# authzen

Source: https://startwithidentity.com/glossary/authzen/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

AuthZEN is the OpenID Foundation working group, and the [Authorization API 1.0](https://openid.net/specs/authorization-api-1_0-final.html) specification it produced, that standardizes how a policy enforcement point (PEP) asks a policy decision point (PDP) "can this subject perform this action on this resource in this context?" over a JSON HTTP API. Authorization API 1.0 was approved as an OpenID Final Specification in January 2026.

Externalized authorization has been held back by lock-in: every policy engine has its own request format, so swapping engines meant rewriting every enforcement point. AuthZEN fixes the wire format, with a subject, resource, action, and context model, an access evaluation endpoint (and a batch form), search endpoints that answer "which resources can this user see", and a metadata document for discovery. It does not define a policy language, so Cedar, Rego, OpenFGA-style relationship models, and XACML-heritage engines can all sit behind the same API. The working group's 2026 drafts extend the model to AI agent and API gateway use cases. The 1.0 editors are from [Aserto](https://startwithidentity.com/vendors/authorization/aserto/), Axiomatics, and [SGNL](https://startwithidentity.com/vendors/authorization/sgnl/).

See also: [fine-grained authorization](https://startwithidentity.com/glossary/fga/), [ABAC](https://startwithidentity.com/glossary/abac/), [ReBAC](https://startwithidentity.com/glossary/rebac/), [RBAC vs ABAC vs ReBAC](https://startwithidentity.com/guides/fundamentals/rbac-vs-abac-vs-rebac/), [authorization vendors](https://startwithidentity.com/vendors/authorization/), [Atul Tulshibagwale](https://startwithidentity.com/experts/atul-tulshibagwale/)