Yes, you can configure each OPAL scope to fetch policies from an HTTP endpoint. When configuring a scope using the PUT /scopes endpoint, you can set the

source_type

in the policy configuration (1) . Based on the scope configuration examples, each scope can have its own policy source configuration (2) . The scope configuration structure includes (3) (1) :

{
  "scope_id": "string",
  "policy": {
    "source_type": "string",
    "url": "string",
    "auth": {
      "auth_type": null
    },
    "directories": [
      "."
    ],
    "extensions": [
      ".rego",
      ".json"
    ],
    "bundle_ignore": [
      "string"
    ],
    "manifest": ".manifest",
    "poll_updates": false,
    "branch": "main"
  },
  "data": {
    "entries": []
  }
}

(3) , (1) For HTTP endpoints specifically, you can configure the

OPAL_POLICY_BUNDLE_URL

environment variable to set your API bundle URL, which is relevant for API source types (4) . The

OPAL_POLICY_BUNDLE_SERVER_TYPE

can be set to

HTTP

for HTTP endpoints with bearer token authentication . Each scope maintains its own independent policy configuration, allowing you to point different scopes to different HTTP endpoints or Git repositories as needed (2) .

To learn more, see the sources I considered: [[1] PUT /scopes](https://opal-v2.permit.io/redoc#tag/Scopes/operation/put_scope_scopes_put) [[2] OPAL Scopes](https://docs.opal.ac/overview/scopes) [[3] GET /scopes/{scope_id}](https://opal-v2.permit.io/redoc#tag/Scopes/operation/get_scope_scopes__scope_id__get) [[4] OPAL Configuration Guide | OPAL](https://docs.opal.ac/getting-started/configuration)

To configure each OPAL scope to listen to a specific bundle endpoint, you need to use the REST API to create or update scopes with the appropriate policy configuration. (1) (2) When creating a scope via the PUT /scopes endpoint, you can specify the bundle endpoint in the policy configuration:

{
  "scope_id": "your_scope_id",
  "policy": {
    "source_type": "api_bundle",
    "url": "<https://your-bundle-server.com/bundle.tar.gz>",
    "auth": {
      "auth_type": "bearer",
      "token": "your_bearer_token"
    },
    "poll_updates": true
  },
  "data": {
    "entries": []
  }
}

(3) (1) For API bundle servers, you can configure authentication using: (3) • ​*HTTP Bearer Token*​: Set

source_type

to

api_bundle

and include bearer token in the auth configuration • ​*AWS S3*​: Configure with AWS credentials if using S3 as your bundle server Here's a complete example using curl to configure a scope with a bundle endpoint: (2)

curl --request PUT '<http://opal_server/scopes>'  
--header 'Content-Type: application/json'  
--header 'Authorization: $OPAL_TOKEN'  
--data-raw '{  
 "scope_id": "internal",  
 "policy": {  
 "source_type": "git",  
 "url": "<https://github.com/company/policy>",  
 "auth": {  
 "auth_type": "github_token",  
 "token": "github_token"  
 },  
 "directories": [  
 "internal"  
 ],  
 "extensions": [  
 ".rego",  
 ".json"  
 ],  
 "manifest": ".manifest",  
 "poll_updates": true,  
"branch": "main"  
 },  
 "data": {  
 "entries": []  
 }  
}'

Remember that: • Each scope maintains its own independent policy configuration • The server must be started with

OPAL_SCOPES=1

environment variable • Clie

To learn more, see the sources I considered: [[1] PUT /scopes](https://opal-v2.permit.io/redoc#tag/Scopes/operation/put_scope_scopes_put) [[2] OPAL Scopes](https://docs.opal.ac/overview/scopes) [[3] Policy syncing from API](https://docs.opal.ac/tutorials/track_an_api_bundle_server)