Yes, OPAL server scopes can work with HTTP endpoints delivering policy bundles. The documentation shows that OPAL supports both Git repositories and API bundle servers as policy sources. When using scopes, you can configure each scope to use an API bundle server as its policy source (1) (2) . The OPAL server is configured to get its data from API bundle server, extract the bundle, and sync it to the clients (1) . The API server must have a

bundle.tar.gz

file and be able to serve it to the OPAL server . For authentication with bundle servers, you can configure the following environment variables (1) (3) : • `POLICY_BUNDLE_SERVER_TYPE`: Set to

HTTP

(authenticated with bearer token) or

AWS-S3

(1) • `POLICY_BUNDLE_SERVER_TOKEN_ID`: The Secret Token Id • `POLICY_BUNDLE_SERVER_TOKEN`: The Secret Token • `POLICY_BUNDLE_SERVER_AWS_REGION`: The AWS Region if using AWS-S3 The OPAL server provides endpoints for retrieving policy bundles for specific scopes, as shown in the

/scopes/{scope_id}/policy

endpoint (4) , which returns policy bundles in the same format as the general

/policy

endpoint (5) . OPAL server supports two ways to detect changes in the tracked bundle server (1) : • ​*Polling by fixed intervals*​ - checks periodically if there's a new bundle file • ​*Webhook*​ - trigger the OPAL server to fetch a new bundle by issuing an HTTP REST request to

<opal-server-url>/webhook

To learn more, see the sources I considered: [[1] Policy syncing from API](https://docs.opal.ac/tutorials/track_an_api_bundle_server) [[2] OPAL Scopes](https://docs.opal.ac/overview/scopes) [[3] OPAL Configuration Guide | OPAL](https://docs.opal.ac/getting-started/configuration) [[4] GET /scopes/{scope_id}/policy](https://opal-v2.permit.io/redoc#tag/Scopes/operation/get_scope_policy_scopes__scope_id__policy_get) [[5] GET /policy](https://opal-v2.permit.io/redoc#tag/Bundle-Server/operation/get_policy_policy_get)