This message was deleted.

It seems that OPA provides a specific input when executing the system.authz. I’m not 100% sure but I would check if it is possible to store input.identity like

token := input.identity

and importing

system.authz

in your desired rego file.

It’s not. Request headers for /v1/data requests aren’t part of input ever — if you need them to be, you’ll have to adjust your HTTP request and include them in the

input

payload.

Good to know, thanks @Stephan Renatus !

Thanks