Resource policy · payloads
34 APIs, every hop
Real API payloads through the generic resource policy described in the explainer, 13 of them CDR banking endpoints. For each API, this page has the OpenAPI document, the RFC 9728 metadata it publishes, the request, the response, and every call on the wire behind that answer: the Sideband API calls Kong made to the three PingAuthorize PDPs, the AuthZEN calls the policy made to the entitlements PIP, and the call to the API.
Captured on 21 October 2026 from the demo stack. The 34 APIs are in addition to the 49-case harness on the explainer page.
34APIs captured hop by hop
31as the metadata means
2wrong, but nothing the subject may not see
1leak: showed something it may not see
What was captured
Each hop, as it went over the wire
Each API was called once, 1.5 seconds apart, with packet captures running on the gateway, the entitlements PIP and the API. Hosts are shown as *.example and tokens as eyJ…. The shared secret Kong sends each PDP is left out.
client → KongThe request and the response the client got, with its headers.
Kong → PingAuthorize ×3Sideband API
/sideband/request to the token, risk and response PDPs, then /sideband/response to the response PDP.PingAuthorize → Policy EditorThe decision itself, in external PDP mode. It runs over TLS and isn't shown. Its PIP calls are.
Policy Editor → entitlements PIPAuthZEN 1.0
/access/v1/evaluation and /access/v1/search/resource.Kong → APIThe API's payload before the response PDP filtered it.
Findings
What held, and what didn't
An earlier run of these payloads on the previous policy found five leaks. Four are closed. The allow-list that closed them removes every top-level member the metadata doesn't name, so an API's metadata now has to name the envelope it returns. The CDR, FHIR and paged cases below declare it with keep and count.
| APIs | Result | What happens | Fix |
|---|---|---|---|
| P31 P51 P53 P54 P55 P58 P59 | pass | Every CDR list endpoint is filtered and masked as meant, and keeps the links and meta the Consumer Data Standards require, with meta.totalRecords counting what is shown. Each operation declares keep: ["links", "meta"] and count: "$.meta.totalRecords". |
None needed. A CDR API's metadata must declare both on every list operation. |
| P30 | pass | The same CDR list with no keep: the policy removes every top-level member the metadata doesn't name, so links and meta go. That is what the metadata says, and a CDR client would reject it. |
The authoring mistake to avoid: declare keep. |
| P50 P52 P56 P57 P60 | pass | Single-resource CDR calls (account, transaction and payee detail, customer) are masked exactly. The CDS 422 error envelope passes as it is. | None needed. |
| P37 | leak | A list holding accounts and cards: a card with id a1 passes because the subject may read account a1. A filter has one resource type for the whole list. |
A type_field in the filter, so each item's own type picks the resource type, and an unknown type is removed. |
| P32 | limit | A GraphQL Relay connection is withheld (502) by the policy's shape check. | Under investigation; the check fails closed. |
| P49 | limit | Two JSON documents back to back in one body: only the first is returned. NDJSON (P45, P47) is withheld. | Refuse any body that is not exactly one JSON document. |
| all | cost | Each request makes four Sideband calls, and the policy fetches the RFC 9728 metadata four to six times. | Cache the metadata in the PDP for its lifetime. |
The APIs
Open any API to see its payloads
Text marked SECRET- is planted data the subject may not see. It must never reach the client. The OpenAPI documents are generated from each payload and name the API each is modelled on. They are not the Consumer Data Standards' published specification. Bodies over 8,000 characters are cut.
CDR banking · 13
P30CDR Get Accounts with no keep: the default allow-list removes links and metaCDS Banking: GET /banking/accountspass · 2004 PDP · 3 PIP · 1 upstream
This operation declares no keep, so the policy removes every top-level member the metadata doesn't name: links and meta go, and a CDR client would reject the response. Compare P31 onwards.
OpenAPI 3.1
Modelled on CDS Banking: GET /banking/accounts. Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P30: CDS Banking: GET /banking/accounts"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P30:
get:
operationId: caseP30
summary: "CDR Get Accounts with no keep: the default allow-list removes links and meta"
security:
- bearerAuth: []
parameters:
- name: x-v
in: header
required: true
schema:
type: string
description: Version of the API end point requested by the client
example: "1"
- name: x-fapi-interaction-id
in: header
required: false
schema:
type: string
format: uuid
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
accounts:
type: array
items:
type: object
properties:
accountId:
type: string
creationDate:
type: string
format: date
displayName:
type: string
nickname:
type: string
openStatus:
type: string
isOwned:
type: boolean
accountOwnership:
type: string
maskedNumber:
type: string
productCategory:
type: string
productName:
type: string
links:
type: object
properties:
self:
type: string
first:
type: string
last:
type: string
meta:
type: object
properties:
totalRecords:
type: integer
totalPages:
type: integer
example:
data:
accounts:
- accountId: a1
creationDate: "2024-03-01"
displayName: Everyday a1
nickname: Bills a1
openStatus: OPEN
isOwned: true
accountOwnership: ONE_PARTY
maskedNumber: xxxx xxxx xxxx 1000
productCategory: TRANS_AND_SAVINGS_ACCOUNTS
productName: Everyday Account
- accountId: a2
creationDate: "2024-03-01"
displayName: Everyday a2
nickname: Bills a2
openStatus: OPEN
isOwned: true
accountOwnership: ONE_PARTY
maskedNumber: xxxx xxxx xxxx 1001
productCategory: TRANS_AND_SAVINGS_ACCOUNTS
productName: Everyday Account
- accountId: a3
creationDate: "2024-03-01"
displayName: Everyday a3
nickname: Bills a3
openStatus: OPEN
isOwned: true
accountOwnership: ONE_PARTY
maskedNumber: xxxx xxxx xxxx 1002
productCategory: TRANS_AND_SAVINGS_ACCOUNTS
productName: Everyday Account
- accountId: a4
creationDate: "2024-03-01"
displayName: Everyday a4
nickname: Bills a4
openStatus: OPEN
isOwned: true
accountOwnership: ONE_PARTY
maskedNumber: xxxx xxxx xxxx 1003
productCategory: TRANS_AND_SAVINGS_ACCOUNTS
productName: Everyday Account
links:
self: "https://api.bank.example/cds-au/v1/banking/accounts?page=1"
first: "https://api.bank.example/cds-au/v1/banking/accounts?page=1"
last: "https://api.bank.example/cds-au/v1/banking/accounts?page=1"
meta:
totalRecords: 4
totalPages: 1
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: "CDS Banking: GET /banking/accounts"
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 6 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data.accounts",
"item_id": "accountId",
"action": "read",
"resource_type": "P30"
},
"mask": {
"fields": [
"maskedNumber",
"nickname"
],
"action": "view",
"resource_type": "P30"
}
},
"method": "GET",
"path": "/api/P30"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P30' \
-H 'authorization: Bearer eyJ…' \
-H 'x-v: 1'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 804
date: Thu, 22 Oct 2026 09:43:25 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 32
X-Kong-Proxy-Latency: 4570
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: f9f29d34c24e5d2c7c2526420b36bf66{
"data": {
"accounts": [
{
"accountId": "a1",
"creationDate": "2024-03-01",
"displayName": "Everyday a1",
"nickname": "Bills a1",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1000",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a2",
"creationDate": "2024-03-01",
"displayName": "Everyday a2",
"nickname": "Bills a2",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1001",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a4",
"creationDate": "2024-03-01",
"displayName": "Everyday a4",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
}
]
}
}What the metadata means
{
"data": {
"accounts": [
{
"accountId": "a1",
"creationDate": "2024-03-01",
"displayName": "Everyday a1",
"nickname": "Bills a1",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1000",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a2",
"creationDate": "2024-03-01",
"displayName": "Everyday a2",
"nickname": "Bills a2",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1001",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a4",
"creationDate": "2024-03-01",
"displayName": "Everyday a4",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
}
]
}
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61306,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P30",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61306,
"method": "GET",
"url": "https://gateway.example/api/P30",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61306,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P30",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61306,
"method": "GET",
"url": "https://gateway.example/api/P30",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61306,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P30",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61306,
"method": "GET",
"url": "https://gateway.example/api/P30",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 3199
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "1492"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:25 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": {
"accounts": [
{
"accountId": "a1",
"creationDate": "2024-03-01",
"displayName": "Everyday a1",
"nickname": "Bills a1",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1000",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a2",
"creationDate": "2024-03-01",
"displayName": "Everyday a2",
"nickname": "Bills a2",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1001",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a3",
"creationDate": "2024-03-01",
"displayName": "Everyday a3",
"nickname": "Bills a3",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1002",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a4",
"creationDate": "2024-03-01",
"displayName": "Everyday a4",
"nickname": "Bills a4",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1003",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts?page=1",
"first": "https://api.bank.example/cds-au/v1/banking/accounts?page=1",
"last": "https://api.bank.example/cds-au/v1/banking/accounts?page=1"
},
"meta": {
"totalRecords": 4,
"totalPages": 1
}
},
"request": {
"source_port": 61306,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P30",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P30",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P30",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "1492"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:25 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": {
"accounts": [
{
"accountId": "a1",
"creationDate": "2024-03-01",
"displayName": "Everyday a1",
"nickname": "Bills a1",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1000",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a2",
"creationDate": "2024-03-01",
"displayName": "Everyday a2",
"nickname": "Bills a2",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1001",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a4",
"creationDate": "2024-03-01",
"displayName": "Everyday a4",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
}
]
}
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P30"
}
}Response
{
"results": [
{
"type": "P30",
"id": "a1"
},
{
"type": "P30",
"id": "a2"
},
{
"type": "P30",
"id": "a4"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P30"
}
}Response
{
"results": [
{
"type": "P30",
"id": "a1"
},
{
"type": "P30",
"id": "a2"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P30 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P30
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: f9f29d34c24e5d2c7c2526420b36bf66
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": {
"accounts": [
{
"accountId": "a1",
"creationDate": "2024-03-01",
"displayName": "Everyday a1",
"nickname": "Bills a1",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1000",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a2",
"creationDate": "2024-03-01",
"displayName": "Everyday a2",
"nickname": "Bills a2",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1001",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a3",
"creationDate": "2024-03-01",
"displayName": "Everyday a3",
"nickname": "Bills a3",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1002",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a4",
"creationDate": "2024-03-01",
"displayName": "Everyday a4",
"nickname": "Bills a4",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1003",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts?page=1",
"first": "https://api.bank.example/cds-au/v1/banking/accounts?page=1",
"last": "https://api.bank.example/cds-au/v1/banking/accounts?page=1"
},
"meta": {
"totalRecords": 4,
"totalPages": 1
}
}P31CDR Get Bulk Balances: mask string amounts and purses[*].amountCDS Banking: GET /banking/accounts/balancespass · 2004 PDP · 3 PIP · 1 upstream
Filtered and masked as the metadata means. The operation declares keep: ["links", "meta"], so the CDS envelope stays, and count, so meta.totalRecords says what is shown.
OpenAPI 3.1
Modelled on CDS Banking: GET /banking/accounts/balances. Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P31: CDS Banking: GET /banking/accounts/balances"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P31:
get:
operationId: caseP31
summary: "CDR Get Bulk Balances: mask string amounts and purses[*].amount"
security:
- bearerAuth: []
parameters:
- name: x-v
in: header
required: true
schema:
type: string
description: Version of the API end point requested by the client
example: "1"
- name: x-fapi-interaction-id
in: header
required: false
schema:
type: string
format: uuid
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
balances:
type: array
items:
type: object
properties:
accountId:
type: string
currentBalance:
type: string
description: amount as a decimal string
availableBalance:
type: string
description: amount as a decimal string
creditLimit:
type: string
description: amount as a decimal string
amortisedLimit:
type: string
description: amount as a decimal string
currency:
type: string
purses:
type: array
items:
type: object
properties:
amount:
type: string
description: amount as a decimal string
currency:
type: string
links:
type: object
properties:
self:
type: string
first:
type: string
last:
type: string
meta:
type: object
properties:
totalRecords:
type: integer
totalPages:
type: integer
example:
data:
balances:
- accountId: a1
currentBalance: "1200.00"
availableBalance: "1100.00"
creditLimit: "0.00"
amortisedLimit: "0.00"
currency: AUD
purses:
- amount: "10.00"
currency: USD
- amount: "5.00"
currency: EUR
- accountId: a2
currentBalance: "1201.00"
availableBalance: "1101.00"
creditLimit: "0.00"
amortisedLimit: "0.00"
currency: AUD
purses:
- amount: "11.00"
currency: USD
- amount: "5.00"
currency: EUR
- accountId: a3
currentBalance: "1202.00"
availableBalance: "1102.00"
creditLimit: "0.00"
amortisedLimit: "0.00"
currency: AUD
purses:
- amount: "12.00"
currency: USD
- amount: "5.00"
currency: EUR
- accountId: a4
currentBalance: "1203.00"
availableBalance: "1103.00"
creditLimit: "0.00"
amortisedLimit: "0.00"
currency: AUD
purses:
- amount: "13.00"
currency: USD
- amount: "5.00"
currency: EUR
links:
self: "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1"
first: "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1"
last: "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1"
meta:
totalRecords: 4
totalPages: 1
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: "CDS Banking: GET /banking/accounts/balances"
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data.balances",
"item_id": "accountId",
"action": "read",
"count": "$.meta.totalRecords",
"resource_type": "P31"
},
"mask": {
"fields": [
"currentBalance",
"availableBalance",
"purses[*].amount"
],
"action": "view",
"resource_type": "P31"
},
"keep": [
"links",
"meta"
]
},
"method": "GET",
"path": "/api/P31"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P31' \
-H 'authorization: Bearer eyJ…' \
-H 'x-v: 1'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 874
date: Thu, 22 Oct 2026 09:43:29 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 1234
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: 7dea1d7615426d22c0b84a300f551a26{
"data": {
"balances": [
{
"accountId": "a1",
"currentBalance": "1200.00",
"availableBalance": "1100.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "10.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
},
{
"accountId": "a2",
"currentBalance": "1201.00",
"availableBalance": "1101.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "11.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
},
{
"accountId": "a4",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"currency": "USD"
},
{
"currency": "EUR"
}
]
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1"
},
"meta": {
"totalRecords": 3,
"totalPages": 1
}
}What the metadata means
{
"data": {
"balances": [
{
"accountId": "a1",
"currentBalance": "1200.00",
"availableBalance": "1100.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "10.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
},
{
"accountId": "a2",
"currentBalance": "1201.00",
"availableBalance": "1101.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "11.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
},
{
"accountId": "a4",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"currency": "USD"
},
{
"currency": "EUR"
}
]
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1"
},
"meta": {
"totalRecords": 3,
"totalPages": 1
}
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60710,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P31",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60710,
"method": "GET",
"url": "https://gateway.example/api/P31",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60710,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P31",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60710,
"method": "GET",
"url": "https://gateway.example/api/P31",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60710,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P31",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60710,
"method": "GET",
"url": "https://gateway.example/api/P31",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 3002
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "1279"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:29 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": {
"balances": [
{
"accountId": "a1",
"currentBalance": "1200.00",
"availableBalance": "1100.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "10.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
},
{
"accountId": "a2",
"currentBalance": "1201.00",
"availableBalance": "1101.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "11.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
},
{
"accountId": "a3",
"currentBalance": "1202.00",
"availableBalance": "1102.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "12.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
},
{
"accountId": "a4",
"currentBalance": "1203.00",
"availableBalance": "1103.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "13.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1"
},
"meta": {
"totalRecords": 4,
"totalPages": 1
}
},
"request": {
"source_port": 60710,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P31",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P31",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P31",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "1279"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:29 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": {
"balances": [
{
"accountId": "a1",
"currentBalance": "1200.00",
"availableBalance": "1100.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "10.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
},
{
"accountId": "a2",
"currentBalance": "1201.00",
"availableBalance": "1101.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "11.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
},
{
"accountId": "a4",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"currency": "USD"
},
{
"currency": "EUR"
}
]
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1"
},
"meta": {
"totalRecords": 3,
"totalPages": 1
}
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P31"
}
}Response
{
"results": [
{
"type": "P31",
"id": "a1"
},
{
"type": "P31",
"id": "a2"
},
{
"type": "P31",
"id": "a4"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P31"
}
}Response
{
"results": [
{
"type": "P31",
"id": "a1"
},
{
"type": "P31",
"id": "a2"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P31 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P31
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: 7dea1d7615426d22c0b84a300f551a26
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": {
"balances": [
{
"accountId": "a1",
"currentBalance": "1200.00",
"availableBalance": "1100.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "10.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
},
{
"accountId": "a2",
"currentBalance": "1201.00",
"availableBalance": "1101.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "11.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
},
{
"accountId": "a3",
"currentBalance": "1202.00",
"availableBalance": "1102.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "12.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
},
{
"accountId": "a4",
"currentBalance": "1203.00",
"availableBalance": "1103.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "13.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1"
},
"meta": {
"totalRecords": 4,
"totalPages": 1
}
}P50CDR Get Account Detail: termDeposit variant; mask bsb, accountNumber, maturityAmountCDS Banking: GET /banking/accounts/{accountId}pass · 2004 PDP · 3 PIP · 1 upstream
As the metadata means.
OpenAPI 3.1
Modelled on CDS Banking: GET /banking/accounts/{accountId}. Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P50: CDS Banking: GET /banking/accounts/{accountId}"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P50:
get:
operationId: caseP50
summary: "CDR Get Account Detail: termDeposit variant; mask bsb, accountNumber, maturityAmount"
security:
- bearerAuth: []
parameters:
- name: x-v
in: header
required: true
schema:
type: string
description: Version of the API end point requested by the client
example: "1"
- name: x-fapi-interaction-id
in: header
required: false
schema:
type: string
format: uuid
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
accountId:
type: string
creationDate:
type: string
format: date
displayName:
type: string
nickname:
type: string
openStatus:
type: string
isOwned:
type: boolean
accountOwnership:
type: string
maskedNumber:
type: string
productCategory:
type: string
productName:
type: string
bsb:
type: string
accountNumber:
type: string
bundleName:
type: "null"
specificAccountUType:
type: string
termDeposit:
type: array
items:
type: object
properties:
lodgementDate:
type: string
format: date
maturityDate:
type: string
format: date
maturityAmount:
type: string
description: amount as a decimal string
maturityCurrency:
type: string
maturityInstructions:
type: string
features:
type: array
items:
type: object
properties:
featureType:
type: string
additionalValue:
type: string
depositRates:
type: array
items:
type: object
properties:
depositRateType:
type: string
rate:
type: string
description: amount as a decimal string
calculationFrequency:
type: string
applicationFrequency:
type: string
additionalValue:
type: string
addresses:
type: array
items:
type: object
properties:
addressUType:
type: string
simple:
type: object
properties:
addressLine1:
type: string
postcode:
type: string
city:
type: string
state:
type: string
country:
type: string
links:
type: object
properties:
self:
type: string
meta:
type: object
properties: {}
example:
data:
accountId: a1
creationDate: "2021-07-14"
displayName: Term Deposit 12m
nickname: Rainy day
openStatus: OPEN
isOwned: true
accountOwnership: TWO_PARTY
maskedNumber: xxxxxx4471
productCategory: TERM_DEPOSITS
productName: Fixed Term Deposit
bsb: "062000"
accountNumber: "12344471"
bundleName: null
specificAccountUType: termDeposit
termDeposit:
- lodgementDate: "2026-01-14"
maturityDate: "2027-01-14"
maturityAmount: "51875.00"
maturityCurrency: AUD
maturityInstructions: ROLLED_OVER
features:
- featureType: NOTIFICATIONS
additionalValue: SMS
depositRates:
- depositRateType: FIXED
rate: "0.0375"
calculationFrequency: P1D
applicationFrequency: P12M
additionalValue: P12M
addresses:
- addressUType: simple
simple:
addressLine1: "12 Smith St"
postcode: "2000"
city: Sydney
state: NSW
country: AUS
links:
self: https://api.bank.example/cds-au/v1/banking/accounts/a1
meta: {}
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: "CDS Banking: GET /banking/accounts/{accountId}"
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"mask": {
"fields": [
"bsb",
"accountNumber",
"maturityAmount"
],
"action": "view",
"resource_type": "P50"
}
},
"method": "GET",
"path": "/api/P50"
}
]
}The entitlements this case gives alice at the PIP:
{
"view": []
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P50' \
-H 'authorization: Bearer eyJ…' \
-H 'x-v: 1'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 908
date: Thu, 22 Oct 2026 09:44:09 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 200
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: 5d7dcb654bb1583730c3e06c55294532{
"data": {
"accountId": "a1",
"creationDate": "2021-07-14",
"displayName": "Term Deposit 12m",
"nickname": "Rainy day",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "TWO_PARTY",
"maskedNumber": "xxxxxx4471",
"productCategory": "TERM_DEPOSITS",
"productName": "Fixed Term Deposit",
"bundleName": null,
"specificAccountUType": "termDeposit",
"termDeposit": [
{
"lodgementDate": "2026-01-14",
"maturityDate": "2027-01-14",
"maturityCurrency": "AUD",
"maturityInstructions": "ROLLED_OVER"
}
],
"features": [
{
"featureType": "NOTIFICATIONS",
"additionalValue": "SMS"
}
],
"depositRates": [
{
"depositRateType": "FIXED",
"rate": "0.0375",
"calculationFrequency": "P1D",
"applicationFrequency": "P12M",
"additionalValue": "P12M"
}
],
"addresses": [
{
"addressUType": "simple",
"simple": {
"addressLine1": "12 Smith St",
"postcode": "2000",
"city": "Sydney",
"state": "NSW",
"country": "AUS"
}
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/a1"
},
"meta": {}
}What the metadata means
{
"data": {
"accountId": "a1",
"creationDate": "2021-07-14",
"displayName": "Term Deposit 12m",
"nickname": "Rainy day",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "TWO_PARTY",
"maskedNumber": "xxxxxx4471",
"productCategory": "TERM_DEPOSITS",
"productName": "Fixed Term Deposit",
"bundleName": null,
"specificAccountUType": "termDeposit",
"termDeposit": [
{
"lodgementDate": "2026-01-14",
"maturityDate": "2027-01-14",
"maturityCurrency": "AUD",
"maturityInstructions": "ROLLED_OVER"
}
],
"features": [
{
"featureType": "NOTIFICATIONS",
"additionalValue": "SMS"
}
],
"depositRates": [
{
"depositRateType": "FIXED",
"rate": "0.0375",
"calculationFrequency": "P1D",
"applicationFrequency": "P12M",
"additionalValue": "P12M"
}
],
"addresses": [
{
"addressUType": "simple",
"simple": {
"addressLine1": "12 Smith St",
"postcode": "2000",
"city": "Sydney",
"state": "NSW",
"country": "AUS"
}
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/a1"
},
"meta": {}
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 62794,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P50",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 62794,
"method": "GET",
"url": "https://gateway.example/api/P50",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 62794,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P50",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 62794,
"method": "GET",
"url": "https://gateway.example/api/P50",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 62794,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P50",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 62794,
"method": "GET",
"url": "https://gateway.example/api/P50",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 2727
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "1052"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:09 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": {
"accountId": "a1",
"creationDate": "2021-07-14",
"displayName": "Term Deposit 12m",
"nickname": "Rainy day",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "TWO_PARTY",
"maskedNumber": "xxxxxx4471",
"productCategory": "TERM_DEPOSITS",
"productName": "Fixed Term Deposit",
"bsb": "062000",
"accountNumber": "12344471",
"bundleName": null,
"specificAccountUType": "termDeposit",
"termDeposit": [
{
"lodgementDate": "2026-01-14",
"maturityDate": "2027-01-14",
"maturityAmount": "51875.00",
"maturityCurrency": "AUD",
"maturityInstructions": "ROLLED_OVER"
}
],
"features": [
{
"featureType": "NOTIFICATIONS",
"additionalValue": "SMS"
}
],
"depositRates": [
{
"depositRateType": "FIXED",
"rate": "0.0375",
"calculationFrequency": "P1D",
"applicationFrequency": "P12M",
"additionalValue": "P12M"
}
],
"addresses": [
{
"addressUType": "simple",
"simple": {
"addressLine1": "12 Smith St",
"postcode": "2000",
"city": "Sydney",
"state": "NSW",
"country": "AUS"
}
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/a1"
},
"meta": {}
},
"request": {
"source_port": 62794,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P50",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P50",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P50",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "1052"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:09 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": {
"accountId": "a1",
"creationDate": "2021-07-14",
"displayName": "Term Deposit 12m",
"nickname": "Rainy day",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "TWO_PARTY",
"maskedNumber": "xxxxxx4471",
"productCategory": "TERM_DEPOSITS",
"productName": "Fixed Term Deposit",
"bundleName": null,
"specificAccountUType": "termDeposit",
"termDeposit": [
{
"lodgementDate": "2026-01-14",
"maturityDate": "2027-01-14",
"maturityCurrency": "AUD",
"maturityInstructions": "ROLLED_OVER"
}
],
"features": [
{
"featureType": "NOTIFICATIONS",
"additionalValue": "SMS"
}
],
"depositRates": [
{
"depositRateType": "FIXED",
"rate": "0.0375",
"calculationFrequency": "P1D",
"applicationFrequency": "P12M",
"additionalValue": "P12M"
}
],
"addresses": [
{
"addressUType": "simple",
"simple": {
"addressLine1": "12 Smith St",
"postcode": "2000",
"city": "Sydney",
"state": "NSW",
"country": "AUS"
}
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/a1"
},
"meta": {}
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 102
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "none"
},
"resource": {
"type": "none"
}
}Response
{
"results": [],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P50"
}
}Response
{
"results": [],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P50 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P50
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: 5d7dcb654bb1583730c3e06c55294532
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": {
"accountId": "a1",
"creationDate": "2021-07-14",
"displayName": "Term Deposit 12m",
"nickname": "Rainy day",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "TWO_PARTY",
"maskedNumber": "xxxxxx4471",
"productCategory": "TERM_DEPOSITS",
"productName": "Fixed Term Deposit",
"bsb": "062000",
"accountNumber": "12344471",
"bundleName": null,
"specificAccountUType": "termDeposit",
"termDeposit": [
{
"lodgementDate": "2026-01-14",
"maturityDate": "2027-01-14",
"maturityAmount": "51875.00",
"maturityCurrency": "AUD",
"maturityInstructions": "ROLLED_OVER"
}
],
"features": [
{
"featureType": "NOTIFICATIONS",
"additionalValue": "SMS"
}
],
"depositRates": [
{
"depositRateType": "FIXED",
"rate": "0.0375",
"calculationFrequency": "P1D",
"applicationFrequency": "P12M",
"additionalValue": "P12M"
}
],
"addresses": [
{
"addressUType": "simple",
"simple": {
"addressLine1": "12 Smith St",
"postcode": "2000",
"city": "Sydney",
"state": "NSW",
"country": "AUS"
}
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/a1"
},
"meta": {}
}P51CDR Get Transactions For Account: an a3 transaction slipped into a1's listCDS Banking: GET /banking/accounts/{accountId}/transactionspass · 2004 PDP · 3 PIP · 1 upstream
Filtered and masked as the metadata means. The operation declares keep: ["links", "meta"], so the CDS envelope stays, and count, so meta.totalRecords says what is shown. The a3 transaction is filtered out.
OpenAPI 3.1
Modelled on CDS Banking: GET /banking/accounts/{accountId}/transactions. Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P51: CDS Banking: GET /banking/accounts/{accountId}/transactions"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P51:
get:
operationId: caseP51
summary: "CDR Get Transactions For Account: an a3 transaction slipped into a1's list"
security:
- bearerAuth: []
parameters:
- name: x-v
in: header
required: true
schema:
type: string
description: Version of the API end point requested by the client
example: "1"
- name: x-fapi-interaction-id
in: header
required: false
schema:
type: string
format: uuid
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
transactions:
type: array
items:
type: object
properties:
accountId:
type: string
transactionId:
type: string
isDetailAvailable:
type: boolean
type:
type: string
status:
type: string
description:
type: string
postingDateTime:
type: string
format: date-time
executionDateTime:
type: string
format: date-time
amount:
type: string
description: amount as a decimal string
currency:
type: string
reference:
type: string
merchantName:
type: string
merchantCategoryCode:
type: string
billerCode:
type: "null"
links:
type: object
properties:
self:
type: string
first:
type: string
last:
type: string
meta:
type: object
properties:
totalRecords:
type: integer
totalPages:
type: integer
example:
data:
transactions:
- accountId: a1
transactionId: tx-101
isDetailAvailable: true
type: PAYMENT
status: POSTED
description: WOOLWORTHS 3001 SYDNEY NSW
postingDateTime: "2026-10-11T09:30:00+11:00"
executionDateTime: "2026-10-11T09:29:41+11:00"
amount: "-43.15"
currency: AUD
reference: REF000001
merchantName: WOOLWORTHS
merchantCategoryCode: "5411"
billerCode: null
- accountId: a1
transactionId: tx-102
isDetailAvailable: true
type: PAYMENT
status: PENDING
description: WOOLWORTHS 3002 SYDNEY NSW
postingDateTime: "2026-10-12T09:30:00+11:00"
executionDateTime: "2026-10-12T09:29:41+11:00"
amount: "-44.15"
currency: AUD
reference: REF000002
merchantName: WOOLWORTHS
merchantCategoryCode: "5411"
billerCode: null
- accountId: a3
transactionId: tx-903
isDetailAvailable: true
type: PAYMENT
status: POSTED
description: WOOLWORTHS 3003 SYDNEY NSW
postingDateTime: "2026-10-13T09:30:00+11:00"
executionDateTime: "2026-10-13T09:29:41+11:00"
amount: "-45.15"
currency: AUD
reference: REF000003
merchantName: WOOLWORTHS
merchantCategoryCode: "5411"
billerCode: null
links:
self: "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25"
first: "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25"
last: "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25"
meta:
totalRecords: 3
totalPages: 1
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: "CDS Banking: GET /banking/accounts/{accountId}/transactions"
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data.transactions",
"item_id": "accountId",
"action": "read",
"count": "$.meta.totalRecords",
"resource_type": "P51"
},
"mask": {
"fields": [
"description",
"merchantName",
"reference"
],
"action": "view",
"resource_type": "P51"
},
"keep": [
"links",
"meta"
]
},
"method": "GET",
"path": "/api/P51"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1"
],
"view": [
"a1"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P51' \
-H 'authorization: Bearer eyJ…' \
-H 'x-v: 1'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 1123
date: Thu, 22 Oct 2026 09:44:11 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 134
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: 70cd5d06a09651282f1b640856228b3a{
"data": {
"transactions": [
{
"accountId": "a1",
"transactionId": "tx-101",
"isDetailAvailable": true,
"type": "PAYMENT",
"status": "POSTED",
"description": "WOOLWORTHS 3001 SYDNEY NSW",
"postingDateTime": "2026-10-11T09:30:00+11:00",
"executionDateTime": "2026-10-11T09:29:41+11:00",
"amount": "-43.15",
"currency": "AUD",
"reference": "REF000001",
"merchantName": "WOOLWORTHS",
"merchantCategoryCode": "5411",
"billerCode": null
},
{
"accountId": "a1",
"transactionId": "tx-102",
"isDetailAvailable": true,
"type": "PAYMENT",
"status": "PENDING",
"description": "WOOLWORTHS 3002 SYDNEY NSW",
"postingDateTime": "2026-10-12T09:30:00+11:00",
"executionDateTime": "2026-10-12T09:29:41+11:00",
"amount": "-44.15",
"currency": "AUD",
"reference": "REF000002",
"merchantName": "WOOLWORTHS",
"merchantCategoryCode": "5411",
"billerCode": null
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25"
},
"meta": {
"totalRecords": 2,
"totalPages": 1
}
}What the metadata means
{
"data": {
"transactions": [
{
"accountId": "a1",
"transactionId": "tx-101",
"isDetailAvailable": true,
"type": "PAYMENT",
"status": "POSTED",
"description": "WOOLWORTHS 3001 SYDNEY NSW",
"postingDateTime": "2026-10-11T09:30:00+11:00",
"executionDateTime": "2026-10-11T09:29:41+11:00",
"amount": "-43.15",
"currency": "AUD",
"reference": "REF000001",
"merchantName": "WOOLWORTHS",
"merchantCategoryCode": "5411",
"billerCode": null
},
{
"accountId": "a1",
"transactionId": "tx-102",
"isDetailAvailable": true,
"type": "PAYMENT",
"status": "PENDING",
"description": "WOOLWORTHS 3002 SYDNEY NSW",
"postingDateTime": "2026-10-12T09:30:00+11:00",
"executionDateTime": "2026-10-12T09:29:41+11:00",
"amount": "-44.15",
"currency": "AUD",
"reference": "REF000002",
"merchantName": "WOOLWORTHS",
"merchantCategoryCode": "5411",
"billerCode": null
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25"
},
"meta": {
"totalRecords": 2,
"totalPages": 1
}
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 62796,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P51",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 62796,
"method": "GET",
"url": "https://gateway.example/api/P51",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 62796,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P51",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 62796,
"method": "GET",
"url": "https://gateway.example/api/P51",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 62796,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P51",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 62796,
"method": "GET",
"url": "https://gateway.example/api/P51",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 3307
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "1596"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:11 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": {
"transactions": [
{
"accountId": "a1",
"transactionId": "tx-101",
"isDetailAvailable": true,
"type": "PAYMENT",
"status": "POSTED",
"description": "WOOLWORTHS 3001 SYDNEY NSW",
"postingDateTime": "2026-10-11T09:30:00+11:00",
"executionDateTime": "2026-10-11T09:29:41+11:00",
"amount": "-43.15",
"currency": "AUD",
"reference": "REF000001",
"merchantName": "WOOLWORTHS",
"merchantCategoryCode": "5411",
"billerCode": null
},
{
"accountId": "a1",
"transactionId": "tx-102",
"isDetailAvailable": true,
"type": "PAYMENT",
"status": "PENDING",
"description": "WOOLWORTHS 3002 SYDNEY NSW",
"postingDateTime": "2026-10-12T09:30:00+11:00",
"executionDateTime": "2026-10-12T09:29:41+11:00",
"amount": "-44.15",
"currency": "AUD",
"reference": "REF000002",
"merchantName": "WOOLWORTHS",
"merchantCategoryCode": "5411",
"billerCode": null
},
{
"accountId": "a3",
"transactionId": "tx-903",
"isDetailAvailable": true,
"type": "PAYMENT",
"status": "POSTED",
"description": "WOOLWORTHS 3003 SYDNEY NSW",
"postingDateTime": "2026-10-13T09:30:00+11:00",
"executionDateTime": "2026-10-13T09:29:41+11:00",
"amount": "-45.15",
"currency": "AUD",
"reference": "REF000003",
"merchantName": "WOOLWORTHS",
"merchantCategoryCode": "5411",
"billerCode": null
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25"
},
"meta": {
"totalRecords": 3,
"totalPages": 1
}
},
"request": {
"source_port": 62796,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P51",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P51",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P51",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "1596"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:11 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": {
"transactions": [
{
"accountId": "a1",
"transactionId": "tx-101",
"isDetailAvailable": true,
"type": "PAYMENT",
"status": "POSTED",
"description": "WOOLWORTHS 3001 SYDNEY NSW",
"postingDateTime": "2026-10-11T09:30:00+11:00",
"executionDateTime": "2026-10-11T09:29:41+11:00",
"amount": "-43.15",
"currency": "AUD",
"reference": "REF000001",
"merchantName": "WOOLWORTHS",
"merchantCategoryCode": "5411",
"billerCode": null
},
{
"accountId": "a1",
"transactionId": "tx-102",
"isDetailAvailable": true,
"type": "PAYMENT",
"status": "PENDING",
"description": "WOOLWORTHS 3002 SYDNEY NSW",
"postingDateTime": "2026-10-12T09:30:00+11:00",
"executionDateTime": "2026-10-12T09:29:41+11:00",
"amount": "-44.15",
"currency": "AUD",
"reference": "REF000002",
"merchantName": "WOOLWORTHS",
"merchantCategoryCode": "5411",
"billerCode": null
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25"
},
"meta": {
"totalRecords": 2,
"totalPages": 1
}
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P51"
}
}Response
{
"results": [
{
"type": "P51",
"id": "a1"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P51"
}
}Response
{
"results": [
{
"type": "P51",
"id": "a1"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P51 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P51
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: 70cd5d06a09651282f1b640856228b3a
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": {
"transactions": [
{
"accountId": "a1",
"transactionId": "tx-101",
"isDetailAvailable": true,
"type": "PAYMENT",
"status": "POSTED",
"description": "WOOLWORTHS 3001 SYDNEY NSW",
"postingDateTime": "2026-10-11T09:30:00+11:00",
"executionDateTime": "2026-10-11T09:29:41+11:00",
"amount": "-43.15",
"currency": "AUD",
"reference": "REF000001",
"merchantName": "WOOLWORTHS",
"merchantCategoryCode": "5411",
"billerCode": null
},
{
"accountId": "a1",
"transactionId": "tx-102",
"isDetailAvailable": true,
"type": "PAYMENT",
"status": "PENDING",
"description": "WOOLWORTHS 3002 SYDNEY NSW",
"postingDateTime": "2026-10-12T09:30:00+11:00",
"executionDateTime": "2026-10-12T09:29:41+11:00",
"amount": "-44.15",
"currency": "AUD",
"reference": "REF000002",
"merchantName": "WOOLWORTHS",
"merchantCategoryCode": "5411",
"billerCode": null
},
{
"accountId": "a3",
"transactionId": "tx-903",
"isDetailAvailable": true,
"type": "PAYMENT",
"status": "POSTED",
"description": "WOOLWORTHS 3003 SYDNEY NSW",
"postingDateTime": "2026-10-13T09:30:00+11:00",
"executionDateTime": "2026-10-13T09:29:41+11:00",
"amount": "-45.15",
"currency": "AUD",
"reference": "REF000003",
"merchantName": "WOOLWORTHS",
"merchantCategoryCode": "5411",
"billerCode": null
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions?page=1&page-size=25"
},
"meta": {
"totalRecords": 3,
"totalPages": 1
}
}P52CDR Get Transaction Detail: NPP extendedData.x2p101Payload, mask payer and payeeCDS Banking: GET /banking/accounts/{accountId}/transactions/{transactionId}pass · 2004 PDP · 3 PIP · 1 upstream
As the metadata means.
OpenAPI 3.1
Modelled on CDS Banking: GET /banking/accounts/{accountId}/transactions/{transactionId}. Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P52: CDS Banking: GET /banking/accounts/{accountId}/transactions/{transactionId}"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P52:
get:
operationId: caseP52
summary: "CDR Get Transaction Detail: NPP extendedData.x2p101Payload, mask payer and payee"
security:
- bearerAuth: []
parameters:
- name: x-v
in: header
required: true
schema:
type: string
description: Version of the API end point requested by the client
example: "1"
- name: x-fapi-interaction-id
in: header
required: false
schema:
type: string
format: uuid
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
accountId:
type: string
transactionId:
type: string
isDetailAvailable:
type: boolean
type:
type: string
status:
type: string
description:
type: string
postingDateTime:
type: string
format: date-time
executionDateTime:
type: string
format: date-time
amount:
type: string
description: amount as a decimal string
currency:
type: string
reference:
type: string
merchantName:
type: string
merchantCategoryCode:
type: string
billerCode:
type: "null"
extendedData:
type: object
properties:
payer:
type: string
payee:
type: string
extensionUType:
type: string
x2p101Payload:
type: object
properties:
extendedDescription:
type: string
endToEndId:
type: string
purposeCode:
type: string
service:
type: string
links:
type: object
properties:
self:
type: string
meta:
type: object
properties: {}
example:
data:
accountId: a1
transactionId: tx-101
isDetailAvailable: true
type: PAYMENT
status: POSTED
description: WOOLWORTHS 3001 SYDNEY NSW
postingDateTime: "2026-10-11T09:30:00+11:00"
executionDateTime: "2026-10-11T09:29:41+11:00"
amount: "-43.15"
currency: AUD
reference: REF000001
merchantName: WOOLWORTHS
merchantCategoryCode: "5411"
billerCode: null
extendedData:
payer: J CITIZEN
payee: A NGUYEN
extensionUType: x2p101Payload
x2p101Payload:
extendedDescription: "Rent for October, unit 4/12 Smith St"
endToEndId: E2E-7781
purposeCode: RNT
service: X2P1.01
links:
self: https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions/tx-101
meta: {}
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: "CDS Banking: GET /banking/accounts/{accountId}/transactions/{transactionId}"
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"mask": {
"fields": [
"payer",
"payee",
"extendedDescription"
],
"action": "view",
"resource_type": "P52"
}
},
"method": "GET",
"path": "/api/P52"
}
]
}The entitlements this case gives alice at the PIP:
{
"view": []
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P52' \
-H 'authorization: Bearer eyJ…' \
-H 'x-v: 1'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 620
date: Thu, 22 Oct 2026 09:44:12 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 134
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: af84483d0d1276511b5b0b366e2fe243{
"data": {
"accountId": "a1",
"transactionId": "tx-101",
"isDetailAvailable": true,
"type": "PAYMENT",
"status": "POSTED",
"description": "WOOLWORTHS 3001 SYDNEY NSW",
"postingDateTime": "2026-10-11T09:30:00+11:00",
"executionDateTime": "2026-10-11T09:29:41+11:00",
"amount": "-43.15",
"currency": "AUD",
"reference": "REF000001",
"merchantName": "WOOLWORTHS",
"merchantCategoryCode": "5411",
"billerCode": null,
"extendedData": {
"extensionUType": "x2p101Payload",
"x2p101Payload": {
"endToEndId": "E2E-7781",
"purposeCode": "RNT"
},
"service": "X2P1.01"
}
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions/tx-101"
},
"meta": {}
}What the metadata means
{
"data": {
"accountId": "a1",
"transactionId": "tx-101",
"isDetailAvailable": true,
"type": "PAYMENT",
"status": "POSTED",
"description": "WOOLWORTHS 3001 SYDNEY NSW",
"postingDateTime": "2026-10-11T09:30:00+11:00",
"executionDateTime": "2026-10-11T09:29:41+11:00",
"amount": "-43.15",
"currency": "AUD",
"reference": "REF000001",
"merchantName": "WOOLWORTHS",
"merchantCategoryCode": "5411",
"billerCode": null,
"extendedData": {
"extensionUType": "x2p101Payload",
"x2p101Payload": {
"endToEndId": "E2E-7781",
"purposeCode": "RNT"
},
"service": "X2P1.01"
}
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions/tx-101"
},
"meta": {}
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 62808,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P52",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 62808,
"method": "GET",
"url": "https://gateway.example/api/P52",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 62808,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P52",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 62808,
"method": "GET",
"url": "https://gateway.example/api/P52",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 62808,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P52",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 62808,
"method": "GET",
"url": "https://gateway.example/api/P52",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 2393
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "769"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:12 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": {
"accountId": "a1",
"transactionId": "tx-101",
"isDetailAvailable": true,
"type": "PAYMENT",
"status": "POSTED",
"description": "WOOLWORTHS 3001 SYDNEY NSW",
"postingDateTime": "2026-10-11T09:30:00+11:00",
"executionDateTime": "2026-10-11T09:29:41+11:00",
"amount": "-43.15",
"currency": "AUD",
"reference": "REF000001",
"merchantName": "WOOLWORTHS",
"merchantCategoryCode": "5411",
"billerCode": null,
"extendedData": {
"payer": "J CITIZEN",
"payee": "A NGUYEN",
"extensionUType": "x2p101Payload",
"x2p101Payload": {
"extendedDescription": "Rent for October, unit 4/12 Smith St",
"endToEndId": "E2E-7781",
"purposeCode": "RNT"
},
"service": "X2P1.01"
}
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions/tx-101"
},
"meta": {}
},
"request": {
"source_port": 62808,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P52",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P52",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P52",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "769"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:12 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": {
"accountId": "a1",
"transactionId": "tx-101",
"isDetailAvailable": true,
"type": "PAYMENT",
"status": "POSTED",
"description": "WOOLWORTHS 3001 SYDNEY NSW",
"postingDateTime": "2026-10-11T09:30:00+11:00",
"executionDateTime": "2026-10-11T09:29:41+11:00",
"amount": "-43.15",
"currency": "AUD",
"reference": "REF000001",
"merchantName": "WOOLWORTHS",
"merchantCategoryCode": "5411",
"billerCode": null,
"extendedData": {
"extensionUType": "x2p101Payload",
"x2p101Payload": {
"endToEndId": "E2E-7781",
"purposeCode": "RNT"
},
"service": "X2P1.01"
}
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions/tx-101"
},
"meta": {}
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 102
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "none"
},
"resource": {
"type": "none"
}
}Response
{
"results": [],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P52"
}
}Response
{
"results": [],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P52 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P52
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: af84483d0d1276511b5b0b366e2fe243
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": {
"accountId": "a1",
"transactionId": "tx-101",
"isDetailAvailable": true,
"type": "PAYMENT",
"status": "POSTED",
"description": "WOOLWORTHS 3001 SYDNEY NSW",
"postingDateTime": "2026-10-11T09:30:00+11:00",
"executionDateTime": "2026-10-11T09:29:41+11:00",
"amount": "-43.15",
"currency": "AUD",
"reference": "REF000001",
"merchantName": "WOOLWORTHS",
"merchantCategoryCode": "5411",
"billerCode": null,
"extendedData": {
"payer": "J CITIZEN",
"payee": "A NGUYEN",
"extensionUType": "x2p101Payload",
"x2p101Payload": {
"extendedDescription": "Rent for October, unit 4/12 Smith St",
"endToEndId": "E2E-7781",
"purposeCode": "RNT"
},
"service": "X2P1.01"
}
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/a1/transactions/tx-101"
},
"meta": {}
}P53CDR Get Bulk Direct Debits: data.directDebitAuthorisations[], nested authorisedEntityCDS Banking: GET /banking/accounts/direct-debitspass · 2004 PDP · 3 PIP · 1 upstream
Filtered and masked as the metadata means. The operation declares keep: ["links", "meta"], so the CDS envelope stays, and count, so meta.totalRecords says what is shown.
OpenAPI 3.1
Modelled on CDS Banking: GET /banking/accounts/direct-debits. Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P53: CDS Banking: GET /banking/accounts/direct-debits"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P53:
get:
operationId: caseP53
summary: "CDR Get Bulk Direct Debits: data.directDebitAuthorisations[], nested authorisedEntity"
security:
- bearerAuth: []
parameters:
- name: x-v
in: header
required: true
schema:
type: string
description: Version of the API end point requested by the client
example: "1"
- name: x-fapi-interaction-id
in: header
required: false
schema:
type: string
format: uuid
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
directDebitAuthorisations:
type: array
items:
type: object
properties:
accountId:
type: string
authorisedEntity:
type: object
properties:
description:
type: string
financialInstitution:
type: string
abn:
type: string
acn:
type: "null"
arbn:
type: "null"
lastDebitDateTime:
type: string
format: date-time
lastDebitAmount:
type: string
description: amount as a decimal string
links:
type: object
properties:
self:
type: string
first:
type: string
last:
type: string
meta:
type: object
properties:
totalRecords:
type: integer
totalPages:
type: integer
example:
data:
directDebitAuthorisations:
- accountId: a1
authorisedEntity:
description: AGL ENERGY
financialInstitution: ANZ
abn: "74000123456"
acn: null
arbn: null
lastDebitDateTime: "2026-10-02T03:00:00+10:00"
lastDebitAmount: "180.40"
- accountId: a2
authorisedEntity:
description: AGL ENERGY
financialInstitution: ANZ
abn: "74001123456"
acn: null
arbn: null
lastDebitDateTime: "2026-10-02T03:00:00+10:00"
lastDebitAmount: "181.40"
- accountId: a3
authorisedEntity:
description: AGL ENERGY
financialInstitution: ANZ
abn: "74002123456"
acn: null
arbn: null
lastDebitDateTime: "2026-10-02T03:00:00+10:00"
lastDebitAmount: "182.40"
- accountId: a4
authorisedEntity:
description: AGL ENERGY
financialInstitution: ANZ
abn: "74003123456"
acn: null
arbn: null
lastDebitDateTime: "2026-10-02T03:00:00+10:00"
lastDebitAmount: "183.40"
links:
self: "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25"
first: "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25"
last: "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25"
meta:
totalRecords: 4
totalPages: 1
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: "CDS Banking: GET /banking/accounts/direct-debits"
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data.directDebitAuthorisations",
"item_id": "accountId",
"action": "read",
"count": "$.meta.totalRecords",
"resource_type": "P53"
},
"mask": {
"fields": [
"lastDebitAmount",
"authorisedEntity.abn",
"authorisedEntity.arbn"
],
"action": "view",
"resource_type": "P53"
},
"keep": [
"links",
"meta"
]
},
"method": "GET",
"path": "/api/P53"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P53' \
-H 'authorization: Bearer eyJ…' \
-H 'x-v: 1'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 960
date: Thu, 22 Oct 2026 09:44:14 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 164
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: e3c1ae465e3fef7a0004a57cf0535038{
"data": {
"directDebitAuthorisations": [
{
"accountId": "a1",
"authorisedEntity": {
"description": "AGL ENERGY",
"financialInstitution": "ANZ",
"abn": "74000123456",
"acn": null,
"arbn": null
},
"lastDebitDateTime": "2026-10-02T03:00:00+10:00",
"lastDebitAmount": "180.40"
},
{
"accountId": "a2",
"authorisedEntity": {
"description": "AGL ENERGY",
"financialInstitution": "ANZ",
"abn": "74001123456",
"acn": null,
"arbn": null
},
"lastDebitDateTime": "2026-10-02T03:00:00+10:00",
"lastDebitAmount": "181.40"
},
{
"accountId": "a4",
"authorisedEntity": {
"description": "AGL ENERGY",
"financialInstitution": "ANZ",
"acn": null
},
"lastDebitDateTime": "2026-10-02T03:00:00+10:00"
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25"
},
"meta": {
"totalRecords": 3,
"totalPages": 1
}
}What the metadata means
{
"data": {
"directDebitAuthorisations": [
{
"accountId": "a1",
"authorisedEntity": {
"description": "AGL ENERGY",
"financialInstitution": "ANZ",
"abn": "74000123456",
"acn": null,
"arbn": null
},
"lastDebitDateTime": "2026-10-02T03:00:00+10:00",
"lastDebitAmount": "180.40"
},
{
"accountId": "a2",
"authorisedEntity": {
"description": "AGL ENERGY",
"financialInstitution": "ANZ",
"abn": "74001123456",
"acn": null,
"arbn": null
},
"lastDebitDateTime": "2026-10-02T03:00:00+10:00",
"lastDebitAmount": "181.40"
},
{
"accountId": "a4",
"authorisedEntity": {
"description": "AGL ENERGY",
"financialInstitution": "ANZ",
"acn": null
},
"lastDebitDateTime": "2026-10-02T03:00:00+10:00"
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25"
},
"meta": {
"totalRecords": 3,
"totalPages": 1
}
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 62810,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P53",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 62810,
"method": "GET",
"url": "https://gateway.example/api/P53",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 62810,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P53",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 62810,
"method": "GET",
"url": "https://gateway.example/api/P53",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 62810,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P53",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 62810,
"method": "GET",
"url": "https://gateway.example/api/P53",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 2989
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "1314"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:14 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": {
"directDebitAuthorisations": [
{
"accountId": "a1",
"authorisedEntity": {
"description": "AGL ENERGY",
"financialInstitution": "ANZ",
"abn": "74000123456",
"acn": null,
"arbn": null
},
"lastDebitDateTime": "2026-10-02T03:00:00+10:00",
"lastDebitAmount": "180.40"
},
{
"accountId": "a2",
"authorisedEntity": {
"description": "AGL ENERGY",
"financialInstitution": "ANZ",
"abn": "74001123456",
"acn": null,
"arbn": null
},
"lastDebitDateTime": "2026-10-02T03:00:00+10:00",
"lastDebitAmount": "181.40"
},
{
"accountId": "a3",
"authorisedEntity": {
"description": "AGL ENERGY",
"financialInstitution": "ANZ",
"abn": "74002123456",
"acn": null,
"arbn": null
},
"lastDebitDateTime": "2026-10-02T03:00:00+10:00",
"lastDebitAmount": "182.40"
},
{
"accountId": "a4",
"authorisedEntity": {
"description": "AGL ENERGY",
"financialInstitution": "ANZ",
"abn": "74003123456",
"acn": null,
"arbn": null
},
"lastDebitDateTime": "2026-10-02T03:00:00+10:00",
"lastDebitAmount": "183.40"
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25"
},
"meta": {
"totalRecords": 4,
"totalPages": 1
}
},
"request": {
"source_port": 62810,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P53",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P53",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P53",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "1314"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:14 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": {
"directDebitAuthorisations": [
{
"accountId": "a1",
"authorisedEntity": {
"description": "AGL ENERGY",
"financialInstitution": "ANZ",
"abn": "74000123456",
"acn": null,
"arbn": null
},
"lastDebitDateTime": "2026-10-02T03:00:00+10:00",
"lastDebitAmount": "180.40"
},
{
"accountId": "a2",
"authorisedEntity": {
"description": "AGL ENERGY",
"financialInstitution": "ANZ",
"abn": "74001123456",
"acn": null,
"arbn": null
},
"lastDebitDateTime": "2026-10-02T03:00:00+10:00",
"lastDebitAmount": "181.40"
},
{
"accountId": "a4",
"authorisedEntity": {
"description": "AGL ENERGY",
"financialInstitution": "ANZ",
"acn": null
},
"lastDebitDateTime": "2026-10-02T03:00:00+10:00"
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25"
},
"meta": {
"totalRecords": 3,
"totalPages": 1
}
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P53"
}
}Response
{
"results": [
{
"type": "P53",
"id": "a1"
},
{
"type": "P53",
"id": "a2"
},
{
"type": "P53",
"id": "a4"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P53"
}
}Response
{
"results": [
{
"type": "P53",
"id": "a1"
},
{
"type": "P53",
"id": "a2"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P53 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P53
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: e3c1ae465e3fef7a0004a57cf0535038
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": {
"directDebitAuthorisations": [
{
"accountId": "a1",
"authorisedEntity": {
"description": "AGL ENERGY",
"financialInstitution": "ANZ",
"abn": "74000123456",
"acn": null,
"arbn": null
},
"lastDebitDateTime": "2026-10-02T03:00:00+10:00",
"lastDebitAmount": "180.40"
},
{
"accountId": "a2",
"authorisedEntity": {
"description": "AGL ENERGY",
"financialInstitution": "ANZ",
"abn": "74001123456",
"acn": null,
"arbn": null
},
"lastDebitDateTime": "2026-10-02T03:00:00+10:00",
"lastDebitAmount": "181.40"
},
{
"accountId": "a3",
"authorisedEntity": {
"description": "AGL ENERGY",
"financialInstitution": "ANZ",
"abn": "74002123456",
"acn": null,
"arbn": null
},
"lastDebitDateTime": "2026-10-02T03:00:00+10:00",
"lastDebitAmount": "182.40"
},
{
"accountId": "a4",
"authorisedEntity": {
"description": "AGL ENERGY",
"financialInstitution": "ANZ",
"abn": "74003123456",
"acn": null,
"arbn": null
},
"lastDebitDateTime": "2026-10-02T03:00:00+10:00",
"lastDebitAmount": "183.40"
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/direct-debits?page=1&page-size=25"
},
"meta": {
"totalRecords": 4,
"totalPages": 1
}
}P54CDR Get Scheduled Payments Bulk: id at from.accountId, amounts in paymentSet[*]CDS Banking: GET /banking/payments/scheduledpass · 2004 PDP · 3 PIP · 1 upstream
Filtered and masked as the metadata means. The operation declares keep: ["links", "meta"], so the CDS envelope stays, and count, so meta.totalRecords says what is shown.
OpenAPI 3.1
Modelled on CDS Banking: GET /banking/payments/scheduled. Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P54: CDS Banking: GET /banking/payments/scheduled"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P54:
get:
operationId: caseP54
summary: "CDR Get Scheduled Payments Bulk: id at from.accountId, amounts in paymentSet[*]"
security:
- bearerAuth: []
parameters:
- name: x-v
in: header
required: true
schema:
type: string
description: Version of the API end point requested by the client
example: "1"
- name: x-fapi-interaction-id
in: header
required: false
schema:
type: string
format: uuid
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
scheduledPayments:
type: array
items:
type: object
properties:
scheduledPaymentId:
type: string
nickname:
type: string
payerReference:
type: string
payeeReference:
type: string
status:
type: string
from:
type: object
properties:
accountId:
type: string
paymentSet:
type: array
items:
type: object
properties:
to:
type: object
properties:
toUType:
type: string
domestic:
type: object
properties:
payeeAccountUType:
type: string
account:
type: object
properties:
accountName:
type: string
bsb:
type: string
accountNumber:
type: string
isAmountCalculated:
type: boolean
amount:
type: string
description: amount as a decimal string
currency:
type: string
recurrence:
type: object
properties:
nextPaymentDate:
type: string
format: date
recurrenceUType:
type: string
intervalSchedule:
type: object
properties:
paymentsRemaining:
type: integer
intervals:
type: array
items:
type: object
properties:
interval:
type: string
links:
type: object
properties:
self:
type: string
first:
type: string
last:
type: string
meta:
type: object
properties:
totalRecords:
type: integer
totalPages:
type: integer
example:
data:
scheduledPayments:
- scheduledPaymentId: sp-a1
nickname: Rent
payerReference: RENT
payeeReference: UNIT4-a1
status: ACTIVE
from:
accountId: a1
paymentSet:
- to:
toUType: domestic
domestic:
payeeAccountUType: account
account:
accountName: A NGUYEN
bsb: "032000"
accountNumber: "55501234"
isAmountCalculated: false
amount: "2100.00"
currency: AUD
recurrence:
nextPaymentDate: "2026-11-01"
recurrenceUType: intervalSchedule
intervalSchedule:
paymentsRemaining: 6
intervals:
- interval: P1M
- scheduledPaymentId: sp-a2
nickname: Rent
payerReference: RENT
payeeReference: UNIT4-a2
status: ACTIVE
from:
accountId: a2
paymentSet:
- to:
toUType: domestic
domestic:
payeeAccountUType: account
account:
accountName: A NGUYEN
bsb: "032000"
accountNumber: "55501234"
isAmountCalculated: false
amount: "2101.00"
currency: AUD
recurrence:
nextPaymentDate: "2026-11-01"
recurrenceUType: intervalSchedule
intervalSchedule:
paymentsRemaining: 6
intervals:
- interval: P1M
- scheduledPaymentId: sp-a3
nickname: Rent
payerReference: RENT
payeeReference: UNIT4-a3
status: ACTIVE
from:
accountId: a3
paymentSet:
- to:
toUType: domestic
domestic:
payeeAccountUType: account
account:
accountName: A NGUYEN
bsb: "032000"
accountNumber: "55501234"
isAmountCalculated: false
amount: "2102.00"
currency: AUD
recurrence:
nextPaymentDate: "2026-11-01"
recurrenceUType: intervalSchedule
intervalSchedule:
paymentsRemaining: 6
intervals:
- interval: P1M
- scheduledPaymentId: sp-a4
nickname: Rent
payerReference: RENT
payeeReference: UNIT4-a4
status: ACTIVE
from:
accountId: a4
paymentSet:
- to:
toUType: domestic
domestic:
payeeAccountUType: account
account:
accountName: A NGUYEN
bsb: "032000"
accountNumber: "55501234"
isAmountCalculated: false
amount: "2103.00"
currency: AUD
recurrence:
nextPaymentDate: "2026-11-01"
recurrenceUType: intervalSchedule
intervalSchedule:
paymentsRemaining: 6
intervals:
- interval: P1M
links:
self: "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25"
first: "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25"
last: "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25"
meta:
totalRecords: 4
totalPages: 1
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: "CDS Banking: GET /banking/payments/scheduled"
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data.scheduledPayments",
"item_id": "from.accountId",
"action": "read",
"count": "$.meta.totalRecords",
"resource_type": "P54"
},
"mask": {
"fields": [
"paymentSet[*].amount",
"payeeReference"
],
"action": "view",
"resource_type": "P54"
},
"keep": [
"links",
"meta"
]
},
"method": "GET",
"path": "/api/P54"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P54' \
-H 'authorization: Bearer eyJ…' \
-H 'x-v: 1'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 1912
date: Thu, 22 Oct 2026 09:44:16 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 107
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: 748b0532306bad1f2115bf68f1721541{
"data": {
"scheduledPayments": [
{
"scheduledPaymentId": "sp-a1",
"nickname": "Rent",
"payerReference": "RENT",
"payeeReference": "UNIT4-a1",
"status": "ACTIVE",
"from": {
"accountId": "a1"
},
"paymentSet": [
{
"to": {
"toUType": "domestic",
"domestic": {
"payeeAccountUType": "account",
"account": {
"accountName": "A NGUYEN",
"bsb": "032000",
"accountNumber": "55501234"
}
}
},
"isAmountCalculated": false,
"amount": "2100.00",
"currency": "AUD"
}
],
"recurrence": {
"nextPaymentDate": "2026-11-01",
"recurrenceUType": "intervalSchedule",
"intervalSchedule": {
"paymentsRemaining": 6,
"intervals": [
{
"interval": "P1M"
}
]
}
}
},
{
"scheduledPaymentId": "sp-a2",
"nickname": "Rent",
"payerReference": "RENT",
"payeeReference": "UNIT4-a2",
"status": "ACTIVE",
"from": {
"accountId": "a2"
},
"paymentSet": [
{
"to": {
"toUType": "domestic",
"domestic": {
"payeeAccountUType": "account",
"account": {
"accountName": "A NGUYEN",
"bsb": "032000",
"accountNumber": "55501234"
}
}
},
"isAmountCalculated": false,
"amount": "2101.00",
"currency": "AUD"
}
],
"recurrence": {
"nextPaymentDate": "2026-11-01",
"recurrenceUType": "intervalSchedule",
"intervalSchedule": {
"paymentsRemaining": 6,
"intervals": [
{
"interval": "P1M"
}
]
}
}
},
{
"scheduledPaymentId": "sp-a4",
"nickname": "Rent",
"payerReference": "RENT",
"status": "ACTIVE",
"from": {
"accountId": "a4"
},
"paymentSet": [
{
"to": {
"toUType": "domestic",
"domestic": {
"payeeAccountUType": "account",
"account": {
"accountName": "A NGUYEN",
"bsb": "032000",
"accountNumber": "55501234"
}
}
},
"isAmountCalculated": false,
"currency": "AUD"
}
],
"recurrence": {
"nextPaymentDate": "2026-11-01",
"recurrenceUType": "intervalSchedule",
"intervalSchedule": {
"paymentsRemaining": 6,
"intervals": [
{
"interval": "P1M"
}
]
}
}
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25"
},
"meta": {
"totalRecords": 3,
"totalPages": 1
}
}What the metadata means
{
"data": {
"scheduledPayments": [
{
"scheduledPaymentId": "sp-a1",
"nickname": "Rent",
"payerReference": "RENT",
"payeeReference": "UNIT4-a1",
"status": "ACTIVE",
"from": {
"accountId": "a1"
},
"paymentSet": [
{
"to": {
"toUType": "domestic",
"domestic": {
"payeeAccountUType": "account",
"account": {
"accountName": "A NGUYEN",
"bsb": "032000",
"accountNumber": "55501234"
}
}
},
"isAmountCalculated": false,
"amount": "2100.00",
"currency": "AUD"
}
],
"recurrence": {
"nextPaymentDate": "2026-11-01",
"recurrenceUType": "intervalSchedule",
"intervalSchedule": {
"paymentsRemaining": 6,
"intervals": [
{
"interval": "P1M"
}
]
}
}
},
{
"scheduledPaymentId": "sp-a2",
"nickname": "Rent",
"payerReference": "RENT",
"payeeReference": "UNIT4-a2",
"status": "ACTIVE",
"from": {
"accountId": "a2"
},
"paymentSet": [
{
"to": {
"toUType": "domestic",
"domestic": {
"payeeAccountUType": "account",
"account": {
"accountName": "A NGUYEN",
"bsb": "032000",
"accountNumber": "55501234"
}
}
},
"isAmountCalculated": false,
"amount": "2101.00",
"currency": "AUD"
}
],
"recurrence": {
"nextPaymentDate": "2026-11-01",
"recurrenceUType": "intervalSchedule",
"intervalSchedule": {
"paymentsRemaining": 6,
"intervals": [
{
"interval": "P1M"
}
]
}
}
},
{
"scheduledPaymentId": "sp-a4",
"nickname": "Rent",
"payerReference": "RENT",
"status": "ACTIVE",
"from": {
"accountId": "a4"
},
"paymentSet": [
{
"to": {
"toUType": "domestic",
"domestic": {
"payeeAccountUType": "account",
"account": {
"accountName": "A NGUYEN",
"bsb": "032000",
"accountNumber": "55501234"
}
}
},
"isAmountCalculated": false,
"currency": "AUD"
}
],
"recurrence": {
"nextPaymentDate": "2026-11-01",
"recurrenceUType": "intervalSchedule",
"intervalSchedule": {
"paymentsRemaining": 6,
"intervals": [
{
"interval": "P1M"
}
]
}
}
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25"
},
"meta": {
"totalRecords": 3,
"totalPages": 1
}
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60714,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P54",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60714,
"method": "GET",
"url": "https://gateway.example/api/P54",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60714,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P54",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60714,
"method": "GET",
"url": "https://gateway.example/api/P54",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60714,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P54",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60714,
"method": "GET",
"url": "https://gateway.example/api/P54",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 4573
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "2682"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:16 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": {
"scheduledPayments": [
{
"scheduledPaymentId": "sp-a1",
"nickname": "Rent",
"payerReference": "RENT",
"payeeReference": "UNIT4-a1",
"status": "ACTIVE",
"from": {
"accountId": "a1"
},
"paymentSet": [
{
"to": {
"toUType": "domestic",
"domestic": {
"payeeAccountUType": "account",
"account": {
"accountName": "A NGUYEN",
"bsb": "032000",
"accountNumber": "55501234"
}
}
},
"isAmountCalculated": false,
"amount": "2100.00",
"currency": "AUD"
}
],
"recurrence": {
"nextPaymentDate": "2026-11-01",
"recurrenceUType": "intervalSchedule",
"intervalSchedule": {
"paymentsRemaining": 6,
"intervals": [
{
"interval": "P1M"
}
]
}
}
},
{
"scheduledPaymentId": "sp-a2",
"nickname": "Rent",
"payerReference": "RENT",
"payeeReference": "UNIT4-a2",
"status": "ACTIVE",
"from": {
"accountId": "a2"
},
"paymentSet": [
{
"to": {
"toUType": "domestic",
"domestic": {
"payeeAccountUType": "account",
"account": {
"accountName": "A NGUYEN",
"bsb": "032000",
"accountNumber": "55501234"
}
}
},
"isAmountCalculated": false,
"amount": "2101.00",
"currency": "AUD"
}
],
"recurrence": {
"nextPaymentDate": "2026-11-01",
"recurrenceUType": "intervalSchedule",
"intervalSchedule": {
"paymentsRemaining": 6,
"intervals": [
{
"interval": "P1M"
}
]
}
}
},
{
"scheduledPaymentId": "sp-a3",
"nickname": "Rent",
"payerReference": "RENT",
"payeeReference": "UNIT4-a3",
"status": "ACTIVE",
"from": {
"accountId": "a3"
},
"paymentSet": [
{
"to": {
"toUType": "domestic",
"domestic": {
"payeeAccountUType": "account",
"account": {
"accountName": "A NGUYEN",
"bsb": "032000",
"accountNumber": "55501234"
}
}
},
"isAmountCalculated": false,
"amount": "2102.00",
"currency": "AUD"
}
],
"recurrence": {
"nextPaymentDate": "2026-11-01",
"recurrenceUType": "intervalSchedule",
"intervalSchedule": {
"paymentsRemaining": 6,
"intervals": [
{
"interval": "P1M"
}
]
}
}
},
{
"scheduledPaymentId": "sp-a4",
"nickname": "Rent",
"payerReference": "RENT",
"payeeReference": "UNIT4-a4",
"status": "ACTIVE",
"from": {
"accountId": "a4"
},
"paymentSet": [
{
"to": {
"toUType": "domestic",
"domestic": {
"payeeAccountUType": "account",
"account": {
"accountName": "A NGUYEN",
"bsb": "032000",
"accountNumber": "55501234"
}
}
},
"isAmountCalculated": false,
"amount": "2103.00",
"currency": "AUD"
}
],
"recurrence": {
"nextPaymentDate": "2026-11-01",
"recurrenceUType": "intervalSchedule",
"intervalSchedule": {
"paymentsRemaining": 6,
"intervals": [
{
"interval": "P1M"
}
]
}
}
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25"
},
"meta": {
"totalRecords": 4,
"totalPages": 1
}
},
"request": {
"source_port": 60714,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P54",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P54",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P54",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "2682"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:16 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": {
"scheduledPayments": [
{
"scheduledPaymentId": "sp-a1",
"nickname": "Rent",
"payerReference": "RENT",
"payeeReference": "UNIT4-a1",
"status": "ACTIVE",
"from": {
"accountId": "a1"
},
"paymentSet": [
{
"to": {
"toUType": "domestic",
"domestic": {
"payeeAccountUType": "account",
"account": {
"accountName": "A NGUYEN",
"bsb": "032000",
"accountNumber": "55501234"
}
}
},
"isAmountCalculated": false,
"amount": "2100.00",
"currency": "AUD"
}
],
"recurrence": {
"nextPaymentDate": "2026-11-01",
"recurrenceUType": "intervalSchedule",
"intervalSchedule": {
"paymentsRemaining": 6,
"intervals": [
{
"interval": "P1M"
}
]
}
}
},
{
"scheduledPaymentId": "sp-a2",
"nickname": "Rent",
"payerReference": "RENT",
"payeeReference": "UNIT4-a2",
"status": "ACTIVE",
"from": {
"accountId": "a2"
},
"paymentSet": [
{
"to": {
"toUType": "domestic",
"domestic": {
"payeeAccountUType": "account",
"account": {
"accountName": "A NGUYEN",
"bsb": "032000",
"accountNumber": "55501234"
}
}
},
"isAmountCalculated": false,
"amount": "2101.00",
"currency": "AUD"
}
],
"recurrence": {
"nextPaymentDate": "2026-11-01",
"recurrenceUType": "intervalSchedule",
"intervalSchedule": {
"paymentsRemaining": 6,
"intervals": [
{
"interval": "P1M"
}
]
}
}
},
{
"scheduledPaymentId": "sp-a4",
"nickname": "Rent",
"payerReference": "RENT",
"status": "ACTIVE",
"from": {
"accountId": "a4"
},
"paymentSet": [
{
"to": {
"toUType": "domestic",
"domestic": {
"payeeAccountUType": "account",
"account": {
"accountName": "A NGUYEN",
"bsb": "032000",
"accountNumber": "55501234"
}
}
},
"isAmountCalculated": false,
"currency": "AUD"
}
],
"recurrence": {
"nextPaymentDate": "2026-11-01",
"recurrenceUType": "intervalSchedule",
"intervalSchedule": {
"paymentsRemaining": 6,
"intervals": [
{
"interval": "P1M"
}
]
}
}
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25"
},
"meta": {
"totalRecords": 3,
"totalPages": 1
}
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P54"
}
}Response
{
"results": [
{
"type": "P54",
"id": "a1"
},
{
"type": "P54",
"id": "a2"
},
{
"type": "P54",
"id": "a4"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P54"
}
}Response
{
"results": [
{
"type": "P54",
"id": "a1"
},
{
"type": "P54",
"id": "a2"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P54 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P54
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: 748b0532306bad1f2115bf68f1721541
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": {
"scheduledPayments": [
{
"scheduledPaymentId": "sp-a1",
"nickname": "Rent",
"payerReference": "RENT",
"payeeReference": "UNIT4-a1",
"status": "ACTIVE",
"from": {
"accountId": "a1"
},
"paymentSet": [
{
"to": {
"toUType": "domestic",
"domestic": {
"payeeAccountUType": "account",
"account": {
"accountName": "A NGUYEN",
"bsb": "032000",
"accountNumber": "55501234"
}
}
},
"isAmountCalculated": false,
"amount": "2100.00",
"currency": "AUD"
}
],
"recurrence": {
"nextPaymentDate": "2026-11-01",
"recurrenceUType": "intervalSchedule",
"intervalSchedule": {
"paymentsRemaining": 6,
"intervals": [
{
"interval": "P1M"
}
]
}
}
},
{
"scheduledPaymentId": "sp-a2",
"nickname": "Rent",
"payerReference": "RENT",
"payeeReference": "UNIT4-a2",
"status": "ACTIVE",
"from": {
"accountId": "a2"
},
"paymentSet": [
{
"to": {
"toUType": "domestic",
"domestic": {
"payeeAccountUType": "account",
"account": {
"accountName": "A NGUYEN",
"bsb": "032000",
"accountNumber": "55501234"
}
}
},
"isAmountCalculated": false,
"amount": "2101.00",
"currency": "AUD"
}
],
"recurrence": {
"nextPaymentDate": "2026-11-01",
"recurrenceUType": "intervalSchedule",
"intervalSchedule": {
"paymentsRemaining": 6,
"intervals": [
{
"interval": "P1M"
}
]
}
}
},
{
"scheduledPaymentId": "sp-a3",
"nickname": "Rent",
"payerReference": "RENT",
"payeeReference": "UNIT4-a3",
"status": "ACTIVE",
"from": {
"accountId": "a3"
},
"paymentSet": [
{
"to": {
"toUType": "domestic",
"domestic": {
"payeeAccountUType": "account",
"account": {
"accountName": "A NGUYEN",
"bsb": "032000",
"accountNumber": "55501234"
}
}
},
"isAmountCalculated": false,
"amount": "2102.00",
"currency": "AUD"
}
],
"recurrence": {
"nextPaymentDate": "2026-11-01",
"recurrenceUType": "intervalSchedule",
"intervalSchedule": {
"paymentsRemaining": 6,
"intervals": [
{
"interval": "P1M"
}
]
}
}
},
{
"scheduledPaymentId": "sp-a4",
"nickname": "Rent",
"payerReference": "RENT",
"payeeReference": "UNIT4-a4",
"status": "ACTIVE",
"from": {
"accountId": "a4"
},
"paymentSet": [
{
"to": {
"toUType": "domestic",
"domestic": {
"payeeAccountUType": "account",
"account": {
"accountName": "A NGUYEN",
"bsb": "032000",
"accountNumber": "55501234"
}
}
},
"isAmountCalculated": false,
"amount": "2103.00",
"currency": "AUD"
}
],
"recurrence": {
"nextPaymentDate": "2026-11-01",
"recurrenceUType": "intervalSchedule",
"intervalSchedule": {
"paymentsRemaining": 6,
"intervals": [
{
"interval": "P1M"
}
]
}
}
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/payments/scheduled?page=1&page-size=25"
},
"meta": {
"totalRecords": 4,
"totalPages": 1
}
}P55CDR Get Payees: data.payees[], payeeId, a different resource typeCDS Banking: GET /banking/payeespass · 2004 PDP · 3 PIP · 1 upstream
Filtered and masked as the metadata means. The operation declares keep: ["links", "meta"], so the CDS envelope stays, and count, so meta.totalRecords says what is shown.
OpenAPI 3.1
Modelled on CDS Banking: GET /banking/payees. Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P55: CDS Banking: GET /banking/payees"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P55:
get:
operationId: caseP55
summary: "CDR Get Payees: data.payees[], payeeId, a different resource type"
security:
- bearerAuth: []
parameters:
- name: x-v
in: header
required: true
schema:
type: string
description: Version of the API end point requested by the client
example: "1"
- name: x-fapi-interaction-id
in: header
required: false
schema:
type: string
format: uuid
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
payees:
type: array
items:
type: object
properties:
payeeId:
type: string
nickname:
type: string
description:
type: string
type:
type: string
creationDate:
type: string
format: date
links:
type: object
properties:
self:
type: string
first:
type: string
last:
type: string
meta:
type: object
properties:
totalRecords:
type: integer
totalPages:
type: integer
example:
data:
payees:
- payeeId: py1
nickname: Payee py1
description: Landlord py1
type: DOMESTIC
creationDate: "2025-02-01"
- payeeId: py2
nickname: Payee py2
description: Landlord py2
type: BILLER
creationDate: "2025-02-01"
- payeeId: py3
nickname: Payee py3
description: Landlord py3
type: INTERNATIONAL
creationDate: "2025-02-01"
links:
self: "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25"
first: "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25"
last: "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25"
meta:
totalRecords: 3
totalPages: 1
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: "CDS Banking: GET /banking/payees"
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data.payees",
"item_id": "payeeId",
"action": "read",
"count": "$.meta.totalRecords",
"resource_type": "P55"
},
"mask": {
"fields": [
"description"
],
"action": "view",
"resource_type": "P55"
},
"keep": [
"links",
"meta"
]
},
"method": "GET",
"path": "/api/P55"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"py1",
"py2"
],
"view": [
"py1"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P55' \
-H 'authorization: Bearer eyJ…' \
-H 'x-v: 1'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 511
date: Thu, 22 Oct 2026 09:44:18 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 3
X-Kong-Proxy-Latency: 174
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: 4b1ea656e74ca45ba0bbfc6917e64475{
"data": {
"payees": [
{
"payeeId": "py1",
"nickname": "Payee py1",
"description": "Landlord py1",
"type": "DOMESTIC",
"creationDate": "2025-02-01"
},
{
"payeeId": "py2",
"nickname": "Payee py2",
"type": "BILLER",
"creationDate": "2025-02-01"
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25"
},
"meta": {
"totalRecords": 2,
"totalPages": 1
}
}What the metadata means
{
"data": {
"payees": [
{
"payeeId": "py1",
"nickname": "Payee py1",
"description": "Landlord py1",
"type": "DOMESTIC",
"creationDate": "2025-02-01"
},
{
"payeeId": "py2",
"nickname": "Payee py2",
"type": "BILLER",
"creationDate": "2025-02-01"
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25"
},
"meta": {
"totalRecords": 2,
"totalPages": 1
}
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60724,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P55",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60724,
"method": "GET",
"url": "https://gateway.example/api/P55",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60724,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P55",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60724,
"method": "GET",
"url": "https://gateway.example/api/P55",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60724,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P55",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60724,
"method": "GET",
"url": "https://gateway.example/api/P55",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 2318
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "704"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:18 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": {
"payees": [
{
"payeeId": "py1",
"nickname": "Payee py1",
"description": "Landlord py1",
"type": "DOMESTIC",
"creationDate": "2025-02-01"
},
{
"payeeId": "py2",
"nickname": "Payee py2",
"description": "Landlord py2",
"type": "BILLER",
"creationDate": "2025-02-01"
},
{
"payeeId": "py3",
"nickname": "Payee py3",
"description": "Landlord py3",
"type": "INTERNATIONAL",
"creationDate": "2025-02-01"
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25"
},
"meta": {
"totalRecords": 3,
"totalPages": 1
}
},
"request": {
"source_port": 60724,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P55",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P55",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P55",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "704"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:18 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": {
"payees": [
{
"payeeId": "py1",
"nickname": "Payee py1",
"description": "Landlord py1",
"type": "DOMESTIC",
"creationDate": "2025-02-01"
},
{
"payeeId": "py2",
"nickname": "Payee py2",
"type": "BILLER",
"creationDate": "2025-02-01"
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25"
},
"meta": {
"totalRecords": 2,
"totalPages": 1
}
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P55"
}
}Response
{
"results": [
{
"type": "P55",
"id": "py1"
},
{
"type": "P55",
"id": "py2"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P55"
}
}Response
{
"results": [
{
"type": "P55",
"id": "py1"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P55 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P55
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: 4b1ea656e74ca45ba0bbfc6917e64475
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": {
"payees": [
{
"payeeId": "py1",
"nickname": "Payee py1",
"description": "Landlord py1",
"type": "DOMESTIC",
"creationDate": "2025-02-01"
},
{
"payeeId": "py2",
"nickname": "Payee py2",
"description": "Landlord py2",
"type": "BILLER",
"creationDate": "2025-02-01"
},
{
"payeeId": "py3",
"nickname": "Payee py3",
"description": "Landlord py3",
"type": "INTERNATIONAL",
"creationDate": "2025-02-01"
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/payees?page=1&page-size=25"
},
"meta": {
"totalRecords": 3,
"totalPages": 1
}
}P56CDR Get Payee Detail: a domestic payId payee, mask identifier everywhereCDS Banking: GET /banking/payees/{payeeId}pass · 2004 PDP · 3 PIP · 1 upstream
As the metadata means.
OpenAPI 3.1
Modelled on CDS Banking: GET /banking/payees/{payeeId}. Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P56: CDS Banking: GET /banking/payees/{payeeId}"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P56:
get:
operationId: caseP56
summary: "CDR Get Payee Detail: a domestic payId payee, mask identifier everywhere"
security:
- bearerAuth: []
parameters:
- name: x-v
in: header
required: true
schema:
type: string
description: Version of the API end point requested by the client
example: "1"
- name: x-fapi-interaction-id
in: header
required: false
schema:
type: string
format: uuid
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
payeeId:
type: string
nickname:
type: string
type:
type: string
creationDate:
type: string
format: date
payeeUType:
type: string
domestic:
type: object
properties:
payeeAccountUType:
type: string
payId:
type: object
properties:
name:
type: string
identifier:
type: string
type:
type: string
links:
type: object
properties:
self:
type: string
meta:
type: object
properties: {}
example:
data:
payeeId: py1
nickname: Ana
type: DOMESTIC
creationDate: "2025-02-01"
payeeUType: domestic
domestic:
payeeAccountUType: payId
payId:
name: A NGUYEN
identifier: "ana.nguyen@example.com"
type: EMAIL
links:
self: https://api.bank.example/cds-au/v1/banking/payees/py1
meta: {}
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: "CDS Banking: GET /banking/payees/{payeeId}"
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"mask": {
"fields": [
"identifier",
"accountNumber",
"bsb"
],
"action": "view",
"resource_type": "P56"
}
},
"method": "GET",
"path": "/api/P56"
}
]
}The entitlements this case gives alice at the PIP:
{
"view": []
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P56' \
-H 'authorization: Bearer eyJ…' \
-H 'x-v: 1'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 280
date: Thu, 22 Oct 2026 09:44:19 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 139
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: ec28023cf8c6562a13a96c466fab2656{
"data": {
"payeeId": "py1",
"nickname": "Ana",
"type": "DOMESTIC",
"creationDate": "2025-02-01",
"payeeUType": "domestic",
"domestic": {
"payeeAccountUType": "payId",
"payId": {
"name": "A NGUYEN",
"type": "EMAIL"
}
}
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/payees/py1"
},
"meta": {}
}What the metadata means
{
"data": {
"payeeId": "py1",
"nickname": "Ana",
"type": "DOMESTIC",
"creationDate": "2025-02-01",
"payeeUType": "domestic",
"domestic": {
"payeeAccountUType": "payId",
"payId": {
"name": "A NGUYEN",
"type": "EMAIL"
}
}
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/payees/py1"
},
"meta": {}
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60738,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P56",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60738,
"method": "GET",
"url": "https://gateway.example/api/P56",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60738,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P56",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60738,
"method": "GET",
"url": "https://gateway.example/api/P56",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60738,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P56",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60738,
"method": "GET",
"url": "https://gateway.example/api/P56",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 1923
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "343"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:19 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": {
"payeeId": "py1",
"nickname": "Ana",
"type": "DOMESTIC",
"creationDate": "2025-02-01",
"payeeUType": "domestic",
"domestic": {
"payeeAccountUType": "payId",
"payId": {
"name": "A NGUYEN",
"identifier": "ana.nguyen@example.com",
"type": "EMAIL"
}
}
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/payees/py1"
},
"meta": {}
},
"request": {
"source_port": 60738,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P56",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P56",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P56",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "343"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:19 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": {
"payeeId": "py1",
"nickname": "Ana",
"type": "DOMESTIC",
"creationDate": "2025-02-01",
"payeeUType": "domestic",
"domestic": {
"payeeAccountUType": "payId",
"payId": {
"name": "A NGUYEN",
"type": "EMAIL"
}
}
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/payees/py1"
},
"meta": {}
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 102
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "none"
},
"resource": {
"type": "none"
}
}Response
{
"results": [],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P56"
}
}Response
{
"results": [],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P56 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P56
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: ec28023cf8c6562a13a96c466fab2656
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": {
"payeeId": "py1",
"nickname": "Ana",
"type": "DOMESTIC",
"creationDate": "2025-02-01",
"payeeUType": "domestic",
"domestic": {
"payeeAccountUType": "payId",
"payId": {
"name": "A NGUYEN",
"identifier": "ana.nguyen@example.com",
"type": "EMAIL"
}
}
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/payees/py1"
},
"meta": {}
}P57CDR Get Customer Detail: person with phones, emails and addresses maskedCDS Common: GET /common/customer/detailpass · 2004 PDP · 3 PIP · 1 upstream
As the metadata means.
OpenAPI 3.1
Modelled on CDS Common: GET /common/customer/detail. Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P57: CDS Common: GET /common/customer/detail"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P57:
get:
operationId: caseP57
summary: "CDR Get Customer Detail: person with phones, emails and addresses masked"
security:
- bearerAuth: []
parameters:
- name: x-v
in: header
required: true
schema:
type: string
description: Version of the API end point requested by the client
example: "1"
- name: x-fapi-interaction-id
in: header
required: false
schema:
type: string
format: uuid
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
customerUType:
type: string
person:
type: object
properties:
lastUpdateTime:
type: string
format: date-time
firstName:
type: string
lastName:
type: string
middleNames:
type: array
items:
type: string
prefix:
type: string
occupationCode:
type: string
occupationCodeVersion:
type: string
phoneNumbers:
type: array
items:
type: object
properties:
isPreferred:
type: boolean
purpose:
type: string
number:
type: string
fullNumber:
type: string
emailAddresses:
type: array
items:
type: object
properties:
isPreferred:
type: boolean
purpose:
type: string
address:
type: string
physicalAddresses:
type: array
items:
type: object
properties:
addressUType:
type: string
simple:
type: object
properties:
addressLine1:
type: string
postcode:
type: string
city:
type: string
state:
type: string
purpose:
type: string
links:
type: object
properties:
self:
type: string
meta:
type: object
properties: {}
example:
data:
customerUType: person
person:
lastUpdateTime: "2026-06-30T10:00:00+10:00"
firstName: Jane
lastName: Citizen
middleNames:
- Mary
prefix: Ms
occupationCode: "261313"
occupationCodeVersion: ANZSCO_1220.0_2013_V1.3
phoneNumbers:
- isPreferred: true
purpose: MOBILE
number: "0412345678"
fullNumber: "+61412345678"
emailAddresses:
- isPreferred: true
purpose: HOME
address: "jane@example.com"
physicalAddresses:
- addressUType: simple
simple:
addressLine1: "12 Smith St"
postcode: "2000"
city: Sydney
state: NSW
purpose: MAIL
links:
self: https://api.bank.example/cds-au/v1/common/customer/detail
meta: {}
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: "CDS Common: GET /common/customer/detail"
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"mask": {
"fields": [
"phoneNumbers",
"emailAddresses",
"physicalAddresses"
],
"action": "view",
"resource_type": "P57"
}
},
"method": "GET",
"path": "/api/P57"
}
]
}The entitlements this case gives alice at the PIP:
{
"view": []
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P57' \
-H 'authorization: Bearer eyJ…' \
-H 'x-v: 1'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 331
date: Thu, 22 Oct 2026 09:44:21 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 7
X-Kong-Proxy-Latency: 218
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: 2a9ce02a3cbe9d63bf60023b8719ac10{
"data": {
"customerUType": "person",
"person": {
"lastUpdateTime": "2026-06-30T10:00:00+10:00",
"firstName": "Jane",
"lastName": "Citizen",
"middleNames": [
"Mary"
],
"prefix": "Ms",
"occupationCode": "261313",
"occupationCodeVersion": "ANZSCO_1220.0_2013_V1.3"
}
},
"links": {
"self": "https://api.bank.example/cds-au/v1/common/customer/detail"
},
"meta": {}
}What the metadata means
{
"data": {
"customerUType": "person",
"person": {
"lastUpdateTime": "2026-06-30T10:00:00+10:00",
"firstName": "Jane",
"lastName": "Citizen",
"middleNames": [
"Mary"
],
"prefix": "Ms",
"occupationCode": "261313",
"occupationCodeVersion": "ANZSCO_1220.0_2013_V1.3"
}
},
"links": {
"self": "https://api.bank.example/cds-au/v1/common/customer/detail"
},
"meta": {}
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60752,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P57",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60752,
"method": "GET",
"url": "https://gateway.example/api/P57",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60752,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P57",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60752,
"method": "GET",
"url": "https://gateway.example/api/P57",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60752,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P57",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60752,
"method": "GET",
"url": "https://gateway.example/api/P57",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 2359
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "729"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:21 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": {
"customerUType": "person",
"person": {
"lastUpdateTime": "2026-06-30T10:00:00+10:00",
"firstName": "Jane",
"lastName": "Citizen",
"middleNames": [
"Mary"
],
"prefix": "Ms",
"occupationCode": "261313",
"occupationCodeVersion": "ANZSCO_1220.0_2013_V1.3",
"phoneNumbers": [
{
"isPreferred": true,
"purpose": "MOBILE",
"number": "0412345678",
"fullNumber": "+61412345678"
}
],
"emailAddresses": [
{
"isPreferred": true,
"purpose": "HOME",
"address": "jane@example.com"
}
],
"physicalAddresses": [
{
"addressUType": "simple",
"simple": {
"addressLine1": "12 Smith St",
"postcode": "2000",
"city": "Sydney",
"state": "NSW"
},
"purpose": "MAIL"
}
]
}
},
"links": {
"self": "https://api.bank.example/cds-au/v1/common/customer/detail"
},
"meta": {}
},
"request": {
"source_port": 60752,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P57",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P57",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P57",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "729"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:21 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": {
"customerUType": "person",
"person": {
"lastUpdateTime": "2026-06-30T10:00:00+10:00",
"firstName": "Jane",
"lastName": "Citizen",
"middleNames": [
"Mary"
],
"prefix": "Ms",
"occupationCode": "261313",
"occupationCodeVersion": "ANZSCO_1220.0_2013_V1.3"
}
},
"links": {
"self": "https://api.bank.example/cds-au/v1/common/customer/detail"
},
"meta": {}
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 102
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "none"
},
"resource": {
"type": "none"
}
}Response
{
"results": [],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P57"
}
}Response
{
"results": [],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P57 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P57
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: 2a9ce02a3cbe9d63bf60023b8719ac10
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": {
"customerUType": "person",
"person": {
"lastUpdateTime": "2026-06-30T10:00:00+10:00",
"firstName": "Jane",
"lastName": "Citizen",
"middleNames": [
"Mary"
],
"prefix": "Ms",
"occupationCode": "261313",
"occupationCodeVersion": "ANZSCO_1220.0_2013_V1.3",
"phoneNumbers": [
{
"isPreferred": true,
"purpose": "MOBILE",
"number": "0412345678",
"fullNumber": "+61412345678"
}
],
"emailAddresses": [
{
"isPreferred": true,
"purpose": "HOME",
"address": "jane@example.com"
}
],
"physicalAddresses": [
{
"addressUType": "simple",
"simple": {
"addressLine1": "12 Smith St",
"postcode": "2000",
"city": "Sydney",
"state": "NSW"
},
"purpose": "MAIL"
}
]
}
},
"links": {
"self": "https://api.bank.example/cds-au/v1/common/customer/detail"
},
"meta": {}
}P58CDR Get Balances For Specific Accounts: POST with accountIds a1 and a3CDS Banking: POST /banking/accounts/balancespass · 2004 PDP · 3 PIP · 1 upstream
Filtered and masked as the metadata means. The operation declares keep: ["links", "meta"], so the CDS envelope stays, and count, so meta.totalRecords says what is shown. a3's balance is filtered out.
OpenAPI 3.1
Modelled on CDS Banking: POST /banking/accounts/balances. Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P58: CDS Banking: POST /banking/accounts/balances"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P58:
post:
operationId: caseP58
summary: "CDR Get Balances For Specific Accounts: POST with accountIds a1 and a3"
security:
- bearerAuth: []
parameters:
- name: x-v
in: header
required: true
schema:
type: string
description: Version of the API end point requested by the client
example: "1"
- name: x-fapi-interaction-id
in: header
required: false
schema:
type: string
format: uuid
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
balances:
type: array
items:
type: object
properties:
accountId:
type: string
currentBalance:
type: string
description: amount as a decimal string
availableBalance:
type: string
description: amount as a decimal string
creditLimit:
type: string
description: amount as a decimal string
amortisedLimit:
type: string
description: amount as a decimal string
currency:
type: string
purses:
type: array
items:
type: object
properties:
amount:
type: string
description: amount as a decimal string
currency:
type: string
links:
type: object
properties:
self:
type: string
first:
type: string
last:
type: string
meta:
type: object
properties:
totalRecords:
type: integer
totalPages:
type: integer
example:
data:
balances:
- accountId: a1
currentBalance: "1200.00"
availableBalance: "1100.00"
creditLimit: "0.00"
amortisedLimit: "0.00"
currency: AUD
purses:
- amount: "10.00"
currency: USD
- amount: "5.00"
currency: EUR
- accountId: a3
currentBalance: "1201.00"
availableBalance: "1101.00"
creditLimit: "0.00"
amortisedLimit: "0.00"
currency: AUD
purses:
- amount: "11.00"
currency: USD
- amount: "5.00"
currency: EUR
links:
self: "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25"
first: "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25"
last: "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25"
meta:
totalRecords: 2
totalPages: 1
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
accountIds:
type: array
items:
type: string
meta:
type: object
properties: {}
example:
data:
accountIds:
- a1
- a3
meta: {}
x-modelled-on: "CDS Banking: POST /banking/accounts/balances"
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data.balances",
"item_id": "accountId",
"action": "read",
"count": "$.meta.totalRecords",
"resource_type": "P58"
},
"mask": {
"fields": [
"currentBalance",
"availableBalance"
],
"action": "view",
"resource_type": "P58"
},
"keep": [
"links",
"meta"
]
},
"method": "POST",
"path": "/api/P58"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X POST 'https://gateway.example/api/P58' \
-H 'authorization: Bearer eyJ…' \
-H 'x-v: 1' \
-H 'content-type: application/json' \
-d '{"data": {"accountIds": ["a1", "a3"]}, "meta": {}}'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 564
date: Thu, 22 Oct 2026 09:44:23 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 5
X-Kong-Proxy-Latency: 215
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: 876ff61aef23e327dc42f142f73c5421{
"data": {
"balances": [
{
"accountId": "a1",
"currentBalance": "1200.00",
"availableBalance": "1100.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "10.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25"
},
"meta": {
"totalRecords": 1,
"totalPages": 1
}
}What the metadata means
{
"data": {
"balances": [
{
"accountId": "a1",
"currentBalance": "1200.00",
"availableBalance": "1100.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "10.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25"
},
"meta": {
"totalRecords": 1,
"totalPages": 1
}
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1128
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60768,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-length": "50"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "POST"
}
],
"url": "https://gateway.example/api/P58",
"http_version": "1.1",
"method": "POST",
"body": {
"data": {
"accountIds": [
"a1",
"a3"
]
},
"meta": {}
},
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60768,
"method": "POST",
"url": "https://gateway.example/api/P58",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-length": "50"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "POST"
}
],
"body": {
"data": {
"accountIds": [
"a1",
"a3"
]
},
"meta": {}
}
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1123
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60768,
"body": {
"data": {
"accountIds": [
"a1",
"a3"
]
},
"meta": {}
},
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-length": "50"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "POST"
}
],
"http_version": "1.1",
"method": "POST",
"url": "https://gateway.example/api/P58",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60768,
"method": "POST",
"url": "https://gateway.example/api/P58",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-length": "50"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "POST"
}
],
"body": {
"data": {
"accountIds": [
"a1",
"a3"
]
},
"meta": {}
}
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1123
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60768,
"body": {
"data": {
"accountIds": [
"a1",
"a3"
]
},
"meta": {}
},
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-length": "50"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "POST"
}
],
"http_version": "1.1",
"method": "POST",
"url": "https://gateway.example/api/P58",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60768,
"method": "POST",
"url": "https://gateway.example/api/P58",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-length": "50"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "POST"
}
],
"body": {
"data": {
"accountIds": [
"a1",
"a3"
]
},
"meta": {}
}
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 2568
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "838"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:23 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": {
"balances": [
{
"accountId": "a1",
"currentBalance": "1200.00",
"availableBalance": "1100.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "10.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
},
{
"accountId": "a3",
"currentBalance": "1201.00",
"availableBalance": "1101.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "11.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25"
},
"meta": {
"totalRecords": 2,
"totalPages": 1
}
},
"request": {
"source_port": 60768,
"body": "{\"data\":{\"accountIds\":[\"a1\",\"a3\"]},\"meta\":{}}",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-length": "50"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "POST"
}
],
"http_version": "1.1",
"method": "POST",
"url": "https://gateway.example/api/P58",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "POST",
"url": "https://gateway.example/api/P58",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P58",
"method": "POST",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "838"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:23 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": {
"balances": [
{
"accountId": "a1",
"currentBalance": "1200.00",
"availableBalance": "1100.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "10.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25"
},
"meta": {
"totalRecords": 1,
"totalPages": 1
}
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P58"
}
}Response
{
"results": [
{
"type": "P58",
"id": "a1"
},
{
"type": "P58",
"id": "a2"
},
{
"type": "P58",
"id": "a4"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P58"
}
}Response
{
"results": [
{
"type": "P58",
"id": "a1"
},
{
"type": "P58",
"id": "a2"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API POST /api/P58 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P58
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: 876ff61aef23e327dc42f142f73c5421
Content-Length: 45
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json{
"data": {
"accountIds": [
"a1",
"a3"
]
},
"meta": {}
}Response
{
"data": {
"balances": [
{
"accountId": "a1",
"currentBalance": "1200.00",
"availableBalance": "1100.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "10.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
},
{
"accountId": "a3",
"currentBalance": "1201.00",
"availableBalance": "1101.00",
"creditLimit": "0.00",
"amortisedLimit": "0.00",
"currency": "AUD",
"purses": [
{
"amount": "11.00",
"currency": "USD"
},
{
"amount": "5.00",
"currency": "EUR"
}
]
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts/balances?page=1&page-size=25"
},
"meta": {
"totalRecords": 2,
"totalPages": 1
}
}P59CDR paging: meta.totalRecords follows the filter (count)CDS Banking: GET /banking/accounts (paged)pass · 2004 PDP · 3 PIP · 1 upstream
Filtered and masked as the metadata means. The operation declares keep: ["links", "meta"], so the CDS envelope stays, and count, so meta.totalRecords says what is shown. The page shows 3 accounts and totalRecords says 3, so it doesn't tell of the hidden one.
OpenAPI 3.1
Modelled on CDS Banking: GET /banking/accounts (paged). Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P59: CDS Banking: GET /banking/accounts (paged)"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P59:
get:
operationId: caseP59
summary: "CDR paging: meta.totalRecords follows the filter (count)"
security:
- bearerAuth: []
parameters:
- name: x-v
in: header
required: true
schema:
type: string
description: Version of the API end point requested by the client
example: "1"
- name: x-fapi-interaction-id
in: header
required: false
schema:
type: string
format: uuid
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
accounts:
type: array
items:
type: object
properties:
accountId:
type: string
creationDate:
type: string
format: date
displayName:
type: string
nickname:
type: string
openStatus:
type: string
isOwned:
type: boolean
accountOwnership:
type: string
maskedNumber:
type: string
productCategory:
type: string
productName:
type: string
links:
type: object
properties:
self:
type: string
first:
type: string
last:
type: string
meta:
type: object
properties:
totalRecords:
type: integer
totalPages:
type: integer
example:
data:
accounts:
- accountId: a1
creationDate: "2024-03-01"
displayName: Everyday a1
nickname: Bills a1
openStatus: OPEN
isOwned: true
accountOwnership: ONE_PARTY
maskedNumber: xxxx xxxx xxxx 1000
productCategory: TRANS_AND_SAVINGS_ACCOUNTS
productName: Everyday Account
- accountId: a2
creationDate: "2024-03-01"
displayName: Everyday a2
nickname: Bills a2
openStatus: OPEN
isOwned: true
accountOwnership: ONE_PARTY
maskedNumber: xxxx xxxx xxxx 1001
productCategory: TRANS_AND_SAVINGS_ACCOUNTS
productName: Everyday Account
- accountId: a3
creationDate: "2024-03-01"
displayName: Everyday a3
nickname: Bills a3
openStatus: OPEN
isOwned: true
accountOwnership: ONE_PARTY
maskedNumber: xxxx xxxx xxxx 1002
productCategory: TRANS_AND_SAVINGS_ACCOUNTS
productName: Everyday Account
- accountId: a4
creationDate: "2024-03-01"
displayName: Everyday a4
nickname: Bills a4
openStatus: OPEN
isOwned: true
accountOwnership: ONE_PARTY
maskedNumber: xxxx xxxx xxxx 1003
productCategory: TRANS_AND_SAVINGS_ACCOUNTS
productName: Everyday Account
links:
self: "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25"
first: "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25"
last: "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25"
meta:
totalRecords: 4
totalPages: 1
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: "CDS Banking: GET /banking/accounts (paged)"
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data.accounts",
"item_id": "accountId",
"action": "read",
"count": "$.meta.totalRecords",
"resource_type": "P59"
},
"mask": {
"fields": [
"maskedNumber"
],
"action": "view",
"resource_type": "P59"
},
"keep": [
"links",
"meta"
]
},
"method": "GET",
"path": "/api/P59"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P59' \
-H 'authorization: Bearer eyJ…' \
-H 'x-v: 1'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 1121
date: Thu, 22 Oct 2026 09:44:25 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 154
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: 8fba34500b5e554b4e5fdf5b3e3f7d0d{
"data": {
"accounts": [
{
"accountId": "a1",
"creationDate": "2024-03-01",
"displayName": "Everyday a1",
"nickname": "Bills a1",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1000",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a2",
"creationDate": "2024-03-01",
"displayName": "Everyday a2",
"nickname": "Bills a2",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1001",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a4",
"creationDate": "2024-03-01",
"displayName": "Everyday a4",
"nickname": "Bills a4",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25"
},
"meta": {
"totalRecords": 3,
"totalPages": 1
}
}What the metadata means
As below: meta.totalRecords counts what is shown (3).
{
"data": {
"accounts": [
{
"accountId": "a1",
"creationDate": "2024-03-01",
"displayName": "Everyday a1",
"nickname": "Bills a1",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1000",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a2",
"creationDate": "2024-03-01",
"displayName": "Everyday a2",
"nickname": "Bills a2",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1001",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a4",
"creationDate": "2024-03-01",
"displayName": "Everyday a4",
"nickname": "Bills a4",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25"
},
"meta": {
"totalRecords": 3,
"totalPages": 1
}
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60772,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P59",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60772,
"method": "GET",
"url": "https://gateway.example/api/P59",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60772,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P59",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60772,
"method": "GET",
"url": "https://gateway.example/api/P59",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60772,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P59",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60772,
"method": "GET",
"url": "https://gateway.example/api/P59",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 3238
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "1531"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:25 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": {
"accounts": [
{
"accountId": "a1",
"creationDate": "2024-03-01",
"displayName": "Everyday a1",
"nickname": "Bills a1",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1000",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a2",
"creationDate": "2024-03-01",
"displayName": "Everyday a2",
"nickname": "Bills a2",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1001",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a3",
"creationDate": "2024-03-01",
"displayName": "Everyday a3",
"nickname": "Bills a3",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1002",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a4",
"creationDate": "2024-03-01",
"displayName": "Everyday a4",
"nickname": "Bills a4",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1003",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25"
},
"meta": {
"totalRecords": 4,
"totalPages": 1
}
},
"request": {
"source_port": 60772,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P59",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P59",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P59",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "1531"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:25 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": {
"accounts": [
{
"accountId": "a1",
"creationDate": "2024-03-01",
"displayName": "Everyday a1",
"nickname": "Bills a1",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1000",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a2",
"creationDate": "2024-03-01",
"displayName": "Everyday a2",
"nickname": "Bills a2",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1001",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a4",
"creationDate": "2024-03-01",
"displayName": "Everyday a4",
"nickname": "Bills a4",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25"
},
"meta": {
"totalRecords": 3,
"totalPages": 1
}
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P59"
}
}Response
{
"results": [
{
"type": "P59",
"id": "a1"
},
{
"type": "P59",
"id": "a2"
},
{
"type": "P59",
"id": "a4"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P59"
}
}Response
{
"results": [
{
"type": "P59",
"id": "a1"
},
{
"type": "P59",
"id": "a2"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P59 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P59
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: 8fba34500b5e554b4e5fdf5b3e3f7d0d
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": {
"accounts": [
{
"accountId": "a1",
"creationDate": "2024-03-01",
"displayName": "Everyday a1",
"nickname": "Bills a1",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1000",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a2",
"creationDate": "2024-03-01",
"displayName": "Everyday a2",
"nickname": "Bills a2",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1001",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a3",
"creationDate": "2024-03-01",
"displayName": "Everyday a3",
"nickname": "Bills a3",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1002",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
},
{
"accountId": "a4",
"creationDate": "2024-03-01",
"displayName": "Everyday a4",
"nickname": "Bills a4",
"openStatus": "OPEN",
"isOwned": true,
"accountOwnership": "ONE_PARTY",
"maskedNumber": "xxxx xxxx xxxx 1003",
"productCategory": "TRANS_AND_SAVINGS_ACCOUNTS",
"productName": "Everyday Account"
}
]
},
"links": {
"self": "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25",
"first": "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25",
"last": "https://api.bank.example/cds-au/v1/banking/accounts?page=1&page-size=25"
},
"meta": {
"totalRecords": 4,
"totalPages": 1
}
}P60CDR error envelope: 422 UnavailableBankingAccount on a filtered operationCDS Banking: GET /banking/accounts/balances (error)pass · 4224 PDP · 3 PIP · 1 upstream
The CDS error envelope passes as it is. The only id in it is the one the client asked for.
OpenAPI 3.1
Modelled on CDS Banking: GET /banking/accounts/balances (error). Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P60: CDS Banking: GET /banking/accounts/balances (error)"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P60:
get:
operationId: caseP60
summary: "CDR error envelope: 422 UnavailableBankingAccount on a filtered operation"
security:
- bearerAuth: []
parameters:
- name: x-v
in: header
required: true
schema:
type: string
description: Version of the API end point requested by the client
example: "1"
- name: x-fapi-interaction-id
in: header
required: false
schema:
type: string
format: uuid
responses:
"422":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
errors:
type: array
items:
type: object
properties:
code:
type: string
title:
type: string
detail:
type: string
meta:
type: object
properties: {}
example:
errors:
- code: urn:au-cds:error:cds-banking:Authorisation/UnavailableBankingAccount
title: Unavailable Banking Account
detail: a3
meta: {}
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: "CDS Banking: GET /banking/accounts/balances (error)"
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data.balances",
"item_id": "accountId",
"action": "read",
"resource_type": "P60"
},
"mask": {
"fields": [
"currentBalance"
],
"action": "view",
"resource_type": "P60"
}
},
"method": "GET",
"path": "/api/P60"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P60' \
-H 'authorization: Bearer eyJ…' \
-H 'x-v: 1'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 422
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 162
date: Thu, 22 Oct 2026 09:44:26 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 3
X-Kong-Proxy-Latency: 160
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: 1970cb1c69baea11ac6e5f51fc317a63{
"errors": [
{
"code": "urn:au-cds:error:cds-banking:Authorisation/UnavailableBankingAccount",
"title": "Unavailable Banking Account",
"detail": "a3",
"meta": {}
}
]
}What the metadata means
The CDS error envelope as it is: the only id in it is the one the client asked for.
{}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 63590,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P60",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 63590,
"method": "GET",
"url": "https://gateway.example/api/P60",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 63590,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P60",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 63590,
"method": "GET",
"url": "https://gateway.example/api/P60",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 63590,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P60",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 63590,
"method": "GET",
"url": "https://gateway.example/api/P60",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 1706
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "162"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:26 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "422",
"body": {
"errors": [
{
"code": "urn:au-cds:error:cds-banking:Authorisation/UnavailableBankingAccount",
"title": "Unavailable Banking Account",
"detail": "a3",
"meta": {}
}
]
},
"request": {
"source_port": 63590,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P60",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P60",
"response_status": ""
}Response
{
"response_code": "422",
"response_status": "CLIENT_ERROR",
"url": "https://gateway.example/api/P60",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "162"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:44:26 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"errors": [
{
"code": "urn:au-cds:error:cds-banking:Authorisation/UnavailableBankingAccount",
"title": "Unavailable Banking Account",
"detail": "a3",
"meta": {}
}
]
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P60"
}
}Response
{
"results": [
{
"type": "P60",
"id": "a1"
},
{
"type": "P60",
"id": "a2"
},
{
"type": "P60",
"id": "a4"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P60"
}
}Response
{
"results": [
{
"type": "P60",
"id": "a1"
},
{
"type": "P60",
"id": "a2"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P60 422
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P60
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: 1970cb1c69baea11ac6e5f51fc317a63
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"errors": [
{
"code": "urn:au-cds:error:cds-banking:Authorisation/UnavailableBankingAccount",
"title": "Unavailable Banking Account",
"detail": "a3",
"meta": {}
}
]
}Other real-world formats · 6
P32GraphQL Relay connection: edges[].node, cursors, pageInfoGraphQL: POST /graphql (Relay connection)limit · 5024 PDP · 0 PIP · 1 upstream
Withheld (502): the policy's shape check rejects $.data.viewer.accounts.edges with item id node.id.
OpenAPI 3.1
Modelled on GraphQL: POST /graphql (Relay connection). Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P32: GraphQL: POST /graphql (Relay connection)"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P32:
get:
operationId: caseP32
summary: "GraphQL Relay connection: edges[].node, cursors, pageInfo"
security:
- bearerAuth: []
parameters: []
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
viewer:
type: object
properties:
login:
type: string
accounts:
type: object
properties:
totalCount:
type: integer
pageInfo:
type: object
properties:
hasNextPage:
type: boolean
endCursor:
type: string
edges:
type: array
items:
type: object
properties:
cursor:
type: string
node:
type: object
properties:
__typename:
type: string
id:
type: string
name:
type: string
balance:
type: integer
taxId:
type: string
extensions:
type: object
properties:
cost:
type: object
properties:
requestedQueryCost:
type: integer
example:
data:
viewer:
login: alice
accounts:
totalCount: 4
pageInfo:
hasNextPage: false
endCursor: "Y3Vyc29yOjQ="
edges:
- cursor: "Y3Vyc29yOj0="
node:
__typename: Account
id: a1
name: Account a1
balance: 100
taxId: TFN-0
- cursor: "Y3Vyc29yOj1="
node:
__typename: Account
id: a2
name: Account a2
balance: 101
taxId: TFN-1
- cursor: "Y3Vyc29yOj2="
node:
__typename: Account
id: a3
name: Account a3
balance: 102
taxId: TFN-2
- cursor: "Y3Vyc29yOj3="
node:
__typename: Account
id: a4
name: Account a4
balance: 103
taxId: TFN-3
extensions:
cost:
requestedQueryCost: 12
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: "GraphQL: POST /graphql (Relay connection)"
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data.viewer.accounts.edges",
"item_id": "node.id",
"action": "read",
"resource_type": "P32"
},
"mask": {
"fields": [
"node.balance",
"node.taxId"
],
"action": "view",
"resource_type": "P32"
}
},
"method": "GET",
"path": "/api/P32"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P32' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 502
Content-Type: application/json
Connection: close
Content-Length: 134
Date: Thu, 22 Oct 2026 09:43:31 GMT
Server: kong/3.9.4
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 456
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: 22bf4d691cab2a620fa21c18f2b33339{
"status": 502,
"error": "response_withheld",
"error_description": "The response is not the shape the resource's metadata describes."
}What the metadata means
{
"data": {
"viewer": {
"login": "alice",
"accounts": {
"totalCount": 4,
"pageInfo": {
"hasNextPage": false,
"endCursor": "Y3Vyc29yOjQ="
},
"edges": [
{
"cursor": "Y3Vyc29yOj0=",
"node": {
"__typename": "Account",
"id": "a1",
"name": "Account a1",
"balance": 100,
"taxId": "TFN-0"
}
},
{
"cursor": "Y3Vyc29yOj1=",
"node": {
"__typename": "Account",
"id": "a2",
"name": "Account a2",
"balance": 101,
"taxId": "TFN-1"
}
},
{
"cursor": "Y3Vyc29yOj3=",
"node": {
"__typename": "Account",
"id": "a4",
"name": "Account a4"
}
}
]
}
}
}
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60718,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P32",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60718,
"method": "GET",
"url": "https://gateway.example/api/P32",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60718,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P32",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60718,
"method": "GET",
"url": "https://gateway.example/api/P32",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60718,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P32",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60718,
"method": "GET",
"url": "https://gateway.example/api/P32",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 2377
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "723"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:31 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": {
"viewer": {
"login": "alice",
"accounts": {
"totalCount": 4,
"pageInfo": {
"hasNextPage": false,
"endCursor": "Y3Vyc29yOjQ="
},
"edges": [
{
"cursor": "Y3Vyc29yOj0=",
"node": {
"__typename": "Account",
"id": "a1",
"name": "Account a1",
"balance": 100,
"taxId": "TFN-0"
}
},
{
"cursor": "Y3Vyc29yOj1=",
"node": {
"__typename": "Account",
"id": "a2",
"name": "Account a2",
"balance": 101,
"taxId": "TFN-1"
}
},
{
"cursor": "Y3Vyc29yOj2=",
"node": {
"__typename": "Account",
"id": "a3",
"name": "Account a3",
"balance": 102,
"taxId": "TFN-2"
}
},
{
"cursor": "Y3Vyc29yOj3=",
"node": {
"__typename": "Account",
"id": "a4",
"name": "Account a4",
"balance": 103,
"taxId": "TFN-3"
}
}
]
}
}
},
"extensions": {
"cost": {
"requestedQueryCost": 12
}
}
},
"request": {
"source_port": 60718,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P32",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P32",
"response_status": "OK"
}Response
{
"response_code": "502",
"response_status": "Bad Gateway",
"url": "https://gateway.example/api/P32",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"Content-Type": "application/json"
}
],
"body": {
"status": 502,
"error": "response_withheld",
"error_description": "The response is not the shape the resource's metadata describes."
},
"request": {
"source_ip": "192.0.2.1",
"source_port": 60718,
"method": "GET",
"url": "https://gateway.example/api/P32",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}
}Entitlements PIP · AuthZEN (0)
No entitlements call: the request was decided before the PIP was asked.
Upstream API (1)
Kong → API GET /api/P32 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P32
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: 22bf4d691cab2a620fa21c18f2b33339
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": {
"viewer": {
"login": "alice",
"accounts": {
"totalCount": 4,
"pageInfo": {
"hasNextPage": false,
"endCursor": "Y3Vyc29yOjQ="
},
"edges": [
{
"cursor": "Y3Vyc29yOj0=",
"node": {
"__typename": "Account",
"id": "a1",
"name": "Account a1",
"balance": 100,
"taxId": "TFN-0"
}
},
{
"cursor": "Y3Vyc29yOj1=",
"node": {
"__typename": "Account",
"id": "a2",
"name": "Account a2",
"balance": 101,
"taxId": "TFN-1"
}
},
{
"cursor": "Y3Vyc29yOj2=",
"node": {
"__typename": "Account",
"id": "a3",
"name": "Account a3",
"balance": 102,
"taxId": "TFN-2"
}
},
{
"cursor": "Y3Vyc29yOj3=",
"node": {
"__typename": "Account",
"id": "a4",
"name": "Account a4",
"balance": 103,
"taxId": "TFN-3"
}
}
]
}
}
},
"extensions": {
"cost": {
"requestedQueryCost": 12
}
}
}P33JSON:API compound document: balances side-loaded in included[]JSON:API compound documentpass · 2004 PDP · 3 PIP · 1 upstream
included[] is removed with everything else the metadata doesn't name, so a3's balance never leaves.
OpenAPI 3.1
Modelled on JSON:API compound document. Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P33: JSON:API compound document"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P33:
get:
operationId: caseP33
summary: "JSON:API compound document: balances side-loaded in included[]"
security:
- bearerAuth: []
parameters: []
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: array
items:
type: object
properties:
type:
type: string
id:
type: string
attributes:
type: object
properties:
name:
type: string
taxId:
type: string
relationships:
type: object
properties:
balance:
type: object
properties:
data:
type: object
properties:
type:
type: string
id:
type: string
included:
type: array
items:
type: object
properties:
type:
type: string
id:
type: string
attributes:
type: object
properties:
amount:
oneOf:
- type: string
description: amount as a decimal string
- type: string
example:
data:
- type: account
id: a1
attributes:
name: a1
taxId: TFN-a1
relationships:
balance:
data:
type: balance
id: bal-a1
- type: account
id: a3
attributes:
name: a3
taxId: TFN-a3
relationships:
balance:
data:
type: balance
id: bal-a3
included:
- type: balance
id: bal-a1
attributes:
amount: "100.00"
- type: balance
id: bal-a3
attributes:
amount: SECRET-a3
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: JSON:API compound document
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data",
"item_id": "id",
"action": "read",
"resource_type": "P33"
},
"mask": {
"fields": [
"attributes.taxId"
],
"action": "view",
"resource_type": "P33"
}
},
"method": "GET",
"path": "/api/P33"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P33' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 153
date: Thu, 22 Oct 2026 09:43:33 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 217
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: a0c71002256d86404129425054bcce28{
"data": [
{
"type": "account",
"id": "a1",
"attributes": {
"name": "a1",
"taxId": "TFN-a1"
},
"relationships": {
"balance": {
"data": {
"type": "balance",
"id": "bal-a1"
}
}
}
}
]
}What the metadata means
Nothing about a3: no bal-a3 in included[].
{
"data": [
{
"type": "account",
"id": "a1",
"attributes": {
"name": "a1",
"taxId": "TFN-a1"
},
"relationships": {
"balance": {
"data": {
"type": "balance",
"id": "bal-a1"
}
}
}
}
]
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60730,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P33",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60730,
"method": "GET",
"url": "https://gateway.example/api/P33",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60730,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P33",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60730,
"method": "GET",
"url": "https://gateway.example/api/P33",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60730,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P33",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60730,
"method": "GET",
"url": "https://gateway.example/api/P33",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 2117
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "491"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:33 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": [
{
"type": "account",
"id": "a1",
"attributes": {
"name": "a1",
"taxId": "TFN-a1"
},
"relationships": {
"balance": {
"data": {
"type": "balance",
"id": "bal-a1"
}
}
}
},
{
"type": "account",
"id": "a3",
"attributes": {
"name": "a3",
"taxId": "TFN-a3"
},
"relationships": {
"balance": {
"data": {
"type": "balance",
"id": "bal-a3"
}
}
}
}
],
"included": [
{
"type": "balance",
"id": "bal-a1",
"attributes": {
"amount": "100.00"
}
},
{
"type": "balance",
"id": "bal-a3",
"attributes": {
"amount": "SECRET-a3"
}
}
]
},
"request": {
"source_port": 60730,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P33",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P33",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P33",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "491"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:33 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": [
{
"type": "account",
"id": "a1",
"attributes": {
"name": "a1",
"taxId": "TFN-a1"
},
"relationships": {
"balance": {
"data": {
"type": "balance",
"id": "bal-a1"
}
}
}
}
]
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P33"
}
}Response
{
"results": [
{
"type": "P33",
"id": "a1"
},
{
"type": "P33",
"id": "a2"
},
{
"type": "P33",
"id": "a4"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P33"
}
}Response
{
"results": [
{
"type": "P33",
"id": "a1"
},
{
"type": "P33",
"id": "a2"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P33 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P33
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: a0c71002256d86404129425054bcce28
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": [
{
"type": "account",
"id": "a1",
"attributes": {
"name": "a1",
"taxId": "TFN-a1"
},
"relationships": {
"balance": {
"data": {
"type": "balance",
"id": "bal-a1"
}
}
}
},
{
"type": "account",
"id": "a3",
"attributes": {
"name": "a3",
"taxId": "TFN-a3"
},
"relationships": {
"balance": {
"data": {
"type": "balance",
"id": "bal-a3"
}
}
}
}
],
"included": [
{
"type": "balance",
"id": "bal-a1",
"attributes": {
"amount": "100.00"
}
},
{
"type": "balance",
"id": "bal-a3",
"attributes": {
"amount": "SECRET-a3"
}
}
]
}P34$batch envelope: responses[].body, with a 404 entryOData / Microsoft Graph: POST /$batchpass · 2004 PDP · 3 PIP · 1 upstream
As the metadata means.
OpenAPI 3.1
Modelled on OData / Microsoft Graph: POST /$batch. Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P34: OData / Microsoft Graph: POST /$batch"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P34:
get:
operationId: caseP34
summary: "$batch envelope: responses[].body, with a 404 entry"
security:
- bearerAuth: []
parameters: []
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
responses:
type: array
items:
type: object
properties:
id:
type: string
status:
type: integer
headers:
type: object
properties:
etag:
type: string
body:
type: object
properties:
id:
type: string
name:
type: string
balance:
type: integer
tax_id:
type: string
error:
type: object
properties:
code:
type: string
message:
type: string
example:
responses:
- id: "1"
status: 200
headers:
etag: "W/\"1\""
body:
id: a1
name: Account a1
balance: 100
tax_id: TFN-0
- id: "2"
status: 200
body:
id: a3
name: Account a3
balance: 100
tax_id: TFN-0
- id: "3"
status: 404
body:
error:
code: NotFound
message: a9
- id: "4"
status: 200
body:
id: a4
name: Account a4
balance: 100
tax_id: TFN-0
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: "OData / Microsoft Graph: POST /$batch"
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.responses",
"item_id": "body.id",
"action": "read",
"resource_type": "P34"
},
"mask": {
"fields": [
"body.balance",
"body.tax_id"
],
"action": "view",
"resource_type": "P34"
}
},
"method": "GET",
"path": "/api/P34"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P34' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 201
date: Thu, 22 Oct 2026 09:43:35 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 207
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: c9681c38eb4c64429433c7654eb9aa29{
"responses": [
{
"id": "1",
"status": 200,
"headers": {
"etag": "W/\"1\""
},
"body": {
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
}
},
{
"id": "4",
"status": 200,
"body": {
"id": "a4",
"name": "Account a4"
}
}
]
}What the metadata means
{
"responses": [
{
"id": "1",
"status": 200,
"headers": {
"etag": "W/\"1\""
},
"body": {
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
}
},
{
"id": "4",
"status": 200,
"body": {
"id": "a4",
"name": "Account a4"
}
}
]
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60746,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P34",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60746,
"method": "GET",
"url": "https://gateway.example/api/P34",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60746,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P34",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60746,
"method": "GET",
"url": "https://gateway.example/api/P34",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 60746,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P34",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 60746,
"method": "GET",
"url": "https://gateway.example/api/P34",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 2080
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "454"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:35 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"responses": [
{
"id": "1",
"status": 200,
"headers": {
"etag": "W/\"1\""
},
"body": {
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
}
},
{
"id": "2",
"status": 200,
"body": {
"id": "a3",
"name": "Account a3",
"balance": 100,
"tax_id": "TFN-0"
}
},
{
"id": "3",
"status": 404,
"body": {
"error": {
"code": "NotFound",
"message": "a9"
}
}
},
{
"id": "4",
"status": 200,
"body": {
"id": "a4",
"name": "Account a4",
"balance": 100,
"tax_id": "TFN-0"
}
}
]
},
"request": {
"source_port": 60746,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P34",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P34",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P34",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "454"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:35 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"responses": [
{
"id": "1",
"status": 200,
"headers": {
"etag": "W/\"1\""
},
"body": {
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
}
},
{
"id": "4",
"status": 200,
"body": {
"id": "a4",
"name": "Account a4"
}
}
]
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P34"
}
}Response
{
"results": [
{
"type": "P34",
"id": "a1"
},
{
"type": "P34",
"id": "a2"
},
{
"type": "P34",
"id": "a4"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P34"
}
}Response
{
"results": [
{
"type": "P34",
"id": "a1"
},
{
"type": "P34",
"id": "a2"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P34 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P34
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: c9681c38eb4c64429433c7654eb9aa29
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"responses": [
{
"id": "1",
"status": 200,
"headers": {
"etag": "W/\"1\""
},
"body": {
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
}
},
{
"id": "2",
"status": 200,
"body": {
"id": "a3",
"name": "Account a3",
"balance": 100,
"tax_id": "TFN-0"
}
},
{
"id": "3",
"status": 404,
"body": {
"error": {
"code": "NotFound",
"message": "a9"
}
}
},
{
"id": "4",
"status": 200,
"body": {
"id": "a4",
"name": "Account a4",
"balance": 100,
"tax_id": "TFN-0"
}
}
]
}P35Elasticsearch search: hits.hits[]._source, plus aggregations over every hitElasticsearch: GET /accounts/_searchpass · 2004 PDP · 3 PIP · 1 upstream
aggregations is removed, a3's hit is filtered out, and hits.total (declared as the count) says 3.
OpenAPI 3.1
Modelled on Elasticsearch: GET /accounts/_search. Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P35: Elasticsearch: GET /accounts/_search"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P35:
get:
operationId: caseP35
summary: "Elasticsearch search: hits.hits[]._source, plus aggregations over every hit"
security:
- bearerAuth: []
parameters: []
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
took:
type: integer
timed_out:
type: boolean
_shards:
type: object
properties:
total:
type: integer
successful:
type: integer
failed:
type: integer
hits:
type: object
properties:
total:
type: object
properties:
value:
type: integer
relation:
type: string
max_score:
type: number
hits:
type: array
items:
type: object
properties:
_index:
type: string
_id:
type: string
_score:
type: number
_source:
type: object
properties:
name:
type: string
balance:
type: integer
tax_id:
type: string
aggregations:
type: object
properties:
by_branch:
type: object
properties:
buckets:
type: array
items:
type: object
properties:
key:
type: string
doc_count:
type: integer
example:
took: 3
timed_out: false
_shards:
total: 1
successful: 1
failed: 0
hits:
total:
value: 4
relation: eq
max_score: 1.0
hits:
- _index: accounts
_id: a1
_score: 1.0
_source:
name: Account a1
balance: 100
tax_id: TFN-0
- _index: accounts
_id: a2
_score: 1.0
_source:
name: Account a2
balance: 101
tax_id: TFN-1
- _index: accounts
_id: a3
_score: 1.0
_source:
name: Account a3
balance: 102
tax_id: TFN-2
- _index: accounts
_id: a4
_score: 1.0
_source:
name: Account a4
balance: 103
tax_id: TFN-3
aggregations:
by_branch:
buckets:
- key: Parramatta
doc_count: 3
- key: SECRET-a3-branch
doc_count: 1
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: "Elasticsearch: GET /accounts/_search"
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.hits.hits",
"item_id": "_id",
"action": "read",
"count": "$.hits.total.value",
"resource_type": "P35"
},
"mask": {
"fields": [
"_source.balance",
"_source.tax_id"
],
"action": "view",
"resource_type": "P35"
}
},
"method": "GET",
"path": "/api/P35"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P35' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 367
date: Thu, 22 Oct 2026 09:43:36 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 151
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: 7147a903cac5dd41c6c8b553aa2d022b{
"hits": {
"total": {
"value": 3,
"relation": "eq"
},
"max_score": 1.0,
"hits": [
{
"_index": "accounts",
"_id": "a1",
"_score": 1.0,
"_source": {
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
}
},
{
"_index": "accounts",
"_id": "a2",
"_score": 1.0,
"_source": {
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
}
},
{
"_index": "accounts",
"_id": "a4",
"_score": 1.0,
"_source": {
"name": "Account a4"
}
}
]
}
}What the metadata means
No hit for a3 and nothing derived from it.
{
"hits": {
"total": {
"value": 3,
"relation": "eq"
},
"max_score": 1.0,
"hits": [
{
"_index": "accounts",
"_id": "a1",
"_score": 1.0,
"_source": {
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
}
},
{
"_index": "accounts",
"_id": "a2",
"_score": 1.0,
"_source": {
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
}
},
{
"_index": "accounts",
"_id": "a4",
"_score": 1.0,
"_source": {
"name": "Account a4"
}
}
]
}
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 55688,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P35",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 55688,
"method": "GET",
"url": "https://gateway.example/api/P35",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 55688,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P35",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 55688,
"method": "GET",
"url": "https://gateway.example/api/P35",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 55688,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P35",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 55688,
"method": "GET",
"url": "https://gateway.example/api/P35",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 2445
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "783"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:36 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"took": 3,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"failed": 0
},
"hits": {
"total": {
"value": 4,
"relation": "eq"
},
"max_score": 1.0,
"hits": [
{
"_index": "accounts",
"_id": "a1",
"_score": 1.0,
"_source": {
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
}
},
{
"_index": "accounts",
"_id": "a2",
"_score": 1.0,
"_source": {
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
}
},
{
"_index": "accounts",
"_id": "a3",
"_score": 1.0,
"_source": {
"name": "Account a3",
"balance": 102,
"tax_id": "TFN-2"
}
},
{
"_index": "accounts",
"_id": "a4",
"_score": 1.0,
"_source": {
"name": "Account a4",
"balance": 103,
"tax_id": "TFN-3"
}
}
]
},
"aggregations": {
"by_branch": {
"buckets": [
{
"key": "Parramatta",
"doc_count": 3
},
{
"key": "SECRET-a3-branch",
"doc_count": 1
}
]
}
}
},
"request": {
"source_port": 55688,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P35",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P35",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P35",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "783"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:36 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"hits": {
"total": {
"value": 3,
"relation": "eq"
},
"max_score": 1.0,
"hits": [
{
"_index": "accounts",
"_id": "a1",
"_score": 1.0,
"_source": {
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
}
},
{
"_index": "accounts",
"_id": "a2",
"_score": 1.0,
"_source": {
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
}
},
{
"_index": "accounts",
"_id": "a4",
"_score": 1.0,
"_source": {
"name": "Account a4"
}
}
]
}
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P35"
}
}Response
{
"results": [
{
"type": "P35",
"id": "a1"
},
{
"type": "P35",
"id": "a2"
},
{
"type": "P35",
"id": "a4"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P35"
}
}Response
{
"results": [
{
"type": "P35",
"id": "a1"
},
{
"type": "P35",
"id": "a2"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P35 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P35
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: 7147a903cac5dd41c6c8b553aa2d022b
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"took": 3,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"failed": 0
},
"hits": {
"total": {
"value": 4,
"relation": "eq"
},
"max_score": 1.0,
"hits": [
{
"_index": "accounts",
"_id": "a1",
"_score": 1.0,
"_source": {
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
}
},
{
"_index": "accounts",
"_id": "a2",
"_score": 1.0,
"_source": {
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
}
},
{
"_index": "accounts",
"_id": "a3",
"_score": 1.0,
"_source": {
"name": "Account a3",
"balance": 102,
"tax_id": "TFN-2"
}
},
{
"_index": "accounts",
"_id": "a4",
"_score": 1.0,
"_source": {
"name": "Account a4",
"balance": 103,
"tax_id": "TFN-3"
}
}
]
},
"aggregations": {
"by_branch": {
"buckets": [
{
"key": "Parramatta",
"doc_count": 3
},
{
"key": "SECRET-a3-branch",
"doc_count": 1
}
]
}
}
}P36FHIR searchset Bundle: entry[].resource, mixed resource types, an OperationOutcomeFHIR R4: GET /Patient?_include=Observation:subjectpass · 2004 PDP · 3 PIP · 1 upstream
The Bundle keeps resourceType, type, total and link (declared in keep), and total counts what is shown.
OpenAPI 3.1
Modelled on FHIR R4: GET /Patient?_include=Observation:subject. Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P36: FHIR R4: GET /Patient?_include=Observation:subject"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P36:
get:
operationId: caseP36
summary: "FHIR searchset Bundle: entry[].resource, mixed resource types, an OperationOutcome"
security:
- bearerAuth: []
parameters: []
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
resourceType:
type: string
type:
type: string
total:
type: integer
link:
type: array
items:
type: object
properties:
relation:
type: string
url:
type: string
entry:
type: array
items:
type: object
properties:
fullUrl:
type: string
search:
type: object
properties:
mode:
type: string
resource:
type: object
properties:
resourceType:
type: string
id:
type: string
birthDate:
type: string
format: date
identifier:
type: array
items:
type: object
properties:
system:
type: string
value:
type: string
name:
type: array
items:
type: object
properties:
family:
type: string
given:
type: array
items:
type: string
status:
type: string
subject:
type: object
properties:
reference:
type: string
valueQuantity:
type: object
properties:
value:
type: integer
unit:
type: string
issue:
type: array
items:
type: object
properties:
severity:
type: string
code:
type: string
example:
resourceType: Bundle
type: searchset
total: 3
link:
- relation: self
url: "https://fhir.example/Patient?_include=Observation:subject"
entry:
- fullUrl: https://fhir.example/Patient/p1
search:
mode: match
resource:
resourceType: Patient
id: p1
birthDate: "1980-02-01"
identifier:
- system: http://ns.electronichealth.net.au/id/medicare-number
value: "2950123411"
name:
- family: Citizen
given:
- p1
- fullUrl: https://fhir.example/Patient/p2
search:
mode: match
resource:
resourceType: Patient
id: p2
birthDate: "1980-02-02"
identifier:
- system: http://ns.electronichealth.net.au/id/medicare-number
value: "2950123421"
name:
- family: Citizen
given:
- p2
- fullUrl: https://fhir.example/Patient/p3
search:
mode: match
resource:
resourceType: Patient
id: p3
birthDate: "1980-02-03"
identifier:
- system: http://ns.electronichealth.net.au/id/medicare-number
value: "2950123431"
name:
- family: Citizen
given:
- p3
- fullUrl: https://fhir.example/Observation/o1
search:
mode: include
resource:
resourceType: Observation
id: o1
status: final
subject:
reference: Patient/p1
valueQuantity:
value: 72
unit: beats/min
- search:
mode: outcome
resource:
resourceType: OperationOutcome
issue:
- severity: information
code: informational
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: "FHIR R4: GET /Patient?_include=Observation:subject"
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.entry",
"item_id": "resource.id",
"action": "read",
"count": "$.total",
"resource_type": "P36"
},
"mask": {
"fields": [
"resource.identifier",
"resource.birthDate"
],
"action": "view",
"resource_type": "P36"
},
"keep": [
"resourceType",
"type",
"total",
"link"
]
},
"method": "GET",
"path": "/api/P36"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"p1",
"p2",
"o1"
],
"view": [
"p1"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P36' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 848
date: Thu, 22 Oct 2026 09:43:38 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 5
X-Kong-Proxy-Latency: 205
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: 77619b7d7ee6e24a3e024e4c3107bd28{
"resourceType": "Bundle",
"type": "searchset",
"total": 3,
"link": [
{
"relation": "self",
"url": "https://fhir.example/Patient?_include=Observation:subject"
}
],
"entry": [
{
"fullUrl": "https://fhir.example/Patient/p1",
"search": {
"mode": "match"
},
"resource": {
"resourceType": "Patient",
"id": "p1",
"birthDate": "1980-02-01",
"identifier": [
{
"system": "http://ns.electronichealth.net.au/id/medicare-number",
"value": "2950123411"
}
],
"name": [
{
"family": "Citizen",
"given": [
"p1"
]
}
]
}
},
{
"fullUrl": "https://fhir.example/Patient/p2",
"search": {
"mode": "match"
},
"resource": {
"resourceType": "Patient",
"id": "p2",
"name": [
{
"family": "Citizen",
"given": [
"p2"
]
}
]
}
},
{
"fullUrl": "https://fhir.example/Observation/o1",
"search": {
"mode": "include"
},
"resource": {
"resourceType": "Observation",
"id": "o1",
"status": "final",
"subject": {
"reference": "Patient/p1"
},
"valueQuantity": {
"value": 72,
"unit": "beats/min"
}
}
}
]
}What the metadata means
{
"resourceType": "Bundle",
"type": "searchset",
"total": 3,
"link": [
{
"relation": "self",
"url": "https://fhir.example/Patient?_include=Observation:subject"
}
],
"entry": [
{
"fullUrl": "https://fhir.example/Patient/p1",
"search": {
"mode": "match"
},
"resource": {
"resourceType": "Patient",
"id": "p1",
"birthDate": "1980-02-01",
"identifier": [
{
"system": "http://ns.electronichealth.net.au/id/medicare-number",
"value": "2950123411"
}
],
"name": [
{
"family": "Citizen",
"given": [
"p1"
]
}
]
}
},
{
"fullUrl": "https://fhir.example/Patient/p2",
"search": {
"mode": "match"
},
"resource": {
"resourceType": "Patient",
"id": "p2",
"name": [
{
"family": "Citizen",
"given": [
"p2"
]
}
]
}
},
{
"fullUrl": "https://fhir.example/Observation/o1",
"search": {
"mode": "include"
},
"resource": {
"resourceType": "Observation",
"id": "o1",
"status": "final",
"subject": {
"reference": "Patient/p1"
},
"valueQuantity": {
"value": 72,
"unit": "beats/min"
}
}
}
]
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 55698,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P36",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 55698,
"method": "GET",
"url": "https://gateway.example/api/P36",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 55698,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P36",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 55698,
"method": "GET",
"url": "https://gateway.example/api/P36",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 55698,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P36",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 55698,
"method": "GET",
"url": "https://gateway.example/api/P36",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 3257
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "1512"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:38 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"resourceType": "Bundle",
"type": "searchset",
"total": 3,
"link": [
{
"relation": "self",
"url": "https://fhir.example/Patient?_include=Observation:subject"
}
],
"entry": [
{
"fullUrl": "https://fhir.example/Patient/p1",
"search": {
"mode": "match"
},
"resource": {
"resourceType": "Patient",
"id": "p1",
"birthDate": "1980-02-01",
"identifier": [
{
"system": "http://ns.electronichealth.net.au/id/medicare-number",
"value": "2950123411"
}
],
"name": [
{
"family": "Citizen",
"given": [
"p1"
]
}
]
}
},
{
"fullUrl": "https://fhir.example/Patient/p2",
"search": {
"mode": "match"
},
"resource": {
"resourceType": "Patient",
"id": "p2",
"birthDate": "1980-02-02",
"identifier": [
{
"system": "http://ns.electronichealth.net.au/id/medicare-number",
"value": "2950123421"
}
],
"name": [
{
"family": "Citizen",
"given": [
"p2"
]
}
]
}
},
{
"fullUrl": "https://fhir.example/Patient/p3",
"search": {
"mode": "match"
},
"resource": {
"resourceType": "Patient",
"id": "p3",
"birthDate": "1980-02-03",
"identifier": [
{
"system": "http://ns.electronichealth.net.au/id/medicare-number",
"value": "2950123431"
}
],
"name": [
{
"family": "Citizen",
"given": [
"p3"
]
}
]
}
},
{
"fullUrl": "https://fhir.example/Observation/o1",
"search": {
"mode": "include"
},
"resource": {
"resourceType": "Observation",
"id": "o1",
"status": "final",
"subject": {
"reference": "Patient/p1"
},
"valueQuantity": {
"value": 72,
"unit": "beats/min"
}
}
},
{
"search": {
"mode": "outcome"
},
"resource": {
"resourceType": "OperationOutcome",
"issue": [
{
"severity": "information",
"code": "informational"
}
]
}
}
]
},
"request": {
"source_port": 55698,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P36",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P36",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P36",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "1512"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:38 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"resourceType": "Bundle",
"type": "searchset",
"total": 3,
"link": [
{
"relation": "self",
"url": "https://fhir.example/Patient?_include=Observation:subject"
}
],
"entry": [
{
"fullUrl": "https://fhir.example/Patient/p1",
"search": {
"mode": "match"
},
"resource": {
"resourceType": "Patient",
"id": "p1",
"birthDate": "1980-02-01",
"identifier": [
{
"system": "http://ns.electronichealth.net.au/id/medicare-number",
"value": "2950123411"
}
],
"name": [
{
"family": "Citizen",
"given": [
"p1"
]
}
]
}
},
{
"fullUrl": "https://fhir.example/Patient/p2",
"search": {
"mode": "match"
},
"resource": {
"resourceType": "Patient",
"id": "p2",
"name": [
{
"family": "Citizen",
"given": [
"p2"
]
}
]
}
},
{
"fullUrl": "https://fhir.example/Observation/o1",
"search": {
"mode": "include"
},
"resource": {
"resourceType": "Observation",
"id": "o1",
"status": "final",
"subject": {
"reference": "Patient/p1"
},
"valueQuantity": {
"value": 72,
"unit": "beats/min"
}
}
}
]
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P36"
}
}Response
{
"results": [
{
"type": "P36",
"id": "p1"
},
{
"type": "P36",
"id": "p2"
},
{
"type": "P36",
"id": "o1"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P36"
}
}Response
{
"results": [
{
"type": "P36",
"id": "p1"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P36 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P36
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: 77619b7d7ee6e24a3e024e4c3107bd28
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"resourceType": "Bundle",
"type": "searchset",
"total": 3,
"link": [
{
"relation": "self",
"url": "https://fhir.example/Patient?_include=Observation:subject"
}
],
"entry": [
{
"fullUrl": "https://fhir.example/Patient/p1",
"search": {
"mode": "match"
},
"resource": {
"resourceType": "Patient",
"id": "p1",
"birthDate": "1980-02-01",
"identifier": [
{
"system": "http://ns.electronichealth.net.au/id/medicare-number",
"value": "2950123411"
}
],
"name": [
{
"family": "Citizen",
"given": [
"p1"
]
}
]
}
},
{
"fullUrl": "https://fhir.example/Patient/p2",
"search": {
"mode": "match"
},
"resource": {
"resourceType": "Patient",
"id": "p2",
"birthDate": "1980-02-02",
"identifier": [
{
"system": "http://ns.electronichealth.net.au/id/medicare-number",
"value": "2950123421"
}
],
"name": [
{
"family": "Citizen",
"given": [
"p2"
]
}
]
}
},
{
"fullUrl": "https://fhir.example/Patient/p3",
"search": {
"mode": "match"
},
"resource": {
"resourceType": "Patient",
"id": "p3",
"birthDate": "1980-02-03",
"identifier": [
{
"system": "http://ns.electronichealth.net.au/id/medicare-number",
"value": "2950123431"
}
],
"name": [
{
"family": "Citizen",
"given": [
"p3"
]
}
]
}
},
{
"fullUrl": "https://fhir.example/Observation/o1",
"search": {
"mode": "include"
},
"resource": {
"resourceType": "Observation",
"id": "o1",
"status": "final",
"subject": {
"reference": "Patient/p1"
},
"valueQuantity": {
"value": 72,
"unit": "beats/min"
}
}
},
{
"search": {
"mode": "outcome"
},
"resource": {
"resourceType": "OperationOutcome",
"issue": [
{
"severity": "information",
"code": "informational"
}
]
}
}
]
}P37a polymorphic list: a card shares an id with an account the subject may readA polymorphic product listleak · 2004 PDP · 3 PIP · 1 upstream
Leak. The card with id a1 passes because the subject may read account a1.
OpenAPI 3.1
Modelled on A polymorphic product list. Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P37: A polymorphic product list"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P37:
get:
operationId: caseP37
summary: "a polymorphic list: a card shares an id with an account the subject may read"
security:
- bearerAuth: []
parameters: []
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: array
items:
type: object
properties:
type:
type: string
id:
type: string
name:
type: string
balance:
type: integer
tax_id:
type: string
pan:
type: string
expiry:
type: string
example:
data:
- type: account
id: a1
name: Account a1
balance: 100
tax_id: TFN-0
- type: card
id: a1
pan: SECRET-card-4111111111111111
expiry: "12/29"
- type: account
id: a3
name: Account a3
balance: 100
tax_id: TFN-0
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
x-modelled-on: A polymorphic product list
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data",
"item_id": "id",
"action": "read",
"resource_type": "P37"
},
"mask": {
"fields": [
"balance",
"tax_id"
],
"action": "view",
"resource_type": "P37"
}
},
"method": "GET",
"path": "/api/P37"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P37' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 170
date: Thu, 22 Oct 2026 09:43:40 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 5
X-Kong-Proxy-Latency: 314
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: fd568019508cf01051de1125f6491e4e{
"data": [
{
"type": "account",
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"type": "card",
"id": "a1",
"pan": "SECRET-card-4111111111111111",
"expiry": "12/29"
}
]
}What the metadata means
The card removed (the subject may read account a1, not card a1); a3 removed.
{
"data": [
{
"type": "account",
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"type": "card",
"id": "a1",
"pan": "SECRET-card-4111111111111111",
"expiry": "12/29"
}
]
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 55704,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P37",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 55704,
"method": "GET",
"url": "https://gateway.example/api/P37",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 55704,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P37",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 55704,
"method": "GET",
"url": "https://gateway.example/api/P37",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 55704,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P37",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 55704,
"method": "GET",
"url": "https://gateway.example/api/P37",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 1862
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "278"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:40 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": [
{
"type": "account",
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"type": "card",
"id": "a1",
"pan": "SECRET-card-4111111111111111",
"expiry": "12/29"
},
{
"type": "account",
"id": "a3",
"name": "Account a3",
"balance": 100,
"tax_id": "TFN-0"
}
]
},
"request": {
"source_port": 55704,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P37",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P37",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P37",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "278"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:40 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": [
{
"type": "account",
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"type": "card",
"id": "a1",
"pan": "SECRET-card-4111111111111111",
"expiry": "12/29"
}
]
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P37"
}
}Response
{
"results": [
{
"type": "P37",
"id": "a1"
},
{
"type": "P37",
"id": "a2"
},
{
"type": "P37",
"id": "a4"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P37"
}
}Response
{
"results": [
{
"type": "P37",
"id": "a1"
},
{
"type": "P37",
"id": "a2"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P37 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P37
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: fd568019508cf01051de1125f6491e4e
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": [
{
"type": "account",
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"type": "card",
"id": "a1",
"pan": "SECRET-card-4111111111111111",
"expiry": "12/29"
},
{
"type": "account",
"id": "a3",
"name": "Account a3",
"balance": 100,
"tax_id": "TFN-0"
}
]
}Parsing and content types · 10
P39duplicate keys: a second data[] after the first (parser differential)Parsing and content typespass · 2004 PDP · 3 PIP · 1 upstream
As the metadata means.
OpenAPI 3.1
Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P39: duplicate keys: a second data[] after the first (parser differential)"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P39:
get:
operationId: caseP39
summary: "duplicate keys: a second data[] after the first (parser differential)"
security:
- bearerAuth: []
parameters: []
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: array
items:
type: object
properties:
id:
type: string
name:
type: string
balance:
type: integer
tax_id:
type: string
example:
data:
- id: a3
name: SECRET-a3
balance: 3
tax_id: SECRET-a3-tfn
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data",
"item_id": "id",
"action": "read",
"resource_type": "P39"
},
"mask": {
"fields": [
"balance",
"tax_id"
],
"action": "view",
"resource_type": "P39"
}
},
"method": "GET",
"path": "/api/P39"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P39' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 11
date: Thu, 22 Oct 2026 09:43:42 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 160
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: 12db4d3dcd0338670180dd3490c56b33{
"data": []
}What the metadata means
Nothing of a3's (refusing the malformed body is also right).
{
"data": []
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 55718,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P39",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 55718,
"method": "GET",
"url": "https://gateway.example/api/P39",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 55718,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P39",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 55718,
"method": "GET",
"url": "https://gateway.example/api/P39",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 55718,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P39",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 55718,
"method": "GET",
"url": "https://gateway.example/api/P39",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 1707
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "145"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:42 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": [
{
"id": "a3",
"name": "SECRET-a3",
"balance": 3,
"tax_id": "SECRET-a3-tfn"
}
]
},
"request": {
"source_port": 55718,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P39",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P39",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P39",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "145"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:42 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": []
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P39"
}
}Response
{
"results": [
{
"type": "P39",
"id": "a1"
},
{
"type": "P39",
"id": "a2"
},
{
"type": "P39",
"id": "a4"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P39"
}
}Response
{
"results": [
{
"type": "P39",
"id": "a1"
},
{
"type": "P39",
"id": "a2"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P39 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P39
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: 12db4d3dcd0338670180dd3490c56b33
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": [
{
"id": "a3",
"name": "SECRET-a3",
"balance": 3,
"tax_id": "SECRET-a3-tfn"
}
]
}P40duplicate keys inside an item: id a3, then id a1Parsing and content typespass · 2004 PDP · 3 PIP · 1 upstream
As the metadata means.
OpenAPI 3.1
Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P40: duplicate keys inside an item: id a3, then id a1"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P40:
get:
operationId: caseP40
summary: "duplicate keys inside an item: id a3, then id a1"
security:
- bearerAuth: []
parameters: []
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: array
items:
type: object
properties:
id:
type: string
name:
type: string
balance:
type: integer
tax_id:
type: string
example:
data:
- id: a1
name: SECRET-a3
balance: 3
tax_id: T3
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data",
"item_id": "id",
"action": "read",
"resource_type": "P40"
},
"mask": {
"fields": [
"balance",
"tax_id"
],
"action": "view",
"resource_type": "P40"
}
},
"method": "GET",
"path": "/api/P40"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1"
],
"view": [
"a1"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P40' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 67
date: Thu, 22 Oct 2026 09:43:44 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 140
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: e245a509c23828659f1a86590405f372{
"data": [
{
"id": "a1",
"name": "SECRET-a3",
"balance": 3,
"tax_id": "T3"
}
]
}What the metadata means
No object a first-wins parser would read as a3.
{
"data": [
{
"id": "a1",
"name": "SECRET-a3",
"balance": 3,
"tax_id": "T3"
}
]
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 55734,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P40",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 55734,
"method": "GET",
"url": "https://gateway.example/api/P40",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 55734,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P40",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 55734,
"method": "GET",
"url": "https://gateway.example/api/P40",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 55734,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P40",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 55734,
"method": "GET",
"url": "https://gateway.example/api/P40",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 1626
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "77"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:44 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": [
{
"id": "a1",
"name": "SECRET-a3",
"balance": 3,
"tax_id": "T3"
}
]
},
"request": {
"source_port": 55734,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P40",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P40",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P40",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "77"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:44 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": [
{
"id": "a1",
"name": "SECRET-a3",
"balance": 3,
"tax_id": "T3"
}
]
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P40"
}
}Response
{
"results": [
{
"type": "P40",
"id": "a1"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P40"
}
}Response
{
"results": [
{
"type": "P40",
"id": "a1"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P40 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P40
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: e245a509c23828659f1a86590405f372
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": [
{
"id": "a1",
"name": "SECRET-a3",
"balance": 3,
"tax_id": "T3"
}
]
}P41ids past 2^53 (9007199254740993 and …992 are one double)Parsing and content typespass · 2004 PDP · 3 PIP · 1 upstream
As the metadata means.
OpenAPI 3.1
Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P41: ids past 2^53 (9007199254740993 and …992 are one double)"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P41:
get:
operationId: caseP41
summary: "ids past 2^53 (9007199254740993 and …992 are one double)"
security:
- bearerAuth: []
parameters: []
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: array
items:
type: object
properties:
id:
type: integer
balance:
oneOf:
- type: integer
- type: string
tax_id:
type: string
example:
data:
- id: 9007199254740993
balance: 1
tax_id: T1
- id: 9007199254740992
balance: SECRET-992
tax_id: SECRET-992
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data",
"item_id": "id",
"action": "read",
"resource_type": "P41"
},
"mask": {
"fields": [
"balance",
"tax_id"
],
"action": "view",
"resource_type": "P41"
}
},
"method": "GET",
"path": "/api/P41"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"9007199254740993"
],
"view": [
"9007199254740993"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P41' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 60
date: Thu, 22 Oct 2026 09:43:45 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 155
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: dee35247afbca271f7b8262c7eab6349{
"data": [
{
"id": 9007199254740993,
"balance": 1,
"tax_id": "T1"
}
]
}What the metadata means
…993 kept with every digit, …992 removed.
{
"data": [
{
"id": 9007199254740993,
"balance": 1,
"tax_id": "T1"
}
]
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61676,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P41",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61676,
"method": "GET",
"url": "https://gateway.example/api/P41",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61676,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P41",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61676,
"method": "GET",
"url": "https://gateway.example/api/P41",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61676,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P41",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61676,
"method": "GET",
"url": "https://gateway.example/api/P41",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 1679
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "129"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:45 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": [
{
"id": 9007199254740993,
"balance": 1,
"tax_id": "T1"
},
{
"id": 9007199254740992,
"balance": "SECRET-992",
"tax_id": "SECRET-992"
}
]
},
"request": {
"source_port": 61676,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P41",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P41",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P41",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "129"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:45 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": [
{
"id": 9007199254740993,
"balance": 1,
"tax_id": "T1"
}
]
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P41"
}
}Response
{
"results": [
{
"type": "P41",
"id": "9007199254740993"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P41"
}
}Response
{
"results": [
{
"type": "P41",
"id": "9007199254740993"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P41 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P41
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: dee35247afbca271f7b8262c7eab6349
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": [
{
"id": 9007199254740993,
"balance": 1,
"tax_id": "T1"
},
{
"id": 9007199254740992,
"balance": "SECRET-992",
"tax_id": "SECRET-992"
}
]
}P42JSON under application/vnd.api+jsonParsing and content typespass · 2004 PDP · 3 PIP · 1 upstream
As the metadata means.
OpenAPI 3.1
Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P42: JSON under application/vnd.api+json"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P42:
get:
operationId: caseP42
summary: "JSON under application/vnd.api+json"
security:
- bearerAuth: []
parameters: []
responses:
"200":
description: "The resource's answer"
content:
"application/vnd.api+json":
schema:
type: object
properties:
data:
type: array
items:
type: object
properties:
id:
type: string
name:
type: string
balance:
type: integer
tax_id:
type: string
example:
data:
- id: a1
name: Account a1
balance: 100
tax_id: TFN-0
- id: a2
name: Account a2
balance: 101
tax_id: TFN-1
- id: a3
name: Account a3
balance: 102
tax_id: TFN-2
- id: a4
name: Account a4
balance: 103
tax_id: TFN-3
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data",
"item_id": "id",
"action": "read",
"resource_type": "P42"
},
"mask": {
"fields": [
"balance",
"tax_id"
],
"action": "view",
"resource_type": "P42"
}
},
"method": "GET",
"path": "/api/P42"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P42' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/vnd.api+json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 168
date: Thu, 22 Oct 2026 09:43:47 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 136
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: d429293238e2687cd36732729d92456a{
"data": [
{
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"id": "a2",
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
},
{
"id": "a4",
"name": "Account a4"
}
]
}What the metadata means
{
"data": [
{
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"id": "a2",
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
},
{
"id": "a4",
"name": "Account a4"
}
]
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61682,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P42",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61682,
"method": "GET",
"url": "https://gateway.example/api/P42",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61682,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P42",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61682,
"method": "GET",
"url": "https://gateway.example/api/P42",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61682,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P42",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61682,
"method": "GET",
"url": "https://gateway.example/api/P42",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 1890
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "294"
},
{
"content-type": "application/vnd.api+json"
},
{
"date": "Thu, 22 Oct 2026 09:43:47 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": [
{
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"id": "a2",
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
},
{
"id": "a3",
"name": "Account a3",
"balance": 102,
"tax_id": "TFN-2"
},
{
"id": "a4",
"name": "Account a4",
"balance": 103,
"tax_id": "TFN-3"
}
]
},
"request": {
"source_port": 61682,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P42",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P42",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P42",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "294"
},
{
"content-type": "application/vnd.api+json"
},
{
"date": "Thu, 22 Oct 2026 09:43:47 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": [
{
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"id": "a2",
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
},
{
"id": "a4",
"name": "Account a4"
}
]
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P42"
}
}Response
{
"results": [
{
"type": "P42",
"id": "a1"
},
{
"type": "P42",
"id": "a2"
},
{
"type": "P42",
"id": "a4"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P42"
}
}Response
{
"results": [
{
"type": "P42",
"id": "a1"
},
{
"type": "P42",
"id": "a2"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P42 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P42
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: d429293238e2687cd36732729d92456a
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": [
{
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"id": "a2",
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
},
{
"id": "a3",
"name": "Account a3",
"balance": 102,
"tax_id": "TFN-2"
},
{
"id": "a4",
"name": "Account a4",
"balance": 103,
"tax_id": "TFN-3"
}
]
}P43JSON under application/json; charset=utf-8Parsing and content typespass · 2004 PDP · 3 PIP · 1 upstream
As the metadata means.
OpenAPI 3.1
Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P43: JSON under application/json; charset=utf-8"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P43:
get:
operationId: caseP43
summary: "JSON under application/json; charset=utf-8"
security:
- bearerAuth: []
parameters: []
responses:
"200":
description: "The resource's answer"
content:
"application/json; charset=utf-8":
schema:
type: object
properties:
data:
type: array
items:
type: object
properties:
id:
type: string
name:
type: string
balance:
type: integer
tax_id:
type: string
example:
data:
- id: a1
name: Account a1
balance: 100
tax_id: TFN-0
- id: a2
name: Account a2
balance: 101
tax_id: TFN-1
- id: a3
name: Account a3
balance: 102
tax_id: TFN-2
- id: a4
name: Account a4
balance: 103
tax_id: TFN-3
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data",
"item_id": "id",
"action": "read",
"resource_type": "P43"
},
"mask": {
"fields": [
"balance",
"tax_id"
],
"action": "view",
"resource_type": "P43"
}
},
"method": "GET",
"path": "/api/P43"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P43' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json; charset=utf-8
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 168
date: Thu, 22 Oct 2026 09:43:49 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 121
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: 232fcd3e679bf957eb4bf01395767642{
"data": [
{
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"id": "a2",
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
},
{
"id": "a4",
"name": "Account a4"
}
]
}What the metadata means
{
"data": [
{
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"id": "a2",
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
},
{
"id": "a4",
"name": "Account a4"
}
]
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61698,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P43",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61698,
"method": "GET",
"url": "https://gateway.example/api/P43",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61698,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P43",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61698,
"method": "GET",
"url": "https://gateway.example/api/P43",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61698,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P43",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61698,
"method": "GET",
"url": "https://gateway.example/api/P43",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 1897
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "294"
},
{
"content-type": "application/json; charset=utf-8"
},
{
"date": "Thu, 22 Oct 2026 09:43:49 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": [
{
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"id": "a2",
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
},
{
"id": "a3",
"name": "Account a3",
"balance": 102,
"tax_id": "TFN-2"
},
{
"id": "a4",
"name": "Account a4",
"balance": 103,
"tax_id": "TFN-3"
}
]
},
"request": {
"source_port": 61698,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P43",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P43",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P43",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "294"
},
{
"content-type": "application/json; charset=utf-8"
},
{
"date": "Thu, 22 Oct 2026 09:43:49 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": [
{
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"id": "a2",
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
},
{
"id": "a4",
"name": "Account a4"
}
]
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P43"
}
}Response
{
"results": [
{
"type": "P43",
"id": "a1"
},
{
"type": "P43",
"id": "a2"
},
{
"type": "P43",
"id": "a4"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P43"
}
}Response
{
"results": [
{
"type": "P43",
"id": "a1"
},
{
"type": "P43",
"id": "a2"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P43 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P43
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: 232fcd3e679bf957eb4bf01395767642
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": [
{
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"id": "a2",
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
},
{
"id": "a3",
"name": "Account a3",
"balance": 102,
"tax_id": "TFN-2"
},
{
"id": "a4",
"name": "Account a4",
"balance": 103,
"tax_id": "TFN-3"
}
]
}P44JSON mislabelled text/plainParsing and content typespass · 2004 PDP · 3 PIP · 1 upstream
As the metadata means.
OpenAPI 3.1
Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P44: JSON mislabelled text/plain"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P44:
get:
operationId: caseP44
summary: JSON mislabelled text/plain
security:
- bearerAuth: []
parameters: []
responses:
"200":
description: "The resource's answer"
content:
text/plain:
schema:
type: object
properties:
data:
type: array
items:
type: object
properties:
id:
type: string
name:
type: string
balance:
type: integer
tax_id:
type: string
example:
data:
- id: a1
name: Account a1
balance: 100
tax_id: TFN-0
- id: a2
name: Account a2
balance: 101
tax_id: TFN-1
- id: a3
name: Account a3
balance: 102
tax_id: TFN-2
- id: a4
name: Account a4
balance: 103
tax_id: TFN-3
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data",
"item_id": "id",
"action": "read",
"resource_type": "P44"
},
"mask": {
"fields": [
"balance",
"tax_id"
],
"action": "view",
"resource_type": "P44"
}
},
"method": "GET",
"path": "/api/P44"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P44' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: text/plain; charset=UTF-8
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 168
date: Thu, 22 Oct 2026 09:43:51 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 5
X-Kong-Proxy-Latency: 147
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: 3161d719b114a6673fa4786da9c27217{
"data": [
{
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"id": "a2",
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
},
{
"id": "a4",
"name": "Account a4"
}
]
}What the metadata means
{
"data": [
{
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"id": "a2",
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
},
{
"id": "a4",
"name": "Account a4"
}
]
}PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61706,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P44",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61706,
"method": "GET",
"url": "https://gateway.example/api/P44",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61706,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P44",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61706,
"method": "GET",
"url": "https://gateway.example/api/P44",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61706,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P44",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61706,
"method": "GET",
"url": "https://gateway.example/api/P44",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 1876
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "294"
},
{
"content-type": "text/plain"
},
{
"date": "Thu, 22 Oct 2026 09:43:51 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": {
"data": [
{
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"id": "a2",
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
},
{
"id": "a3",
"name": "Account a3",
"balance": 102,
"tax_id": "TFN-2"
},
{
"id": "a4",
"name": "Account a4",
"balance": 103,
"tax_id": "TFN-3"
}
]
},
"request": {
"source_port": 61706,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P44",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P44",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P44",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "294"
},
{
"content-type": "text/plain"
},
{
"date": "Thu, 22 Oct 2026 09:43:51 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": [
{
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"id": "a2",
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
},
{
"id": "a4",
"name": "Account a4"
}
]
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P44"
}
}Response
{
"results": [
{
"type": "P44",
"id": "a1"
},
{
"type": "P44",
"id": "a2"
},
{
"type": "P44",
"id": "a4"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P44"
}
}Response
{
"results": [
{
"type": "P44",
"id": "a1"
},
{
"type": "P44",
"id": "a2"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P44 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P44
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: 3161d719b114a6673fa4786da9c27217
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{
"data": [
{
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
},
{
"id": "a2",
"name": "Account a2",
"balance": 101,
"tax_id": "TFN-1"
},
{
"id": "a3",
"name": "Account a3",
"balance": 102,
"tax_id": "TFN-2"
},
{
"id": "a4",
"name": "Account a4",
"balance": 103,
"tax_id": "TFN-3"
}
]
}P45NDJSON stream (application/x-ndjson) on a filtered operationParsing and content typespass · 5024 PDP · 0 PIP · 1 upstream
Withheld (502): the body is not one JSON document.
OpenAPI 3.1
Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P45: NDJSON stream (application/x-ndjson) on a filtered operation"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P45:
get:
operationId: caseP45
summary: NDJSON stream (application/x-ndjson) on a filtered operation
security:
- bearerAuth: []
parameters: []
responses:
"200":
description: "The resource's answer"
content:
application/x-ndjson:
schema:
type: string
example: "{\"id\": \"a1\", \"name\": \"Account a1\", \"balance\": 100, \"tax_id\": \"TFN-0\"}\n{\"id\": \"a3\", \"name\": \"Account a3\", \"balance\": 101, \"tax_id\": \"TFN-1\"}\n"
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data",
"item_id": "id",
"action": "read",
"resource_type": "P45"
},
"mask": {
"fields": [
"balance",
"tax_id"
],
"action": "view",
"resource_type": "P45"
}
},
"method": "GET",
"path": "/api/P45"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P45' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 502
Content-Type: application/json
Connection: close
Content-Length: 134
Date: Thu, 22 Oct 2026 09:43:52 GMT
Server: kong/3.9.4
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
X-Kong-Upstream-Latency: 5
X-Kong-Proxy-Latency: 134
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: 2ffb88327da6c639dac92f402c52094c{
"status": 502,
"error": "response_withheld",
"error_description": "The response is not the shape the resource's metadata describes."
}What the metadata means
Refused: the body is not one JSON document.
PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61720,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P45",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61720,
"method": "GET",
"url": "https://gateway.example/api/P45",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61720,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P45",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61720,
"method": "GET",
"url": "https://gateway.example/api/P45",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61720,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P45",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61720,
"method": "GET",
"url": "https://gateway.example/api/P45",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 1704
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "140"
},
{
"content-type": "application/x-ndjson"
},
{
"date": "Thu, 22 Oct 2026 09:43:52 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": "{\"id\": \"a1\", \"name\": \"Account a1\", \"balance\": 100, \"tax_id\": \"TFN-0\"}\n{\"id\": \"a3\", \"name\": \"Account a3\", \"balance\": 101, \"tax_id\": \"TFN-1\"}\n",
"request": {
"source_port": 61720,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P45",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P45",
"response_status": "OK"
}Response
{
"response_code": "502",
"response_status": "Bad Gateway",
"url": "https://gateway.example/api/P45",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"Content-Type": "application/json"
}
],
"body": {
"status": 502,
"error": "response_withheld",
"error_description": "The response is not the shape the resource's metadata describes."
},
"request": {
"source_ip": "192.0.2.1",
"source_port": 61720,
"method": "GET",
"url": "https://gateway.example/api/P45",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}
}Entitlements PIP · AuthZEN (0)
No entitlements call: the request was decided before the PIP was asked.
Upstream API (1)
Kong → API GET /api/P45 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P45
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: 2ffb88327da6c639dac92f402c52094c
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{"id": "a1", "name": "Account a1", "balance": 100, "tax_id": "TFN-0"}
{"id": "a3", "name": "Account a3", "balance": 101, "tax_id": "TFN-1"}
P47NDJSON with the unreadable line firstParsing and content typespass · 5024 PDP · 0 PIP · 1 upstream
Withheld (502): the body is not one JSON document.
OpenAPI 3.1
Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P47: NDJSON with the unreadable line first"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P47:
get:
operationId: caseP47
summary: NDJSON with the unreadable line first
security:
- bearerAuth: []
parameters: []
responses:
"200":
description: "The resource's answer"
content:
application/x-ndjson:
schema:
type: string
example: "{\"id\": \"a3\", \"name\": \"Account a3\", \"balance\": 100, \"tax_id\": \"TFN-0\"}\n{\"id\": \"a1\", \"name\": \"Account a1\", \"balance\": 101, \"tax_id\": \"TFN-1\"}\n"
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data",
"item_id": "id",
"action": "read",
"resource_type": "P47"
},
"mask": {
"fields": [
"balance",
"tax_id"
],
"action": "view",
"resource_type": "P47"
}
},
"method": "GET",
"path": "/api/P47"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P47' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 502
Content-Type: application/json
Connection: close
Content-Length: 134
Date: Thu, 22 Oct 2026 09:43:54 GMT
Server: kong/3.9.4
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 119
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: cd32b74a2ba84165239c271ae00d0508{
"status": 502,
"error": "response_withheld",
"error_description": "The response is not the shape the resource's metadata describes."
}What the metadata means
Refused: the body is not one JSON document.
PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61730,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P47",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61730,
"method": "GET",
"url": "https://gateway.example/api/P47",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61730,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P47",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61730,
"method": "GET",
"url": "https://gateway.example/api/P47",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 61730,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P47",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 61730,
"method": "GET",
"url": "https://gateway.example/api/P47",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 1704
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "140"
},
{
"content-type": "application/x-ndjson"
},
{
"date": "Thu, 22 Oct 2026 09:43:54 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": "{\"id\": \"a3\", \"name\": \"Account a3\", \"balance\": 100, \"tax_id\": \"TFN-0\"}\n{\"id\": \"a1\", \"name\": \"Account a1\", \"balance\": 101, \"tax_id\": \"TFN-1\"}\n",
"request": {
"source_port": 61730,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P47",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P47",
"response_status": "OK"
}Response
{
"response_code": "502",
"response_status": "Bad Gateway",
"url": "https://gateway.example/api/P47",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"Content-Type": "application/json"
}
],
"body": {
"status": 502,
"error": "response_withheld",
"error_description": "The response is not the shape the resource's metadata describes."
},
"request": {
"source_ip": "192.0.2.1",
"source_port": 61730,
"method": "GET",
"url": "https://gateway.example/api/P47",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}
}Entitlements PIP · AuthZEN (0)
No entitlements call: the request was decided before the PIP was asked.
Upstream API (1)
Kong → API GET /api/P47 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P47
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: cd32b74a2ba84165239c271ae00d0508
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{"id": "a3", "name": "Account a3", "balance": 100, "tax_id": "TFN-0"}
{"id": "a1", "name": "Account a1", "balance": 101, "tax_id": "TFN-1"}
P48an anti-XSSI prefix before the JSON: )]}',Parsing and content typespass · 4154 PDP · 0 PIP · 1 upstream
Refused (415): the anti-XSSI prefix doesn't parse as JSON.
OpenAPI 3.1
Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P48: an anti-XSSI prefix before the JSON: )]}',"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P48:
get:
operationId: caseP48
summary: "an anti-XSSI prefix before the JSON: )]}',"
security:
- bearerAuth: []
parameters: []
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: string
example: ")]}',\n{\"data\": [{\"id\": \"a1\", \"name\": \"Account a1\", \"balance\": 100, \"tax_id\": \"TFN-0\"}, {\"id\": \"a3\", \"name\": \"Account a3\", \"balance\": 101, \"tax_id\": \"TFN-1\"}]}"
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 3 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data",
"item_id": "id",
"action": "read",
"resource_type": "P48"
},
"mask": {
"fields": [
"balance",
"tax_id"
],
"action": "view",
"resource_type": "P48"
}
},
"method": "GET",
"path": "/api/P48"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P48' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 415
Content-Type: application/json
Connection: close
Content-Length: 100
Date: Thu, 22 Oct 2026 09:43:56 GMT
Server: kong/3.9.4
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
X-Kong-Upstream-Latency: 3
X-Kong-Proxy-Latency: 90
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: f8ab794c241c054f70d3703bdaf11e56{
"status": 415,
"error": "The response entity could not be parsed as JSON",
"error_description": ""
}What the metadata means
Refused, or filtered: never a3.
PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 59248,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P48",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 59248,
"method": "GET",
"url": "https://gateway.example/api/P48",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 59248,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P48",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 59248,
"method": "GET",
"url": "https://gateway.example/api/P48",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 59248,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P48",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 59248,
"method": "GET",
"url": "https://gateway.example/api/P48",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 1719
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "158"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:56 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": ")]}',\n{\"data\": [{\"id\": \"a1\", \"name\": \"Account a1\", \"balance\": 100, \"tax_id\": \"TFN-0\"}, {\"id\": \"a3\", \"name\": \"Account a3\", \"balance\": 101, \"tax_id\": \"TFN-1\"}]}",
"request": {
"source_port": 59248,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P48",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P48",
"response_status": "OK"
}Response
{
"response_code": "415",
"response_status": "Unsupported Media Type",
"url": "https://gateway.example/api/P48",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"Content-Type": "application/json"
}
],
"body": {
"status": 415,
"error": "The response entity could not be parsed as JSON",
"error_description": ""
},
"request": {
"source_ip": "192.0.2.1",
"source_port": 59248,
"method": "GET",
"url": "https://gateway.example/api/P48",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}
}Entitlements PIP · AuthZEN (0)
No entitlements call: the request was decided before the PIP was asked.
Upstream API (1)
Kong → API GET /api/P48 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P48
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: f8ab794c241c054f70d3703bdaf11e56
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
)]}',
{"data": [{"id": "a1", "name": "Account a1", "balance": 100, "tax_id": "TFN-0"}, {"id": "a3", "name": "Account a3", "balance": 101, "tax_id": "TFN-1"}]}P49two JSON documents back to back in one application/json bodyParsing and content typeslimit · 2004 PDP · 3 PIP · 1 upstream
Only the first of the two JSON documents is returned; the second is dropped.
OpenAPI 3.1
Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P49: two JSON documents back to back in one application/json body"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P49:
get:
operationId: caseP49
summary: two JSON documents back to back in one application/json body
security:
- bearerAuth: []
parameters: []
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: string
example: "{\"data\": [{\"id\": \"a1\", \"name\": \"Account a1\", \"balance\": 100, \"tax_id\": \"TFN-0\"}]}{\"data\": [{\"id\": \"a3\", \"name\": \"Account a3\", \"balance\": 100, \"tax_id\": \"TFN-0\"}]}"
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data",
"item_id": "id",
"action": "read",
"resource_type": "P49"
},
"mask": {
"fields": [
"balance",
"tax_id"
],
"action": "view",
"resource_type": "P49"
}
},
"method": "GET",
"path": "/api/P49"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1",
"a2",
"a4"
],
"view": [
"a1",
"a2"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P49' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 73
date: Thu, 22 Oct 2026 09:43:57 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 5
X-Kong-Proxy-Latency: 125
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: e6542d340feef614def61149c438807b{
"data": [
{
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
}
]
}What the metadata means
Refused: the body is not one JSON document.
PDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 59262,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P49",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 59262,
"method": "GET",
"url": "https://gateway.example/api/P49",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 59262,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P49",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 59262,
"method": "GET",
"url": "https://gateway.example/api/P49",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 59262,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P49",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 59262,
"method": "GET",
"url": "https://gateway.example/api/P49",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 1724
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"headers": [
{
"connection": "close"
},
{
"content-length": "162"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:57 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"response_code": "200",
"body": "{\"data\": [{\"id\": \"a1\", \"name\": \"Account a1\", \"balance\": 100, \"tax_id\": \"TFN-0\"}]}{\"data\": [{\"id\": \"a3\", \"name\": \"Account a3\", \"balance\": 100, \"tax_id\": \"TFN-0\"}]}",
"request": {
"source_port": 59262,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P49",
"source_ip": "192.0.2.1"
},
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P49",
"response_status": "OK"
}Response
{
"response_code": "200",
"response_status": "OK",
"url": "https://gateway.example/api/P49",
"method": "GET",
"http_version": "1.1",
"headers": [
{
"connection": "close"
},
{
"content-length": "162"
},
{
"content-type": "application/json"
},
{
"date": "Thu, 22 Oct 2026 09:43:57 GMT"
},
{
"server": "BaseHTTP/0.6 Python/3.12.15"
},
{
"x-pdp-decision": "PERMIT"
},
{
"x-pdp-layers": "https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"
},
{
"x-pdp-pep": "Kong (sideband)"
},
{
"x-pdp-source": "rfc9728"
}
],
"body": {
"data": [
{
"id": "a1",
"name": "Account a1",
"balance": 100,
"tax_id": "TFN-0"
}
]
}
}Entitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P49"
}
}Response
{
"results": [
{
"type": "P49",
"id": "a1"
},
{
"type": "P49",
"id": "a2"
},
{
"type": "P49",
"id": "a4"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P49"
}
}Response
{
"results": [
{
"type": "P49",
"id": "a1"
},
{
"type": "P49",
"id": "a2"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P49 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P49
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: e6542d340feef614def61149c438807b
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{"data": [{"id": "a1", "name": "Account a1", "balance": 100, "tax_id": "TFN-0"}]}{"data": [{"id": "a3", "name": "Account a3", "balance": 100, "tax_id": "TFN-0"}]}Size · 1
P46a realistic page: 150 statements x 25 transactions (~600 KB), mask nested amountsSizepass · 2004 PDP · 3 PIP · 1 upstream
Filtered and masked as meant; meta is kept.
OpenAPI 3.1
Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P46: a realistic page: 150 statements x 25 transactions (~600 KB), mask nested amounts"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P46:
get:
operationId: caseP46
summary: "a realistic page: 150 statements x 25 transactions (~600 KB), mask nested amounts"
security:
- bearerAuth: []
parameters: []
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
data:
type: array
items:
type: object
properties:
id:
type: string
balance:
type: integer
tax_id:
type: string
name:
type: string
transactions:
type: array
items:
type: object
properties:
id:
type: string
postedAt:
type: string
format: date-time
description:
type: string
amount:
type: number
category:
type: string
meta:
type: object
properties:
page:
type: integer
pageSize:
type: integer
example: "(see the upstream payload)"
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 4 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"response": {
"filter": {
"items": "$.data",
"item_id": "id",
"action": "read",
"resource_type": "P46"
},
"mask": {
"fields": [
"balance",
"tax_id",
"transactions[*].amount"
],
"action": "view",
"resource_type": "P46"
},
"keep": [
"meta"
]
},
"method": "GET",
"path": "/api/P46"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"s0",
"s2",
"s4",
"s6",
"s8",
"s10",
"s12",
"s14",
"s16",
"s18",
"s20",
"s22",
"s24",
"s26",
"s28",
"s30",
"s32",
"s34",
"s36",
"s38",
"s40",
"s42",
"s44",
"s46",
"s48",
"s50",
"s52",
"s54",
"s56",
"s58",
"s60",
"s62",
"s64",
"s66",
"s68",
"s70",
"s72",
"s74",
"s76",
"s78",
"s80",
"s82",
"s84",
"s86",
"s88",
"s90",
"s92",
"s94",
"s96",
"s98",
"s100",
"s102",
"s104",
"s106",
"s108",
"s110",
"s112",
"s114",
"s116",
"s118",
"s120",
"s122",
"s124",
"s126",
"s128",
"s130",
"s132",
"s134",
"s136",
"s138",
"s140",
"s142",
"s144",
"s146",
"s148"
],
"view": [
"s0",
"s4",
"s8",
"s12",
"s16",
"s20",
"s24",
"s28",
"s32",
"s36",
"s40",
"s44",
"s48",
"s52",
"s56",
"s60",
"s64",
"s68",
"s72",
"s76",
"s80",
"s84",
"s88",
"s92",
"s96",
"s100",
"s104",
"s108",
"s112",
"s116",
"s120",
"s124",
"s128",
"s132",
"s136",
"s140",
"s144",
"s148"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P46' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 200
Content-Type: application/json
Connection: close
X-PDP-Layers: https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Source: rfc9728
X-PDP-Decision: PERMIT
Content-Length: 269634
date: Thu, 22 Oct 2026 09:43:59 GMT
server: BaseHTTP/0.6 Python/3.12.15
connection: close
X-Kong-Upstream-Latency: 10
X-Kong-Proxy-Latency: 340
Via: 1.1 kong/3.9.4
X-Kong-Request-Id: beaa9906d5af387543e4e34492d4c238{"data":[{"id":"s0","balance":100,"tax_id":"TFN-0","name":"Account s0","transactions":[{"id":"s0-t0","postedAt":"2026-09-01T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 0 SYDNEY NSW","amount":-12.5,"category":"groceries"},{"id":"s0-t1","postedAt":"2026-09-02T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 1 SYDNEY NSW","amount":-13.5,"category":"groceries"},{"id":"s0-t2","postedAt":"2026-09-03T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 2 SYDNEY NSW","amount":-14.5,"category":"groceries"},{"id":"s0-t3","postedAt":"2026-09-04T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 3 SYDNEY NSW","amount":-15.5,"category":"groceries"},{"id":"s0-t4","postedAt":"2026-09-05T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 4 SYDNEY NSW","amount":-16.5,"category":"groceries"},{"id":"s0-t5","postedAt":"2026-09-06T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 5 SYDNEY NSW","amount":-17.5,"category":"groceries"},{"id":"s0-t6","postedAt":"2026-09-07T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 6 SYDNEY NSW","amount":-18.5,"category":"groceries"},{"id":"s0-t7","postedAt":"2026-09-08T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 7 SYDNEY NSW","amount":-19.5,"category":"groceries"},{"id":"s0-t8","postedAt":"2026-09-09T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 8 SYDNEY NSW","amount":-20.5,"category":"groceries"},{"id":"s0-t9","postedAt":"2026-09-10T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 9 SYDNEY NSW","amount":-21.5,"category":"groceries"},{"id":"s0-t10","postedAt":"2026-09-11T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 10 SYDNEY NSW","amount":-22.5,"category":"groceries"},{"id":"s0-t11","postedAt":"2026-09-12T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 11 SYDNEY NSW","amount":-23.5,"category":"groceries"},{"id":"s0-t12","postedAt":"2026-09-13T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 12 SYDNEY NSW","amount":-24.5,"category":"groceries"},{"id":"s0-t13","postedAt":"2026-09-14T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 13 SYDNEY NSW","amount":-25.5,"category":"groceries"},{"id":"s0-t14","postedAt":"2026-09-15T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 14 SYDNEY NSW","amount":-26.5,"category":"groceries"},{"id":"s0-t15","postedAt":"2026-09-16T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 15 SYDNEY NSW","amount":-27.5,"category":"groceries"},{"id":"s0-t16","postedAt":"2026-09-17T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 16 SYDNEY NSW","amount":-28.5,"category":"groceries"},{"id":"s0-t17","postedAt":"2026-09-18T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 17 SYDNEY NSW","amount":-29.5,"category":"groceries"},{"id":"s0-t18","postedAt":"2026-09-19T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 18 SYDNEY NSW","amount":-30.5,"category":"groceries"},{"id":"s0-t19","postedAt":"2026-09-20T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 19 SYDNEY NSW","amount":-31.5,"category":"groceries"},{"id":"s0-t20","postedAt":"2026-09-21T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 20 SYDNEY NSW","amount":-32.5,"category":"groceries"},{"id":"s0-t21","postedAt":"2026-09-22T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 21 SYDNEY NSW","amount":-33.5,"category":"groceries"},{"id":"s0-t22","postedAt":"2026-09-23T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 22 SYDNEY NSW","amount":-34.5,"category":"groceries"},{"id":"s0-t23","postedAt":"2026-09-24T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 23 SYDNEY NSW","amount":-35.5,"category":"groceries"},{"id":"s0-t24","postedAt":"2026-09-25T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 24 SYDNEY NSW","amount":-36.5,"category":"groceries"}]},{"id":"s2","name":"Account s2","transactions":[{"id":"s2-t0","postedAt":"2026-09-01T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 0 SYDNEY NSW","category":"groceries"},{"id":"s2-t1","postedAt":"2026-09-02T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 1 SYDNEY NSW","category":"groceries"},{"id":"s2-t2","postedAt":"2026-09-03T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 2 SYDNEY NSW","category":"groceries"},{"id":"s2-t3","postedAt":"2026-09-04T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 3 SYDNEY NSW","category":"groceries"},{"id":"s2-t4","postedAt":"2026-09-05T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 4 SYDNEY NSW","category":"groceries"},{"id":"s2-t5","postedAt":"2026-09-06T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 5 SYDNEY NSW","category":"groceries"},{"id":"s2-t6","postedAt":"2026-09-07T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 6 SYDNEY NSW","category":"groceries"},{"id":"s2-t7","postedAt":"2026-09-08T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 7 SYDNEY NSW","category":"groceries"},{"id":"s2-t8","postedAt":"2026-09-09T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 8 SYDNEY NSW","category":"groceries"},{"id":"s2-t9","postedAt":"2026-09-10T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 9 SYDNEY NSW","category":"groceries"},{"id":"s2-t10","postedAt":"2026-09-11T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 10 SYDNEY NSW","category":"groceries"},{"id":"s2-t11","postedAt":"2026-09-12T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 11 SYDNEY NSW","category":"groceries"},{"id":"s2-t12","postedAt":"2026-09-13T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 12 SYDNEY NSW","category":"groceries"},{"id":"s2-t13","postedAt":"2026-09-14T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 13 SYDNEY NSW","category":"groceries"},{"id":"s2-t14","postedAt":"2026-09-15T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 14 SYDNEY NSW","category":"groceries"},{"id":"s2-t15","postedAt":"2026-09-16T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 15 SYDNEY NSW","category":"groceries"},{"id":"s2-t16","postedAt":"2026-09-17T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 16 SYDNEY NSW","category":"groceries"},{"id":"s2-t17","postedAt":"2026-09-18T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 17 SYDNEY NSW","category":"groceries"},{"id":"s2-t18","postedAt":"2026-09-19T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 18 SYDNEY NSW","category":"groceries"},{"id":"s2-t19","postedAt":"2026-09-20T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 19 SYDNEY NSW","category":"groceries"},{"id":"s2-t20","postedAt":"2026-09-21T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 20 SYDNEY NSW","category":"groceries"},{"id":"s2-t21","postedAt":"2026-09-22T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 21 SYDNEY NSW","category":"groceries"},{"id":"s2-t22","postedAt":"2026-09-23T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 22 SYDNEY NSW","category":"groceries"},{"id":"s2-t23","postedAt":"2026-09-24T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 23 SYDNEY NSW","category":"groceries"},{"id":"s2-t24","postedAt":"2026-09-25T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 24 SYDNEY NSW","category":"groceries"}]},{"id":"s4","balance":104,"tax_id":"TFN-4","name":"Account s4","transactions":[{"id":"s4-t0","postedAt":"2026-09-01T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 0 SYDNEY NSW","amount":-12.5,"category":"groceries"},{"id":"s4-t1","postedAt":"2026-09-02T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 1 SYDNEY NSW","amount":-13.5,"category":"groceries"},{"id":"s4-t2","postedAt":"2026-09-03T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 2 SYDNEY NSW","amount":-14.5,"category":"groceries"},{"id":"s4-t3","postedAt":"2026-09-04T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 3 SYDNEY NSW","amount":-15.5,"category":"groceries"},{"id":"s4-t4","postedAt":"2026-09-05T09:30:00+10:00","description":"EFTPOS PURCHASE MERCHANT 4 SYDNEY NSW","amount":-16.5,"category":"groceries"},{"id":"s4-t5","postedAt":"2026-09-06T09:30:00+10:00","description":"E
… 16,000 more charactersWhat the metadata means
{
"data": [
{
"id": "s0",
"balance": 100,
"tax_id": "TFN-0",
"name": "Account s0",
"transactions": [
{
"id": "s0-t0",
"postedAt": "2026-09-01T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 0 SYDNEY NSW",
"amount": -12.5,
"category": "groceries"
},
{
"id": "s0-t1",
"postedAt": "2026-09-02T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 1 SYDNEY NSW",
"amount": -13.5,
"category": "groceries"
},
{
"id": "s0-t2",
"postedAt": "2026-09-03T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 2 SYDNEY NSW",
"amount": -14.5,
"category": "groceries"
},
{
"id": "s0-t3",
"postedAt": "2026-09-04T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 3 SYDNEY NSW",
"amount": -15.5,
"category": "groceries"
},
{
"id": "s0-t4",
"postedAt": "2026-09-05T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 4 SYDNEY NSW",
"amount": -16.5,
"category": "groceries"
},
{
"id": "s0-t5",
"postedAt": "2026-09-06T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 5 SYDNEY NSW",
"amount": -17.5,
"category": "groceries"
},
{
"id": "s0-t6",
"postedAt": "2026-09-07T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 6 SYDNEY NSW",
"amount": -18.5,
"category": "groceries"
},
{
"id": "s0-t7",
"postedAt": "2026-09-08T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 7 SYDNEY NSW",
"amount": -19.5,
"category": "groceries"
},
{
"id": "s0-t8",
"postedAt": "2026-09-09T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 8 SYDNEY NSW",
"amount": -20.5,
"category": "groceries"
},
{
"id": "s0-t9",
"postedAt": "2026-09-10T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 9 SYDNEY NSW",
"amount": -21.5,
"category": "groceries"
},
{
"id": "s0-t10",
"postedAt": "2026-09-11T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 10 SYDNEY NSW",
"amount": -22.5,
"category": "groceries"
},
{
"id": "s0-t11",
"postedAt": "2026-09-12T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 11 SYDNEY NSW",
"amount": -23.5,
"category": "groceries"
},
{
"id": "s0-t12",
"postedAt": "2026-09-13T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 12 SYDNEY NSW",
"amount": -24.5,
"category": "groceries"
},
{
"id": "s0-t13",
"postedAt": "2026-09-14T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 13 SYDNEY NSW",
"amount": -25.5,
"category": "groceries"
},
{
"id": "s0-t14",
"postedAt": "2026-09-15T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 14 SYDNEY NSW",
"amount": -26.5,
"category": "groceries"
},
{
"id": "s0-t15",
"postedAt": "2026-09-16T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 15 SYDNEY NSW",
"amount": -27.5,
"category": "groceries"
},
{
"id": "s0-t16",
"postedAt": "2026-09-17T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 16 SYDNEY NSW",
"amount": -28.5,
"category": "groceries"
},
{
"id": "s0-t17",
"postedAt": "2026-09-18T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 17 SYDNEY NSW",
"amount": -29.5,
"category": "groceries"
},
{
"id": "s0-t18",
"postedAt": "2026-09-19T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 18 SYDNEY NSW",
"amount": -30.5,
"category": "groceries"
},
{
"id": "s0-t19",
"postedAt": "2026-09-20T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 19 SYDNEY NSW",
"amount": -31.5,
"category": "groceries"
},
{
"id": "s0-t20",
"postedAt": "2026-09-21T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 20 SYDNEY NSW",
"amount": -32.5,
"category": "groceries"
},
{
"id": "s0-t21",
"postedAt": "2026-09-22T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 21 SYDNEY NSW",
"amount": -33.5,
"category": "groceries"
},
{
"id": "s0-t22",
"postedAt": "2026-09-23T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 22 SYDNEY NSW",
"amount": -34.5,
"category": "groceries"
},
{
"id": "s0-t23",
"postedAt": "2026-09-24T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 23 SYDNEY NSW",
"amount": -35.5,
"category": "groceries"
},
{
"id": "s0-t24",
"postedAt": "2026-09-25T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 24 SYDNEY NSW",
"amount": -36.5,
"category": "groceries"
}
]
},
{
"id": "s2",
"name": "Account s2",
"transactions": [
{
"id": "s2-t0",
"postedAt": "2026-09-01T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 0 SYDNEY NSW",
"category": "groceries"
},
{
"id": "s2-t1",
"postedAt": "2026-09-02T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 1 SYDNEY NSW",
"category": "groceries"
},
{
"id": "s2-t2",
"postedAt": "2026-09-03T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 2 SYDNEY NSW",
"category": "groceries"
},
{
"id": "s2-t3",
"postedAt": "2026-09-04T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 3 SYDNEY NSW",
"category": "groceries"
},
{
"id": "s2-t4",
"postedAt": "2026-09-05T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 4 SYDNEY NSW",
"category": "groceries"
},
{
"id": "s2-t5",
"postedAt": "2026-09-06T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 5 SYDNEY NSW",
"category": "groceries"
},
{
"id": "s2-t6",
"postedAt": "2026-09-07T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 6 SYDNEY NSW",
"category": "groceries"
},
{
"id": "s2-t7",
"postedAt": "2026-09-08T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 7 SYDNEY NSW",
"category": "groceries"
},
{
"id": "s2-t8",
"postedAt": "2026-09-09T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 8 SYDNEY NSW",
"category": "groceries"
},
{
"id": "s2-t9",
"postedAt": "2026-09-10T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 9 SYDNEY NSW",
"category": "groceries"
},
{
"id": "s2-t10",
"postedAt": "2026-09-11T09:30:00+10:00",
"description": "EFTPOS PURCHASE MERCHANT 10 SYDNEY NSW",
"category
… 2,899 more charactersPDP · Sideband API (4)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1042
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 59270,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P46",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 59270,
"method": "GET",
"url": "https://gateway.example/api/P46",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 59270,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P46",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 59270,
"method": "GET",
"url": "https://gateway.example/api/P46",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1032
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 59270,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P46",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 59270,
"method": "GET",
"url": "https://gateway.example/api/P46",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/response 200
Request
Content-Length: 679659
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{"headers":[{"connection":"close"},{"content-length":"608218"},{"content-type":"application/json"},{"date":"Thu, 22 Oct 2026 09:43:59 GMT"},{"server":"BaseHTTP/0.6 Python/3.12.15"},{"x-pdp-decision":"PERMIT"},{"x-pdp-layers":"https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"},{"x-pdp-pep":"Kong (sideband)"},{"x-pdp-source":"rfc9728"}],"response_code":"200","body":"{\"data\": [{\"id\": \"s0\", \"balance\": 100, \"tax_id\": \"TFN-0\", \"name\": \"Account s0\", \"transactions\": [{\"id\": \"s0-t0\", \"postedAt\": \"2026-09-01T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 0 SYDNEY NSW\", \"amount\": -12.5, \"category\": \"groceries\"}, {\"id\": \"s0-t1\", \"postedAt\": \"2026-09-02T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 1 SYDNEY NSW\", \"amount\": -13.5, \"category\": \"groceries\"}, {\"id\": \"s0-t2\", \"postedAt\": \"2026-09-03T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 2 SYDNEY NSW\", \"amount\": -14.5, \"category\": \"groceries\"}, {\"id\": \"s0-t3\", \"postedAt\": \"2026-09-04T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 3 SYDNEY NSW\", \"amount\": -15.5, \"category\": \"groceries\"}, {\"id\": \"s0-t4\", \"postedAt\": \"2026-09-05T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 4 SYDNEY NSW\", \"amount\": -16.5, \"category\": \"groceries\"}, {\"id\": \"s0-t5\", \"postedAt\": \"2026-09-06T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 5 SYDNEY NSW\", \"amount\": -17.5, \"category\": \"groceries\"}, {\"id\": \"s0-t6\", \"postedAt\": \"2026-09-07T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 6 SYDNEY NSW\", \"amount\": -18.5, \"category\": \"groceries\"}, {\"id\": \"s0-t7\", \"postedAt\": \"2026-09-08T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 7 SYDNEY NSW\", \"amount\": -19.5, \"category\": \"groceries\"}, {\"id\": \"s0-t8\", \"postedAt\": \"2026-09-09T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 8 SYDNEY NSW\", \"amount\": -20.5, \"category\": \"groceries\"}, {\"id\": \"s0-t9\", \"postedAt\": \"2026-09-10T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 9 SYDNEY NSW\", \"amount\": -21.5, \"category\": \"groceries\"}, {\"id\": \"s0-t10\", \"postedAt\": \"2026-09-11T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 10 SYDNEY NSW\", \"amount\": -22.5, \"category\": \"groceries\"}, {\"id\": \"s0-t11\", \"postedAt\": \"2026-09-12T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 11 SYDNEY NSW\", \"amount\": -23.5, \"category\": \"groceries\"}, {\"id\": \"s0-t12\", \"postedAt\": \"2026-09-13T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 12 SYDNEY NSW\", \"amount\": -24.5, \"category\": \"groceries\"}, {\"id\": \"s0-t13\", \"postedAt\": \"2026-09-14T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 13 SYDNEY NSW\", \"amount\": -25.5, \"category\": \"groceries\"}, {\"id\": \"s0-t14\", \"postedAt\": \"2026-09-15T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 14 SYDNEY NSW\", \"amount\": -26.5, \"category\": \"groceries\"}, {\"id\": \"s0-t15\", \"postedAt\": \"2026-09-16T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 15 SYDNEY NSW\", \"amount\": -27.5, \"category\": \"groceries\"}, {\"id\": \"s0-t16\", \"postedAt\": \"2026-09-17T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 16 SYDNEY NSW\", \"amount\": -28.5, \"category\": \"groceries\"}, {\"id\": \"s0-t17\", \"postedAt\": \"2026-09-18T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 17 SYDNEY NSW\", \"amount\": -29.5, \"category\": \"groceries\"}, {\"id\": \"s0-t18\", \"postedAt\": \"2026-09-19T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 18 SYDNEY NSW\", \"amount\": -30.5, \"category\": \"groceries\"}, {\"id\": \"s0-t19\", \"postedAt\": \"2026-09-20T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 19 SYDNEY NSW\", \"amount\": -31.5, \"category\": \"groceries\"}, {\"id\": \"s0-t20\", \"postedAt\": \"2026-09-21T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 20 SYDNEY NSW\", \"amount\": -32.5, \"category\": \"groceries\"}, {\"id\": \"s0-t21\", \"postedAt\": \"2026-09-22T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 21 SYDNEY NSW\", \"amount\": -33.5, \"category\": \"groceries\"}, {\"id\": \"s0-t22\", \"postedAt\": \"2026-09-23T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 22 SYDNEY NSW\", \"amount\": -34.5, \"category\": \"groceries\"}, {\"id\": \"s0-t23\", \"postedAt\": \"2026-09-24T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 23 SYDNEY NSW\", \"amount\": -35.5, \"category\": \"groceries\"}, {\"id\": \"s0-t24\", \"postedAt\": \"2026-09-25T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 24 SYDNEY NSW\", \"amount\": -36.5, \"category\": \"groceries\"}]}, {\"id\": \"s1\", \"balance\": 101, \"tax_id\": \"TFN-1\", \"name\": \"Account s1\", \"transactions\": [{\"id\": \"s1-t0\", \"postedAt\": \"2026-09-01T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 0 SYDNEY NSW\", \"amount\": -12.5, \"category\": \"groceries\"}, {\"id\": \"s1-t1\", \"postedAt\": \"2026-09-02T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 1 SYDNEY NSW\", \"amount\": -13.5, \"category\": \"groceries\"}, {\"id\": \"s1-t2\", \"postedAt\": \"2026-09-03T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 2 SYDNEY NSW\", \"amount\": -14.5, \"category\": \"groceries\"}, {\"id\": \"s1-t3\", \"postedAt\": \"2026-09-04T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 3 SYDNEY NSW\", \"amount\": -15.5, \"category\": \"groceries\"}, {\"id\": \"s1-t4\", \"postedAt\": \"2026-09-05T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 4 SYDNEY NSW\", \"amount\": -16.5, \"category\": \"groceries\"}, {\"id\": \"s1-t5\", \"postedAt\": \"2026-09-06T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 5 SYDNEY NSW\", \"amount\": -17.5, \"category\": \"groceries\"}, {\"id\": \"s1-t6\", \"postedAt\": \"2026-09-07T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 6 SYDNEY NSW\", \"amount\": -18.5, \"category\": \"groceries\"}, {\"id\": \"s1-t7\", \"postedAt\": \"2026-09-08T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 7 SYDNEY NSW\", \"amount\": -19.5, \"category\": \"groceries\"}, {\"id\": \"s1-t8\", \"postedAt\": \"2026-09-09T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 8 SYDNEY NSW\", \"amount\": -20.5, \"category\": \"groceries\"}, {\"id\": \"s1-t9\", \"postedAt\": \"2026-09-10T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 9 SYDNEY NSW\", \"amount\": -21.5, \"category\": \"groceries\"}, {\"id\": \"s1-t10\", \"postedAt\": \"2026-09-11T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 10 SYDNEY NSW\", \"amount\": -22.5, \"category\": \"groceries\"}, {\"id\": \"s1-t11\", \"postedAt\": \"2026-09-12T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 11 SYDNEY NSW\", \"amount\": -23.5, \"category\": \"groceries\"}, {\"id\": \"s1-t12\", \"postedAt\": \"2026-09-13T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 12 SYDNEY NSW\", \"amount\": -24.5, \"category\": \"groceries\"}, {\"id\": \"s1-t13\", \"postedAt\": \"2026-09-14T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 13 SYDNEY NSW\", \"amount\": -25.5, \"category\": \"groceries\"}, {\"id\": \"s1-t14\", \"postedAt\": \"2026-09-15T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 14 SYDNEY NSW\", \"amount\": -26.5, \"category\": \"groceries\"}, {\"id\": \"s1-t15\", \"postedAt\": \"2026-09-16T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 15 SYDNEY NSW\", \"amount\": -27.5, \"category\": \"groceries\"}, {\"id\": \"s1-t16\", \"postedAt\": \"2026-09-17T09:30:00+10:00\", \"description\": \"EFTPOS PURCHASE MERCHANT 16 SYDNEY NSW\", \"amount\": -28.5, \"category\": \"groceries\"}, {\"id\": \"s1-t17\", \"poste
… 16,037 more charactersResponse
{"response_code":"200","response_status":"OK","url":"https://gateway.example/api/P46","method":"GET","http_version":"1.1","headers":[{"connection":"close"},{"content-length":"608218"},{"content-type":"application/json"},{"date":"Thu, 22 Oct 2026 09:43:59 GMT"},{"server":"BaseHTTP/0.6 Python/3.12.15"},{"x-pdp-decision":"PERMIT"},{"x-pdp-layers":"https://pdp-token.example, https://pdp-risk.example, https://pdp-response.example"},{"x-pdp-pep":"Kong (sideband)"},{"x-pdp-source":"rfc9728"}],"body":"{\"data\":[{\"id\":\"s0\",\"balance\":100,\"tax_id\":\"TFN-0\",\"name\":\"Account s0\",\"transactions\":[{\"id\":\"s0-t0\",\"postedAt\":\"2026-09-01T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 0 SYDNEY NSW\",\"amount\":-12.5,\"category\":\"groceries\"},{\"id\":\"s0-t1\",\"postedAt\":\"2026-09-02T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 1 SYDNEY NSW\",\"amount\":-13.5,\"category\":\"groceries\"},{\"id\":\"s0-t2\",\"postedAt\":\"2026-09-03T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 2 SYDNEY NSW\",\"amount\":-14.5,\"category\":\"groceries\"},{\"id\":\"s0-t3\",\"postedAt\":\"2026-09-04T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 3 SYDNEY NSW\",\"amount\":-15.5,\"category\":\"groceries\"},{\"id\":\"s0-t4\",\"postedAt\":\"2026-09-05T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 4 SYDNEY NSW\",\"amount\":-16.5,\"category\":\"groceries\"},{\"id\":\"s0-t5\",\"postedAt\":\"2026-09-06T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 5 SYDNEY NSW\",\"amount\":-17.5,\"category\":\"groceries\"},{\"id\":\"s0-t6\",\"postedAt\":\"2026-09-07T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 6 SYDNEY NSW\",\"amount\":-18.5,\"category\":\"groceries\"},{\"id\":\"s0-t7\",\"postedAt\":\"2026-09-08T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 7 SYDNEY NSW\",\"amount\":-19.5,\"category\":\"groceries\"},{\"id\":\"s0-t8\",\"postedAt\":\"2026-09-09T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 8 SYDNEY NSW\",\"amount\":-20.5,\"category\":\"groceries\"},{\"id\":\"s0-t9\",\"postedAt\":\"2026-09-10T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 9 SYDNEY NSW\",\"amount\":-21.5,\"category\":\"groceries\"},{\"id\":\"s0-t10\",\"postedAt\":\"2026-09-11T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 10 SYDNEY NSW\",\"amount\":-22.5,\"category\":\"groceries\"},{\"id\":\"s0-t11\",\"postedAt\":\"2026-09-12T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 11 SYDNEY NSW\",\"amount\":-23.5,\"category\":\"groceries\"},{\"id\":\"s0-t12\",\"postedAt\":\"2026-09-13T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 12 SYDNEY NSW\",\"amount\":-24.5,\"category\":\"groceries\"},{\"id\":\"s0-t13\",\"postedAt\":\"2026-09-14T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 13 SYDNEY NSW\",\"amount\":-25.5,\"category\":\"groceries\"},{\"id\":\"s0-t14\",\"postedAt\":\"2026-09-15T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 14 SYDNEY NSW\",\"amount\":-26.5,\"category\":\"groceries\"},{\"id\":\"s0-t15\",\"postedAt\":\"2026-09-16T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 15 SYDNEY NSW\",\"amount\":-27.5,\"category\":\"groceries\"},{\"id\":\"s0-t16\",\"postedAt\":\"2026-09-17T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 16 SYDNEY NSW\",\"amount\":-28.5,\"category\":\"groceries\"},{\"id\":\"s0-t17\",\"postedAt\":\"2026-09-18T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 17 SYDNEY NSW\",\"amount\":-29.5,\"category\":\"groceries\"},{\"id\":\"s0-t18\",\"postedAt\":\"2026-09-19T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 18 SYDNEY NSW\",\"amount\":-30.5,\"category\":\"groceries\"},{\"id\":\"s0-t19\",\"postedAt\":\"2026-09-20T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 19 SYDNEY NSW\",\"amount\":-31.5,\"category\":\"groceries\"},{\"id\":\"s0-t20\",\"postedAt\":\"2026-09-21T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 20 SYDNEY NSW\",\"amount\":-32.5,\"category\":\"groceries\"},{\"id\":\"s0-t21\",\"postedAt\":\"2026-09-22T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 21 SYDNEY NSW\",\"amount\":-33.5,\"category\":\"groceries\"},{\"id\":\"s0-t22\",\"postedAt\":\"2026-09-23T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 22 SYDNEY NSW\",\"amount\":-34.5,\"category\":\"groceries\"},{\"id\":\"s0-t23\",\"postedAt\":\"2026-09-24T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 23 SYDNEY NSW\",\"amount\":-35.5,\"category\":\"groceries\"},{\"id\":\"s0-t24\",\"postedAt\":\"2026-09-25T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 24 SYDNEY NSW\",\"amount\":-36.5,\"category\":\"groceries\"}]},{\"id\":\"s2\",\"name\":\"Account s2\",\"transactions\":[{\"id\":\"s2-t0\",\"postedAt\":\"2026-09-01T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 0 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t1\",\"postedAt\":\"2026-09-02T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 1 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t2\",\"postedAt\":\"2026-09-03T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 2 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t3\",\"postedAt\":\"2026-09-04T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 3 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t4\",\"postedAt\":\"2026-09-05T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 4 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t5\",\"postedAt\":\"2026-09-06T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 5 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t6\",\"postedAt\":\"2026-09-07T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 6 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t7\",\"postedAt\":\"2026-09-08T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 7 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t8\",\"postedAt\":\"2026-09-09T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 8 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t9\",\"postedAt\":\"2026-09-10T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 9 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t10\",\"postedAt\":\"2026-09-11T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 10 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t11\",\"postedAt\":\"2026-09-12T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 11 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t12\",\"postedAt\":\"2026-09-13T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 12 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t13\",\"postedAt\":\"2026-09-14T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 13 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t14\",\"postedAt\":\"2026-09-15T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 14 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t15\",\"postedAt\":\"2026-09-16T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 15 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t16\",\"postedAt\":\"2026-09-17T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 16 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t17\",\"postedAt\":\"2026-09-18T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 17 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t18\",\"postedAt\":\"2026-09-19T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 18 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t19\",\"postedAt\":\"2026-09-20T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 19 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t20\",\"postedAt\":\"2026-09-21T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE MERCHANT 20 SYDNEY NSW\",\"category\":\"groceries\"},{\"id\":\"s2-t21\",\"postedAt\":\"2026-09-22T09:30:00+10:00\",\"description\":\"EFTPOS PURCHASE ME
… 16,036 more charactersEntitlements PIP · AuthZEN (3)
Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P46"
}
}Response
{
"results": [
{
"type": "P46",
"id": "s0"
},
{
"type": "P46",
"id": "s2"
},
{
"type": "P46",
"id": "s4"
},
{
"type": "P46",
"id": "s6"
},
{
"type": "P46",
"id": "s8"
},
{
"type": "P46",
"id": "s10"
},
{
"type": "P46",
"id": "s12"
},
{
"type": "P46",
"id": "s14"
},
{
"type": "P46",
"id": "s16"
},
{
"type": "P46",
"id": "s18"
},
{
"type": "P46",
"id": "s20"
},
{
"type": "P46",
"id": "s22"
},
{
"type": "P46",
"id": "s24"
},
{
"type": "P46",
"id": "s26"
},
{
"type": "P46",
"id": "s28"
},
{
"type": "P46",
"id": "s30"
},
{
"type": "P46",
"id": "s32"
},
{
"type": "P46",
"id": "s34"
},
{
"type": "P46",
"id": "s36"
},
{
"type": "P46",
"id": "s38"
},
{
"type": "P46",
"id": "s40"
},
{
"type": "P46",
"id": "s42"
},
{
"type": "P46",
"id": "s44"
},
{
"type": "P46",
"id": "s46"
},
{
"type": "P46",
"id": "s48"
},
{
"type": "P46",
"id": "s50"
},
{
"type": "P46",
"id": "s52"
},
{
"type": "P46",
"id": "s54"
},
{
"type": "P46",
"id": "s56"
},
{
"type": "P46",
"id": "s58"
},
{
"type": "P46",
"id": "s60"
},
{
"type": "P46",
"id": "s62"
},
{
"type": "P46",
"id": "s64"
},
{
"type": "P46",
"id": "s66"
},
{
"type": "P46",
"id": "s68"
},
{
"type": "P46",
"id": "s70"
},
{
"type": "P46",
"id": "s72"
},
{
"type": "P46",
"id": "s74"
},
{
"type": "P46",
"id": "s76"
},
{
"type": "P46",
"id": "s78"
},
{
"type": "P46",
"id": "s80"
},
{
"type": "P46",
"id": "s82"
},
{
"type": "P46",
"id": "s84"
},
{
"type": "P46",
"id": "s86"
},
{
"type": "P46",
"id": "s88"
},
{
"type": "P46",
"id": "s90"
},
{
"type": "P46",
"id": "s92"
},
{
"type": "P46",
"id": "s94"
},
{
"type": "P46",
"id": "s96"
},
{
"type": "P46",
"id": "s98"
},
{
"type": "P46",
"id": "s100"
},
{
"type": "P46",
"id": "s102"
},
{
"type": "P46",
"id": "s104"
},
{
"type": "P46",
"id": "s106"
},
{
"type": "P46",
"id": "s108"
},
{
"type": "P46",
"id": "s110"
},
{
"type": "P46",
"id": "s112"
},
{
"type": "P46",
"id": "s114"
},
{
"type": "P46",
"id": "s116"
},
{
"type": "P46",
"id": "s118"
},
{
"type": "P46",
"id": "s120"
},
{
"type": "P46",
"id": "s122"
},
{
"type": "P46",
"id": "s124"
},
{
"type": "P46",
"id": "s126"
},
{
"type": "P46",
"id": "s128"
},
{
"type": "P46",
"id": "s130"
},
{
"type": "P46",
"id": "s132"
},
{
"type": "P46",
"id": "s134"
},
{
"type": "P46",
"id": "s136"
},
{
"type": "P46",
"id": "s138"
},
{
"type": "P46",
"id": "s140"
},
{
"type": "P46",
"id": "s142"
},
{
"type": "P46",
"id": "s144"
},
{
"type": "P46",
"id": "s146"
},
{
"type": "P46",
"id": "s148"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/search/resource 200
Request
Content-Type: application/json
Content-Length: 101
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "P46"
}
}Response
{
"results": [
{
"type": "P46",
"id": "s0"
},
{
"type": "P46",
"id": "s4"
},
{
"type": "P46",
"id": "s8"
},
{
"type": "P46",
"id": "s12"
},
{
"type": "P46",
"id": "s16"
},
{
"type": "P46",
"id": "s20"
},
{
"type": "P46",
"id": "s24"
},
{
"type": "P46",
"id": "s28"
},
{
"type": "P46",
"id": "s32"
},
{
"type": "P46",
"id": "s36"
},
{
"type": "P46",
"id": "s40"
},
{
"type": "P46",
"id": "s44"
},
{
"type": "P46",
"id": "s48"
},
{
"type": "P46",
"id": "s52"
},
{
"type": "P46",
"id": "s56"
},
{
"type": "P46",
"id": "s60"
},
{
"type": "P46",
"id": "s64"
},
{
"type": "P46",
"id": "s68"
},
{
"type": "P46",
"id": "s72"
},
{
"type": "P46",
"id": "s76"
},
{
"type": "P46",
"id": "s80"
},
{
"type": "P46",
"id": "s84"
},
{
"type": "P46",
"id": "s88"
},
{
"type": "P46",
"id": "s92"
},
{
"type": "P46",
"id": "s96"
},
{
"type": "P46",
"id": "s100"
},
{
"type": "P46",
"id": "s104"
},
{
"type": "P46",
"id": "s108"
},
{
"type": "P46",
"id": "s112"
},
{
"type": "P46",
"id": "s116"
},
{
"type": "P46",
"id": "s120"
},
{
"type": "P46",
"id": "s124"
},
{
"type": "P46",
"id": "s128"
},
{
"type": "P46",
"id": "s132"
},
{
"type": "P46",
"id": "s136"
},
{
"type": "P46",
"id": "s140"
},
{
"type": "P46",
"id": "s144"
},
{
"type": "P46",
"id": "s148"
}
],
"page": {
"next_token": ""
}
}Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 116
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "view"
},
"resource": {
"type": "none",
"id": "none"
}
}Response
{
"decision": false
}Upstream API (1)
Kong → API GET /api/P46 200
Request
Via: 1.1 kong/3.9.4
Host: api.example
Connection: keep-alive
X-Forwarded-For: 192.0.2.1
X-Forwarded-Proto: http
X-Forwarded-Host: gateway.example
X-Forwarded-Port: 8000
X-Forwarded-Path: /api/P46
X-Real-IP: 192.0.2.1
X-Kong-Request-Id: beaa9906d5af387543e4e34492d4c238
User-Agent: Python-urllib/3.9
Authorization: Bearer eyJ…
Content-Type: application/json(no body)
Response
{"data": [{"id": "s0", "balance": 100, "tax_id": "TFN-0", "name": "Account s0", "transactions": [{"id": "s0-t0", "postedAt": "2026-09-01T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 0 SYDNEY NSW", "amount": -12.5, "category": "groceries"}, {"id": "s0-t1", "postedAt": "2026-09-02T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 1 SYDNEY NSW", "amount": -13.5, "category": "groceries"}, {"id": "s0-t2", "postedAt": "2026-09-03T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 2 SYDNEY NSW", "amount": -14.5, "category": "groceries"}, {"id": "s0-t3", "postedAt": "2026-09-04T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 3 SYDNEY NSW", "amount": -15.5, "category": "groceries"}, {"id": "s0-t4", "postedAt": "2026-09-05T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 4 SYDNEY NSW", "amount": -16.5, "category": "groceries"}, {"id": "s0-t5", "postedAt": "2026-09-06T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 5 SYDNEY NSW", "amount": -17.5, "category": "groceries"}, {"id": "s0-t6", "postedAt": "2026-09-07T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 6 SYDNEY NSW", "amount": -18.5, "category": "groceries"}, {"id": "s0-t7", "postedAt": "2026-09-08T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 7 SYDNEY NSW", "amount": -19.5, "category": "groceries"}, {"id": "s0-t8", "postedAt": "2026-09-09T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 8 SYDNEY NSW", "amount": -20.5, "category": "groceries"}, {"id": "s0-t9", "postedAt": "2026-09-10T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 9 SYDNEY NSW", "amount": -21.5, "category": "groceries"}, {"id": "s0-t10", "postedAt": "2026-09-11T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 10 SYDNEY NSW", "amount": -22.5, "category": "groceries"}, {"id": "s0-t11", "postedAt": "2026-09-12T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 11 SYDNEY NSW", "amount": -23.5, "category": "groceries"}, {"id": "s0-t12", "postedAt": "2026-09-13T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 12 SYDNEY NSW", "amount": -24.5, "category": "groceries"}, {"id": "s0-t13", "postedAt": "2026-09-14T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 13 SYDNEY NSW", "amount": -25.5, "category": "groceries"}, {"id": "s0-t14", "postedAt": "2026-09-15T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 14 SYDNEY NSW", "amount": -26.5, "category": "groceries"}, {"id": "s0-t15", "postedAt": "2026-09-16T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 15 SYDNEY NSW", "amount": -27.5, "category": "groceries"}, {"id": "s0-t16", "postedAt": "2026-09-17T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 16 SYDNEY NSW", "amount": -28.5, "category": "groceries"}, {"id": "s0-t17", "postedAt": "2026-09-18T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 17 SYDNEY NSW", "amount": -29.5, "category": "groceries"}, {"id": "s0-t18", "postedAt": "2026-09-19T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 18 SYDNEY NSW", "amount": -30.5, "category": "groceries"}, {"id": "s0-t19", "postedAt": "2026-09-20T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 19 SYDNEY NSW", "amount": -31.5, "category": "groceries"}, {"id": "s0-t20", "postedAt": "2026-09-21T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 20 SYDNEY NSW", "amount": -32.5, "category": "groceries"}, {"id": "s0-t21", "postedAt": "2026-09-22T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 21 SYDNEY NSW", "amount": -33.5, "category": "groceries"}, {"id": "s0-t22", "postedAt": "2026-09-23T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 22 SYDNEY NSW", "amount": -34.5, "category": "groceries"}, {"id": "s0-t23", "postedAt": "2026-09-24T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 23 SYDNEY NSW", "amount": -35.5, "category": "groceries"}, {"id": "s0-t24", "postedAt": "2026-09-25T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 24 SYDNEY NSW", "amount": -36.5, "category": "groceries"}]}, {"id": "s1", "balance": 101, "tax_id": "TFN-1", "name": "Account s1", "transactions": [{"id": "s1-t0", "postedAt": "2026-09-01T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 0 SYDNEY NSW", "amount": -12.5, "category": "groceries"}, {"id": "s1-t1", "postedAt": "2026-09-02T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 1 SYDNEY NSW", "amount": -13.5, "category": "groceries"}, {"id": "s1-t2", "postedAt": "2026-09-03T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 2 SYDNEY NSW", "amount": -14.5, "category": "groceries"}, {"id": "s1-t3", "postedAt": "2026-09-04T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 3 SYDNEY NSW", "amount": -15.5, "category": "groceries"}, {"id": "s1-t4", "postedAt": "2026-09-05T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 4 SYDNEY NSW", "amount": -16.5, "category": "groceries"}, {"id": "s1-t5", "postedAt": "2026-09-06T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 5 SYDNEY NSW", "amount": -17.5, "category": "groceries"}, {"id": "s1-t6", "postedAt": "2026-09-07T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 6 SYDNEY NSW", "amount": -18.5, "category": "groceries"}, {"id": "s1-t7", "postedAt": "2026-09-08T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 7 SYDNEY NSW", "amount": -19.5, "category": "groceries"}, {"id": "s1-t8", "postedAt": "2026-09-09T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 8 SYDNEY NSW", "amount": -20.5, "category": "groceries"}, {"id": "s1-t9", "postedAt": "2026-09-10T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 9 SYDNEY NSW", "amount": -21.5, "category": "groceries"}, {"id": "s1-t10", "postedAt": "2026-09-11T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 10 SYDNEY NSW", "amount": -22.5, "category": "groceries"}, {"id": "s1-t11", "postedAt": "2026-09-12T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 11 SYDNEY NSW", "amount": -23.5, "category": "groceries"}, {"id": "s1-t12", "postedAt": "2026-09-13T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 12 SYDNEY NSW", "amount": -24.5, "category": "groceries"}, {"id": "s1-t13", "postedAt": "2026-09-14T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 13 SYDNEY NSW", "amount": -25.5, "category": "groceries"}, {"id": "s1-t14", "postedAt": "2026-09-15T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 14 SYDNEY NSW", "amount": -26.5, "category": "groceries"}, {"id": "s1-t15", "postedAt": "2026-09-16T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 15 SYDNEY NSW", "amount": -27.5, "category": "groceries"}, {"id": "s1-t16", "postedAt": "2026-09-17T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 16 SYDNEY NSW", "amount": -28.5, "category": "groceries"}, {"id": "s1-t17", "postedAt": "2026-09-18T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 17 SYDNEY NSW", "amount": -29.5, "category": "groceries"}, {"id": "s1-t18", "postedAt": "2026-09-19T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 18 SYDNEY NSW", "amount": -30.5, "category": "groceries"}, {"id": "s1-t19", "postedAt": "2026-09-20T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 19 SYDNEY NSW", "amount": -31.5, "category": "groceries"}, {"id": "s1-t20", "postedAt": "2026-09-21T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 20 SYDNEY NSW", "amount": -32.5, "category": "groceries"}, {"id": "s1-t21", "postedAt": "2026-09-22T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 21 SYDNEY NSW", "amount": -33.5, "category": "groceries"}, {"id": "s1-t22", "postedAt": "2026-09-23T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 22 SYDNEY NSW", "amount": -34.5, "category": "groceries"}, {"id": "s1-t23", "postedAt": "2026-09-24T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 23 SYDNEY NSW", "amount": -35.5, "category": "groceries"}, {"id": "s1-t24", "postedAt": "2026-09-25T09:30:00+10:00", "description": "EFTPOS PURCHASE MERCHANT 24 SYDNEY NSW
… 16,025 more charactersRequest paths · 4
P61a dot segment: /a1/../a3 when only a1 is entitledRequest pathspass · 4033 PDP · 1 PIP · 0 upstream
As the metadata means.
OpenAPI 3.1
Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P61: a dot segment: /a1/../a3 when only a1 is entitled"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P61/{accountId}:
get:
operationId: caseP61
summary: "a dot segment: /a1/../a3 when only a1 is entitled"
security:
- bearerAuth: []
parameters:
- name: accountId
in: path
required: true
schema:
type: string
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
example:
ok: true
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 3 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"method": "GET",
"path": "/api/P61/{accountId}",
"resource": {
"type": "P61",
"id": "{accountId}"
},
"action": "read"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P61/a1/../a3' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 403
Date: Thu, 22 Oct 2026 09:44:02 GMT
Content-Type: application/json
Connection: close
X-PDP-Source: rfc9728
X-PDP-Layer: https://pdp-response.example
X-PDP-PEP: Kong (sideband)
X-PDP-Decision: DENY
Content-Length: 88
X-Kong-Response-Latency: 214
Server: kong/3.9.4
X-Kong-Request-Id: 0d92a171164c16372f67082331c16e30{
"status": 403,
"error": "access_denied",
"error_description": "alice may not read a3."
}What the metadata means
403: the request names a3.
PDP · Sideband API (3)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1045
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 59282,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P61/a3",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 59282,
"method": "GET",
"url": "https://gateway.example/api/P61/a3",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · risk POST /sideband/request 200
Request
Content-Length: 1035
Accept: application/json
Host: pdp-risk.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 59282,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P61/a3",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 59282,
"method": "GET",
"url": "https://gateway.example/api/P61/a3",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
]
}Kong → PingAuthorize · response POST /sideband/request 200
Request
Content-Length: 1035
Accept: application/json
Host: pdp-response.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 59282,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"http_version": "1.1",
"method": "GET",
"url": "https://gateway.example/api/P61/a3",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 59282,
"method": "GET",
"url": "https://gateway.example/api/P61/a3",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"response": {
"response_code": "403",
"response_status": "Forbidden",
"http_version": "1.1",
"headers": [
{
"Content-Type": "application/json"
}
],
"body": "{\"status\": 403, \"error\": \"access_denied\", \"error_description\": \"alice may not read a3.\"}"
}
}Entitlements PIP · AuthZEN (1)
Policy Editor → Entitlements PIP POST /access/v1/evaluation 200
Request
Content-Type: application/json
Content-Length: 113
Host: entitlements.example
Connection: Keep-Alive
Accept-Encoding: gzip{
"subject": {
"type": "user",
"id": "alice"
},
"action": {
"name": "read"
},
"resource": {
"type": "P61",
"id": "a3"
}
}Response
{
"decision": false
}Upstream API (0)
Not proxied: the request was denied before it reached the API.
P62an encoded slash: a1%2F..%2Fa3Request pathspass · 4031 PDP · 0 PIP · 0 upstream
As the metadata means.
OpenAPI 3.1
Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P62: an encoded slash: a1%2F..%2Fa3"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P62/{accountId}:
get:
operationId: caseP62
summary: "an encoded slash: a1%2F..%2Fa3"
security:
- bearerAuth: []
parameters:
- name: accountId
in: path
required: true
schema:
type: string
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
example:
ok: true
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 1 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"method": "GET",
"path": "/api/P62/{accountId}",
"resource": {
"type": "P62",
"id": "{accountId}"
},
"action": "read"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P62/a1%2F..%2Fa3' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 403
Date: Thu, 22 Oct 2026 09:44:04 GMT
Content-Type: application/json
Connection: close
X-PDP-Source: rfc9728
X-PDP-Layer: https://pdp-token.example
X-PDP-PEP: Kong (sideband)
X-PDP-Decision: DENY
Content-Length: 144
X-Kong-Response-Latency: 278
Server: kong/3.9.4
X-Kong-Request-Id: 7de70f0f1bb3f836c637e572af48e728{
"status": 403,
"error": "operation_not_published",
"error_description": "The resource's metadata names no operation for this method and path."
}What the metadata means
Refused.
PDP · Sideband API (1)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1055
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 59298,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P62/a1%2F..%2Fa3",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 59298,
"method": "GET",
"url": "https://gateway.example/api/P62/a1%2F..%2Fa3",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"response": {
"response_code": "403",
"response_status": "Forbidden",
"http_version": "1.1",
"headers": [
{
"Content-Type": "application/json"
}
],
"body": "{\"status\": 403, \"error\": \"operation_not_published\", \"error_description\": \"The resource's metadata names no operation for this method and path.\"}"
}
}Entitlements PIP · AuthZEN (0)
No entitlements call: the request was decided before the PIP was asked.
Upstream API (0)
Not proxied: the request was denied before it reached the API.
P63an extra segment past the template: /a1/statementsRequest pathspass · 4031 PDP · 0 PIP · 0 upstream
As the metadata means.
OpenAPI 3.1
Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P63: an extra segment past the template: /a1/statements"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P63/{accountId}:
get:
operationId: caseP63
summary: "an extra segment past the template: /a1/statements"
security:
- bearerAuth: []
parameters:
- name: accountId
in: path
required: true
schema:
type: string
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
example:
ok: true
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 1 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"method": "GET",
"path": "/api/P63/{accountId}",
"resource": {
"type": "P63",
"id": "{accountId}"
},
"action": "read"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P63/a1/statements' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 403
Date: Thu, 22 Oct 2026 09:44:06 GMT
Content-Type: application/json
Connection: close
X-PDP-Source: rfc9728
X-PDP-Layer: https://pdp-token.example
X-PDP-PEP: Kong (sideband)
X-PDP-Decision: DENY
Content-Length: 144
X-Kong-Response-Latency: 66
Server: kong/3.9.4
X-Kong-Request-Id: ccc79e1e05dc5d60580b5a40fcc22751{
"status": 403,
"error": "operation_not_published",
"error_description": "The resource's metadata names no operation for this method and path."
}What the metadata means
Refused: no operation is published for this path.
PDP · Sideband API (1)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1056
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 62784,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P63/a1/statements",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 62784,
"method": "GET",
"url": "https://gateway.example/api/P63/a1/statements",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"response": {
"response_code": "403",
"response_status": "Forbidden",
"http_version": "1.1",
"headers": [
{
"Content-Type": "application/json"
}
],
"body": "{\"status\": 403, \"error\": \"operation_not_published\", \"error_description\": \"The resource's metadata names no operation for this method and path.\"}"
}
}Entitlements PIP · AuthZEN (0)
No entitlements call: the request was decided before the PIP was asked.
Upstream API (0)
Not proxied: the request was denied before it reached the API.
P64the template after another prefix: /api/P63/api/P64/a1Request pathspass · 4031 PDP · 0 PIP · 0 upstream
As the metadata means.
OpenAPI 3.1
Generated from the payload: the path, parameters, security and response schema.
openapi: "3.1.0"
info:
title: "P64: the template after another prefix: /api/P63/api/P64/a1"
version: "1.0.0"
description: Generated from the payload for this page.
servers:
- url: https://gateway.example
description: Kong (sideband-pdp)
paths:
/api/P64/{accountId}:
get:
operationId: caseP64
summary: "the template after another prefix: /api/P63/api/P64/a1"
security:
- bearerAuth: []
parameters:
- name: accountId
in: path
required: true
schema:
type: string
responses:
"200":
description: "The resource's answer"
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
example:
ok: true
"401":
description: "No valid token (invalid_token), or the wrong acr"
headers:
WWW-Authenticate:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"403":
description: "insufficient_scope, access_denied or operation_not_published"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
"502":
description: "response_withheld: the response could not be authorised"
content:
application/json:
schema:
type: object
properties:
status:
type: integer
error:
type: string
error_description:
type: string
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWTRFC 9728 metadata and entitlements
The document the API served at /.well-known/oauth-protected-resource, cut to this API's operation. The policy fetched it 1 times during this request.
{
"resource": "https://api.example",
"authorization_servers": [
"https://as.demo.example"
],
"access_token_audiences": [
"accounts-api"
],
"scopes_supported": [
"accounts:read",
"payments:write"
],
"scopes_required": [],
"acr_values_required": [
"urn:demo:acr:basic",
"urn:demo:acr:strong"
],
"authzen_policy_set": {
"combining": "deny-overrides",
"members": [
"https://pdp-token.example",
"https://pdp-risk.example",
"https://pdp-response.example"
]
},
"authzen_entitlements_pip": "https://entitlements.example",
"authzen_risk_policies": [
{
"name": "payments-risk",
"claim": "risk_session",
"max_score": 600
}
],
"authzen_operations": [
{
"method": "GET",
"path": "/api/P64/{accountId}",
"resource": {
"type": "P64",
"id": "{accountId}"
},
"action": "read"
}
]
}The entitlements this case gives alice at the PIP:
{
"read": [
"a1"
]
}Request · curl
curl -sS -i -X GET 'https://gateway.example/api/P63/api/P64/a1' \
-H 'authorization: Bearer eyJ…'The token carries these claims, signed RS256 by the demo issuer:
{
"sub": "alice",
"iss": "https://as.demo.example",
"aud": "accounts-api",
"scope": "accounts:read",
"acr": "urn:demo:acr:basic"
}Response
What the client got · HTTP 403
Date: Thu, 22 Oct 2026 09:44:07 GMT
Content-Type: application/json
Connection: close
X-PDP-Source: rfc9728
X-PDP-Layer: https://pdp-token.example
X-PDP-PEP: Kong (sideband)
X-PDP-Decision: DENY
Content-Length: 144
X-Kong-Response-Latency: 113
Server: kong/3.9.4
X-Kong-Request-Id: 8282241a32d589002815311d50b5db64{
"status": 403,
"error": "operation_not_published",
"error_description": "The resource's metadata names no operation for this method and path."
}What the metadata means
Refused: the template must match the whole path.
PDP · Sideband API (1)
Kong → PingAuthorize · token POST /sideband/request 200
Request
Content-Length: 1056
Accept: application/json
Host: pdp-token.example
User-Agent: Kong/sideband-pdp 0.4.2
Content-Type: application/json{
"source_port": 62786,
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"url": "https://gateway.example/api/P63/api/P64/a1",
"http_version": "1.1",
"method": "GET",
"body": "",
"source_ip": "192.0.2.1"
}Response
{
"source_ip": "192.0.2.1",
"source_port": 62786,
"method": "GET",
"url": "https://gateway.example/api/P63/api/P64/a1",
"http_version": "1.1",
"headers": [
{
"accept-encoding": "identity"
},
{
"authorization": "Bearer eyJ…"
},
{
"connection": "close"
},
{
"content-type": "application/json"
},
{
"host": "gateway.example"
},
{
"user-agent": "Python-urllib/3.9"
},
{
"x-authzen-resource": "https://api.example"
},
{
"x-pep-method": "GET"
}
],
"response": {
"response_code": "403",
"response_status": "Forbidden",
"http_version": "1.1",
"headers": [
{
"Content-Type": "application/json"
}
],
"body": "{\"status\": 403, \"error\": \"operation_not_published\", \"error_description\": \"The resource's metadata names no operation for this method and path.\"}"
}
}Entitlements PIP · AuthZEN (0)
No entitlements call: the request was decided before the PIP was asked.
Upstream API (0)
Not proxied: the request was denied before it reached the API.