Yes, you can dynamically pull user data from Entra ID using OPAL's data fetchers. Here's how it works: OPAL tracks data from various sources via webhooks and Fetch-Providers (extensible python modules that teach it to load data from sources) (1) . The OPAL server sends instructions to the OPAL-clients to fetch data, and the event via the config field indicates which type of data-fetch-provider the client should use (2) . For your Entra ID scenario, you have two main approaches: ​*Initial Data Load:*​ Initial data is indicated by the server based on

OPAL_DATA_CONFIG_SOURCES

(1) . You can configure this to fetch from your Entra ID endpoint on startup. ​*Dynamic Updates:*​ Subsequent data updates are triggered via the data update webhook . When user data changes in Entra ID, you can trigger OPAL to fetch the updated data by calling:

curl -X POST <http://localhost:7002/data/config> \
 -H "Content-Type: application/json" \
 -d '{
 "entries": [{
 "url": "<http://example_external_data_provider:80/acl/tenant1>",
 "topics": ["tenant_data"],
 "dst_path": "/acl/tenant1"
 }],
"reason": "Add tenant1 data source"
 }'

(3) The key point is that OPAL-clients use data-fetchers both to load the initial baseline data and for subsequent updates as part of an update event (2) . The fetcher will retrieve the data from your Entra ID API and store it in OPA before policy evaluation occurs. You can write custom data-fetch-providers to handle the specific authentication and data transformation needed for Entra ID integration.

To learn more, see the sources I considered: [[1] OPAL TL;DR](https://docs.opal.ac/getting-started/tldr) [[2] Data updates](https://docs.opal.ac/faq/) [[3] Single-Topic Multi-Tenant Configuration](https://docs.opal.ac/tutorials/single-topic-multi-tenant)

Sorry "does not fit"

I want something similiar to what is shown in the diagram

The app receives a request with the user id in a token (jwt). I want to call OPA with that token and call Entra ID dynamically based on that user id.

I can't find documentation here about calling the OPAL Client API directly