API.

AuthZEN Roles

Role	Description	ThunderID Support
Policy Decision Point (PDP)	Evaluates access requests and returns allow or deny decisions.	Supported. See Policy Decision Point.
Policy Enforcement Point (PEP)	Enforces the PDP decision before the protected resource receives the request.	Planned for future.

How the AuthZEN Flow Works

1. A client sends a request for a protected resource through the PEP.
2. The PEP identifies the subject, resource, and action and collects any request context.
3. The PEP sends an AuthZEN access evaluation request to the PDP.
4. The PDP evaluates its authorization policies and returns decision: true or decision: false. The response can also include context about the decision.
5. When the decision is false, the PEP denies access without forwarding the request to the protected resource.
6. When the decision is true, the PEP forwards the request and returns the protected resource response to the client.

For the supported PDP endpoints, request and response examples, and configuration links, see Policy Decision Point.

Related Guides

• Policy Decision Point: call ThunderID as an AuthZEN PDP.
• Resource Servers: define protected APIs, resources, and actions.
• Roles: assign permissions to users, groups, applications, and agents.
• Envoy: configure Envoy to call ThunderID as an AuthZEN PDP.