AuthZEN 1.0 Conformance

Vengtoo is natively conformant with the OpenID AuthZEN Authorization API 1.0 specification (Final, January 2026). This is not a compatibility shim or translation layer: the primary /access/v1/evaluation endpoint speaks AuthZEN as its native protocol.

What is AuthZEN?

AuthZEN is an open standard from the OpenID Foundation that defines a common API for authorization decisions. It specifies how clients request access decisions and how authorization services respond, enabling interoperability between applications and authorization providers.

The goal: any application that speaks AuthZEN can work with any conformant authorization service, without vendor-specific integration code.

Request format

AuthZEN defines three top-level objects in the request: subject, resource, and action.

Action as an object

The action field is an object containing a name:

{
  "action": {
    "name": "read"
  }
}

Properties

Subject and resource carry key-value data in a properties field, the AuthZEN canonical name. This is the only field the Vengtoo SDKs expose; the backend handles all internal mapping transparently.

{
  "subject": {
    "id": "user-123",
    "type": "user",
    "properties": {
      "department": "engineering"
    }
  },
  "resource": {
    "id": "doc-456",
    "type": "document",
    "properties": {
      "classification": "internal"
    }
  }
}

Required type fields

Both subject.type and resource.type are required. These tell the authorization engine what kind of entity is requesting access and what kind of resource is being accessed.

Response format

The response uses decision (boolean) as the top-level verdict, with additional details nested under context:

{
  "decision": true,
  "context": {
    "reason": "Policy 'editors-can-read-write' grants access",
    "policy_id": "550e8400-e29b-41d4-a716-446655440000",
    "access_path": "role"
  }
}

Field	Type	Description
decision	boolean	Whether access is granted
context.reason	string	Human-readable explanation
context.policy_id	string	ID of the matching policy (when access is granted)
context.access_path	string	How access was resolved: "direct", "role", "group", or "none"

Discovery endpoint

Vengtoo exposes a discovery endpoint at:

GET /.well-known/authzen-configuration

This returns metadata about the authorization service, including supported endpoints and capabilities. Clients can use this to auto-configure against any AuthZEN-conformant service.

X-Request-ID support

Send an X-Request-ID header with your request, and Vengtoo echoes it back in the response. This makes it straightforward to correlate authorization decisions with your application logs and traces.

curl -X POST https://pdp.vengtoo.com/access/v1/evaluation \
  -H "Authorization: Bearer vgt_..." \
  -H "Content-Type: application/json" \
  -H "X-Request-ID: req-abc-123" \
  -d '{ ... }'

The response includes the same header:

X-Request-ID: req-abc-123

Vengtoo extensions

Vengtoo extends the AuthZEN spec with additional fields that are useful for real-world authorization but not part of the base specification:

Extension field	Location	Description
subject.external_id	Request	External identifier from your identity provider
resource.external_id	Request	External identifier from your system of record: use instead of resource.id when your resources are identified by your own IDs
context.access_path	Response	Which access path produced the decision
context.policy_id	Response	The specific policy that matched

These extensions are fully optional. A standard AuthZEN client works with Vengtoo without using any of them.

Specification link

The full AuthZEN 1.0 specification is available at: https://openid.github.io/authzen/

Related

• Authorize API: full request and response reference.
• Access Paths: the access_path response field explained.
• Decisions: what happens after evaluation.