Vengtoo PDP API
The Vengtoo PDP (Policy Decision Point) API evaluates authorization decisions. It is natively conformant with the OpenID AuthZEN Authorization API 1.0 specification, not a compatibility shim or translation layer.
Base URL: https://pdp.vengtoo.com
All API calls require a credential in the Authorization header, either
an API key or an OAuth2 access token:
Authorization: Bearer vgt_...
Get your API key from Settings > API Keys in the Vengtoo Console. Your credential is scoped to your tenant; all data is isolated.
For managing your authorization model (resource types, resources,
subjects, roles, policies), see the
Vengtoo Management API at api.vengtoo.com.
Errors
All errors return a JSON object with an error field:
{ "error": "description of what went wrong" }
| Status | Description |
|---|---|
400 | Invalid request body: malformed JSON or missing required fields |
401 | Missing or invalid credential |
403 | Valid OAuth2 token but insufficient scope |
500 | Internal authorization error |
If Vengtoo is unreachable or returns a 500, default to deny in your
enforcement logic: fail closed, not open.
Authentication
- HTTP: Bearer Auth
API key or OAuth2 access token (e.g., vgt_...)
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
Contact Vengtoo: URL: https://vengtoo.com