Let me address your questions: URL Mapping Issues I notice the documentation mentions that FoAz is deprecated (1) (2) . The URL Mapping feature is available at app.permit.io/url-mapping (1) . However, the specific issues you're experiencing with duplicate mappings and deletion aren't covered in the available documentation. To help our engineers investigate these URL mapping issues: 1. Which Workspace / Project / Env are you using? 2. What specific API calls or UI actions are you performing when editing mappings? 3. Which PDP version are you running? 4. Can you share relevant logs showing the duplicate creation behavior? User Sync Best Practices The recommended point to sync users is during the sign-in or sign-up process, right after authentication verifies the user's identity (3) . This occurs at the "handoff point" - the moment users interact with your system . For Cognito specifically, you have two options after login (4) : • Use Cognito's redirect to a specific URL after login • Use the

code

query parameter they send after login Here's the recommended approach from the documentation :

// frontend/app.mjs  
if (searchParams.get("code") !== null) {  
 //...  
 const syncUser = await fetch("api/sync", {  
 method: "POST",  
 headers: new Headers({ Authorization: `Bearer ${tokens.access_token}` }) ,  
 }) ;  
 //...  
}

Your pre-token generation stage aligns with the recommended practice of syncing "during the login process, as soon as a user's identity is verified" (3) . Lambda Authorizer Options For checking permissions with URL mapping, you should use the

/allowed_url

endpoint on the PDP (1) . Here's the documented approach:

curl --location '<http://localhost:7766/allowed_url>' \  
--header 'Content-Type: application/json' \  
--header 'Accept: application/json' \  
--header 'Authorization: Bearer permit_key_{your_key}' \  
--data '{  
 "user": {  
 "key": "<mailto:raz@permit.io|raz@permit.io>"  
 },  
 "url": "<https://example.com/endpoint?param=value>",  
 "http_method": "POST",  
 "tenant": "default"  
}'

The

/allowed_url

endpoint is specifically designed for URL-based permission checks and is supported in PDP version 0.2.19 or higher .

To learn more, see the sources I considered: [[1] Simple URL Mapping Check](https://docs.permit.io/foaz/url-mapping-check) [[2] Regex URL Mapping Check](https://docs.permit.io/foaz/regex-url-mapping-check) [[3] Sync your Application Data | Permit.io Documentation](https://docs.permit.io/overview/sync-application-data-into-permit) [[4] Cognito and Permit Integration](https://docs.permit.io/authentication/cognito/permit-integration)

Hey @Taha ÇEKEN, tried it myself and it worked. You can take a look at the Proxy Configs API reference here: proxy-config Did you do/try something else?

@Taha ÇEKEN I want to help you and resolve your issue, can you please share a screenshot of the error you get when you perform those actions in the UI? If you want to perform those actions using API requests, and need any help, feel free to ask

Hey @Taha ÇEKEN, We opened a ticket and we'll let you know when this is fixed. Thanks for pointing this out!