Based on the URL patterns you're trying to match, you need to use ​*regex URL mapping*​ instead of simple URL mapping (1) . For matching all sub-routes under

dashboards

, you should use the regex pattern with the

url_type

set to

"regex"

. Here's the correct approach:

curl --location '<https://api.permit.io/v2/facts/{project_id}/{env_id}/proxy_configs>' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer YOUR_PERMIT_KEY' \
--data '{
  "name": "Dashboard API",
  "key": "dashboard_api",
  "mapping_rules": [
    {
      "url": "^<https://api>\\.abex\\.com\\.tr/test/api/test/booking/(?P<lang>[^/]+) /dashboards/.*",
      "http_method": "post",
      "resource": "dashboards",
      "action": "view",
      "url_type": "regex"
    }
  ],
  "secret":"abc123notUsed"
}'

The key points for your pattern: • Use

^

to anchor at the start • Escape dots with

\\.

(which becomes

\\\\.

in JSON) • Use

(?P<lang>[^/]+)

to capture the language parameter • Use

.*

at the end to match everything after

dashboards/

• Set

"url_type": "regex"

to enable regex pattern matching The patterns you tried (

/*

,

/**

,

/.*$

) appear to be glob-style patterns, but Permit.io uses proper regex patterns when

url_type

is set to

"regex"

. To help troubleshoot this issue further, please provide: 1. Which Workspace / Project / Env you are using 2. The exact API calls you're making (as SDK code or CURL) 3. Which PDP version you are running 4. Any relevant logs from your PDP showing the matching attempts

To learn more, see the sources I considered: [[1] Regex URL Mapping Check](https://docs.permit.io/foaz/regex-url-mapping-check)

@Ask Inkeep im doing this via frontend and also permitio API. do you have another solution ?

I see the issue - there's a missing

?

in your regex pattern. Looking at your configuration, you have:

"url": "^<https://api>\\.abex\\.com\\.tr/test/api/test/booking/(P<lang>[^/]+) /dashboards/.*"

But it should be

(?P<lang>...)

with the question mark. Here's the corrected pattern:

{
  "url": "^<https://api>\\.abex\\.com\\.tr/test/api/test/booking/(?P<lang>[^/]+) /dashboards/.*",
  "url_type": "regex",
  "http_method": "get",
  "resource": "bkg_dashboard",
  "action": "read"
}

(1) The documentation shows that named capture groups must use

(?P<name>pattern)

syntax . The

?P

is required for named groups in regex. Also, make sure your PDP is running version 0.8.0 or higher, as simple URL mapping support requires this version . To check permissions, use the

/allowed_url

endpoint on your PDP:

curl --location '<http://localhost:7766/allowed_url>' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer permit_key_{your_key}' \
--data '{
  "user": {
    "key": "<mailto:raz@permit.io|raz@permit.io>"
  },
  "url": "<https://api.example.com/users/123/profile>",
  "http_method": "post",
  "tenant": "default"
}'

To help debug this further, please share: 1. Which Workspace / Project / Env you are using 2. The exact

/allowed_url

call you're making to test 3. Which PDP version you are running 4. Relevant PDP logs showing the permission check attempts

To learn more, see the sources I considered: [[1] Regex URL Mapping Check](https://docs.permit.io/foaz/regex-url-mapping-check)

Looking at the regex pattern issue, when using the frontend application, you need to use the pattern without the JSON escaping (1) . The documentation shows that in JSON payloads, backslashes need to be escaped (

\\.

becomes

\\.

) , but in the frontend input field, you should use the direct regex pattern . Try this pattern in the frontend:

^<https://api>\.abex\.com\.tr/test/api/test/booking/(?P<lang>[^/]+) /dashboards/.*

The key differences: • Use single backslashes

\.

instead of

\\.

(no JSON escaping needed in frontend) • Keep the

?P

for named capture groups as shown in the documentation • The pattern

(?P<lang>[^/]+)

captures the language parameter If the frontend still shows validation errors, you could alternatively use the API directly :

curl --location '<https://api.permit.io/v2/facts/{project_id}/{env_id}/proxy_configs>' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer YOUR_PERMIT_KEY' \
--data '{
  "name": "Dashboard API",
  "key": "dashboard_api",
  "mapping_rules": [
    {
      "url": "^<https://api>\\.abex\\.com\\.tr/test/api/test/booking/(?P<lang>[^/]+) /dashboards/.*",
      "http_method": "get",
      "resource": "bkg_dashboard",
      "action": "read",
      "url_type": "regex"
    }
  ],
  "secret":"abc123notUsed"
}'

Note that when using the API, you need the double backslashes for JSON escaping . To help debug this further: 1. Which Workspace / Project / Env are you using? 2. What exact calls are you performing to test (as SDK code or CURL) ? 3. Which PDP version are you running? 4. Could you share relevant logs from your PDP showing the permission check attempts?

To learn more, see the sources I considered: [[1] Regex URL Mapping Check](https://docs.permit.io/foaz/regex-url-mapping-check)