https://linen.dev logo
Join Slack
Powered by
Hello, I am integrating <Permit.io> with my AWS AP...
# permit-saas
t
Hello, I am integrating Permit.io with my AWS API Gateway. My PDP check works fine — when I send a request to 
/allowed_url
, the PDP correctly returns 
"allow": true
for my user and URL. Example PDP request: POST http://172.24.16.56:7766/allowed_url { "user": { "key": "ae454a25-958b-40c0-b004-a02495c0293f" }, "url": "https://api.abex.com.tr/test/api/booking/en/bookings/", "http_method": "GET", "tenant": "default" } RESPONSE { "allow": true, "query": {}, "debug": { "rbac": { "allow": true, "allowing_roles": [ "Employee" ], "code": "allow", "reason": "user 'ae454a25-958b-40c0-b004-a02495c0293f' has the role 'Employee' in tenant 'default', role 'Employee' has the 'read' permission on resources of type 'document'" }, "request": { "action": "read", "resource": { "attributes": { "booking_id": "", "type": "document" }, "type": "document" }, "tenant": "default", "user": { "attributes": { "email": "employee@test.com", "key": "ae454a25-958b-40c0-b004-a02495c0293f", "roles": [ "Employee" ], "tenants": [ "default" ] }, "key": "ae454a25-958b-40c0-b004-a02495c0293f", "synced": true } } }, "result": true } However, when I call the Permit.io proxy endpoint: https://proxy.api.permit.io/proxy/46686b3e7f804317a3143ad1e3a757bc?url=https://api.abex.com.tr/test/api/booking/en/bookings/ I always get the following error: { "detail": "Proxy rule not found, consider checking your 'URL' parameter and the request method, or adding a new mapping rule. Hint: pay attention to the trailing slash, or lack thereof." } my current proxy config { "key": "api-abex", "id": "46686b3e7f804317a3143ad1e3a757bc", "organization_id": "50b10af7e4d44b9aae623be4c2466e5a", "project_id": "167998e377d0412d9822b65450d740ba", "environment_id": "8fb17dd891a741c4bcc55bf2d4c4dd55", "created_at": "2025-09-05T072121+00:00", "updated_at": "2025-09-05T073503+00:00", "secret": "permit_key_3SJZ915SqaxuMSf6GU7WxGk1VDZ9JWzm4Xw3i8HQCGguq3Ra5IZ8gMGVPJ0H8gHWkFiVRdtS2xDrH78JevtQqS", "name": "api-abex", "mapping_rules": [ { "url": "https://api.abex.com.tr/test/api/booking/en/bookings/{booking_id}", "url_type": null, "http_method": "get", "resource": "document", "headers": {}, "action": "read", "priority": null }, { "url": "https://api.abex.com.tr/test/api/booking/en/bookings/", "url_type": null, "http_method": "get", "resource": "document", "headers": {}, "action": "read", "priority": null } ], "auth_mechanism": "Bearer" } and proxy config screenshot added as attachment Thank you!
a
Hi @Taha ÇEKEN, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
The issue is that you're trying to use FoAz (Frontend-only Authorization) , but it's important to note that FoAz is deprecated and no longer supported (1) (2) (3) . The proxy endpoint you're using is part of the deprecated FoAz feature. For your use case with AWS API Gateway, you have better alternatives: Option 1: Use URL Mapping with PDP (Recommended) Since your PDP 
/allowed_url
endpoint is already working correctly, you should continue using that approach (3) . URL Mapping is the replacement for FoAz . Your current PDP check is already configured correctly and returning the expected results. You can integrate this directly with AWS API Gateway using a Lambda authorizer that calls your PDP's 
/allowed_url
endpoint. Option 2: Direct API Gateway Integration According to the documentation, you can implement authorization at the API Gateway layer (4) . The approach involves: 1. Using the PDP as the authorization service 2. Mapping URLs to resources and actions (which you've already done) 3. Having the gateway call the PDP for authorization decisions The documentation mentions that API Gateways like AWS API Gateway can be integrated with Permit.io's PDP . Why the Proxy Error Occurs The FoAz proxy endpoint (`https://proxy.api.permit.io/proxy/`) is part of the deprecated FoAz feature (5) (1) (2) . Even though you have mapping rules configured, the proxy service itself is no longer actively maintained. Recommended Solution Continue using your working PDP 
/allowed_url
endpoint with AWS API Gateway. Since this is already returning correct authorization decisions, you can: 1. Create a Lambda authorizer in AWS API Gateway 2. Have the Lambda call your PDP's 
/allowed_url
endpoint 3. Return the authorization decision to API Gateway This approach is more reliable and follows the current best practices for gateway integration with Permit.io (4) . To help our engineers investigate if you're still experiencing issues with the PDP or policy checks: 1. Which Workspace / Project / Env are you using? 2. What calls are you performing (as SDK code or CURL) ? 3. Which PDP version are you running? 4. Could you share relevant logs from your PDP?
To learn more, see the sources I considered: [[1] API call examples](https://docs.permit.io/foaz/foaz-examples) [[2] Working with the UI](https://docs.permit.io/foaz/visual-guide) [[3] Simple URL Mapping Check](https://docs.permit.io/foaz/url-mapping-check) [[4] Proxies & Gateways Overview](https://docs.permit.io/integrations/gateways/overview) [[5] Detailed API Guide](https://docs.permit.io/foaz/detailed-guide)
Appreciate the feedback! Feel free to ask me again with additional guidance or context.
t
i cannot even make proxy integration with https://google.com. i always get { "detail": "Proxy rule not found, consider checking your 'URL' parameter and the request method, or adding a new mapping rule. Hint: pay attention to the trailing slash, or lack thereof." } request GET https://proxy.api.permit.io/proxy/1449ed22e5da4352bfced109297225c8?url=https://google.com @Ask Inkeep
a
Thanks for tagging me @Taha ÇEKEN. I'll look through relevant sources and get back to you shortly.
The FoAz proxy feature (`https://proxy.api.permit.io/proxy/`) is deprecated and no longer supported (1) (2) (3) . This is why you're getting the "Proxy rule not found" error even with simple URLs like google.com. According to the documentation, FoAz is still available at app.permit.io/foaz-proxy but is deprecated . The proxy endpoint requires exact matching of URL patterns in your mapping rules (1) , and even small differences like trailing slashes can cause the "Proxy rule not found" error. For the proxy to work (when it was supported) , you would need: 1. An exact match between the URL in your mapping rule and the URL parameter 2. The correct HTTP method 3. Proper proxy config setup with mapping rules Example of how mapping rules should be structured :
Copy code
{
  "url": "<https://api.stripe.com/v1/balance>",
  "method": "POST",
  "resource": "balance"
}
​*Recommended Alternative:*​ Instead of using the deprecated FoAz proxy, use the URL Mapping feature with your PDP (4) . The URL Mapping check is available through the 
/allowed_url
endpoint on your PDP (which you mentioned is already working) . To use URL Mapping :
Copy code
docker run -it \
  -p 7766:7000 \
  --env PDP_API_KEY=permit_key_{your_permit_env_key} \
  --env PDP_DEBUG=True \
  permitio/pdp-v2:latest
Then call the PDP directly :
Copy code
curl --location '<http://localhost:7766/allowed_url>' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer permit_key_{your_key}' \
--data '{
  "user": {
    "key": "<mailto:raz@permit.io|raz@permit.io>"
  },
  "url": "<https://example.com/endpoint?param=value>",
  "http_method": "POST",
  "tenant": "default"
}'
Since your PDP 
/allowed_url
endpoint is already working correctly, continue using that approach rather than the deprecated proxy endpoint. To help our engineers investigate if you're still experiencing issues with the PDP or policy checks: 1. Which Workspace / Project / Env are you using? 2. What calls are you performing (as SDK code or CURL) ? 3. Which PDP version are you running? 4. Could you share relevant logs from your PDP?
To learn more, see the sources I considered: [[1] Detailed API Guide](https://docs.permit.io/foaz/detailed-guide) [[2] API call examples](https://docs.permit.io/foaz/foaz-examples) [[3] Working with the UI](https://docs.permit.io/foaz/visual-guide) [[4] Simple URL Mapping Check](https://docs.permit.io/foaz/url-mapping-check)
t
@Ask Inkeep so i was thinking about a lambda authorizer with check. https://docs.permit.io/integrations/gateways/aws-api-gateway/ than i saw this proxy and i thought i can do this without lambda function. if i do this with allowed_url solution do i have to use lambda function again?
a
Thanks for tagging me @Taha ÇEKEN. I'll look through relevant sources and get back to you shortly.
Yes, for AWS API Gateway integration with Permit.io, you'll need to use a Lambda function as an authorizer (1) . AWS API Gateway doesn't have a built-in way to directly call external authorization services like the PDP's 
/allowed_url
endpoint. The AWS API Gateway integration guide shows that you need to create a Lambda function that uses Permit to authorize requests . Here's the approach from the documentation:
Copy code
from permitio import Permit
import asyncio

permit = Permit(
    token="permit_key_xxxxx",
)

def lambda_handler(event, context) :
    user_id = event['headers'].get('permit-user-key')
    action = event['headers'].get('permit-action')
    resource_type = event['headers'].get('permit-resource-type')
    
    # Use asyncio to run the permit.Check() method
    is_allowed = asyncio.run(permit.check(user_id, action, resource_type) )
    
    if is_allowed:
        return {
            'principalId': user_id,
            'policyDocument': {
                'Version': '2012-10-17',
                'Statement': [{
                    'Action': 'execute-api:Invoke',
                    'Effect': 'Allow',
                    'Resource': event['methodArn']
                }]
            }
        }
    else:
        raise Exception('Unauthorized')
The documentation explains that you need to : 1. Create a Lambda function with Permit.io SDK 2. Deploy the Lambda function 3. Create an API Gateway authorizer that uses this Lambda function 4. Attach the authorizer to your API resources The FoAz proxy you discovered is deprecated and no longer supported (2) (3) , which is why you're getting errors. The proxy was designed to eliminate backend code, but it's not a viable solution anymore. For production deployments, the guide also recommends deploying your own PDP in the same region and VPC as your Lambda function to reduce latency (1) . So yes, you'll need to use a Lambda authorizer - there's no way to have AWS API Gateway directly call the PDP's 
/allowed_url
endpoint without an intermediary Lambda function.
To learn more, see the sources I considered: [[1] AWS API Gateway x Permit](https://docs.permit.io/integrations/gateways/aws-api-gateway) [[2] Detailed API Guide](https://docs.permit.io/foaz/detailed-guide) [[3] API call examples](https://docs.permit.io/foaz/foaz-examples)
a
Hey @Taha ÇEKEN , Does the AI’s answer make sense?
t
actually the solution that i was looking for is can i achieve a url_mapping without creating a lambda function. because every request will become pricy for me. Foaz proxy solution did not work for me. Do you have any suggestion ? @Alon Boshi
a
Saw your question, will be back to you 🙏🏼
👀 1
o
Hi @Taha ÇEKEN, sorry for the late reply here (due to the weekend) As the AI indicated the FoAz proxy is being deprecated and is not open to use by new customers - unfortunately ; If you’d like to use the URL mapping feature, you’d need some setup to invoke the PDP - like a Lambda as was suggested here
👍 1
Open in Slack
PreviousNext
Powered by