AuthZEN (Authorization API)

AuthZEN is the OpenID Foundation working group, and the Authorization API 1.0 specification it produced, that standardizes how a policy enforcement point (PEP) asks a policy decision point (PDP) "can this subject perform this action on this resource in this context?" over a JSON HTTP API. Authorization API 1.0 was approved as an OpenID Final Specification in January 2026.

Externalized authorization has been held back by lock-in: every policy engine has its own request format, so swapping engines meant rewriting every enforcement point. AuthZEN fixes the wire format, with a subject, resource, action, and context model, an access evaluation endpoint (and a batch form), search endpoints that answer "which resources can this user see", and a metadata document for discovery. It does not define a policy language, so Cedar, Rego, OpenFGA-style relationship models, and XACML-heritage engines can all sit behind the same API. The working group's 2026 drafts extend the model to AI agent and API gateway use cases. The 1.0 editors are from Aserto, Axiomatics, and SGNL.

See also: fine-grained authorization, ABAC, ReBAC, RBAC vs ABAC vs ReBAC, authorization vendors, Atul Tulshibagwale