---
title: Charmhub | openfga interface
description: Interfaces describe the relation between two charms. This interface shows
  opinionated, standardized interface specifications for charm relations.
url: https://charmhub.io/integrations/openfga
---

# openfga

Version 1, published

## Usage

This relation interface describes the expected behaviour of any charm claiming to be able to interact with a OpenFGA.

In most cases, this will be accomplished using the [openfga library](https://charmhub.io/openfga-k8s/libraries/openfga), although charm developers are free to provide alternative libraries as long as they fulfil the behavioural and schematic requirements described in this document.

## Direction

```
flowchart TD
    Requirer -- store_name --> Provider
    Provider -- store_id, token_secret_id, token, grpc_api_url, http_api_url --> Requirer
```

As with all Juju relations, the `openfga` interface consists of two parties: a Provider (openfga charm), and a Requirer (application charm). The Requirer will be expected to expose an authentication store name, and the Provider will create and forward new unique credentials (along with other optional fields), which can be used to access the OpenFGA store.

## Behavior

Both the Requirer and the Provider need to adhere to the following criteria to be considered compatible with the interface.

### Provider

* Is expected to create an authentication store in OpenFGA when the requirer provides the `store_name` field.
* Is expected to expose to the Requirer `store_id`, `token_secret_id`, `token`, `grpc_api_url` and `http_api_url` fields in the *application* databag.

### Requirer

* Is expected to provide the `store_name` it requires in its application databag
* Is expected to use the `store_id`, `token_secret_id`, `token`, `grpc_api_url` and `http_api_url` fields, when exposed by the `Provider`, to set up an OpenFGA connection.

## Relation Data

[[Pydantic Schema]](https://github.com/canonical/charmlibs/blob/main/interfaces/openfga/interface/vv1/schema.py)

### Provider

Provider exposes `store_id`, `token_secret_id`, `token`, `grpc_api_url` and `http_api_url` fields in the **application** databag.

#### Example

```
  relation-info:
  - endpoint: openfga
    related-endpoint: openfga
    application-data:
      token_secret_id: "10559c09-6416-40b0-9402-54b6e28edd3a"
      token: null
      store_id: "01GK13VYZK62Q1T0X55Q2BHYD6"
      grpc_api_url: "http://10.10.0.17:8081"
      http_api_url: "http://10.10.0.17:8080"
```

### Requirer

The Requirer exposes the store name for which authorization is requested in the **application** databag.

#### Example

```
  relation-info:
  - endpoint: openfga
    related-endpoint: openfga
    application-data:
      store_name: "test-store"
```

## Charms implementing this interface

### Providers

### Requirers

## Other charms using this interface

### Providers

* [openfga-k8s](https://charmhub.io/openfga-k8s)

### Requirers

* [ams](https://charmhub.io/ams)
* [temporal-k8s](https://charmhub.io/temporal-k8s)
* [juju-jimm-k8s](https://charmhub.io/juju-jimm-k8s)