Warrant

Warrant's REST API covers four core operations: write a warrant (grant permission), read warrants (query relationships), check access (single or batch permission check), and query (list objects a user can access). The access check endpoint is optimized for low-latency use in hot paths. JSON request/response. SDK support: TypeScript/Node, Python, Go, Java. The API design follows Zanzibar semantics: (subject, relation, object) triples. Batch check and query endpoints support complex authorization scenarios.

Check endpoint returns structured JSON: { result: 'Authorized' | 'Not Authorized' }. Permission denied does not return 403 — it returns 200 with result: 'Not Authorized' (correct for authorization check endpoints). HTTP errors: 400 for invalid requests, 401 for auth failures, 5xx for service errors. Batch check errors return per-item results. Rate limits are plan-based on Warrant Cloud. Error handling is well-defined for the core check use case.

Warrant is an open-source Zanzibar-inspired authorization service providing fine-grained, relationship-based access control (ReBAC). Agents can use Warrant's API to check permissions (is user X allowed to do Y on object Z?), create and manage object relationships (user is member of team, team has viewer role on document), and define permission policies. This is directly relevant to agents operating in multi-tenant environments where access must be enforced at runtime. Warrant Cloud is the managed offering; self-hosting is supported via Go binary or Docker. API key auth. Confidence is docs-derived.

Authentication via API key (bearer token) for management and check APIs. Server-side key for write operations (warrant management); client-side key for read/check if configured. No OAuth for machine-to-machine use — API key is the pattern. Keys are generated in the Warrant Cloud dashboard or via environment config for self-hosted. No key scoping documented beyond server/client distinction. Standard API key model.

Documentation at docs.warrant.dev covers the data model, API reference, and SDK guides. The ReBAC model explanation is clear. Getting started guide is practical with examples. SDK documentation is detailed for supported languages. Community support via Slack and GitHub. Documentation quality is good for the core use case; advanced policy scenarios and self-hosting edge cases are less documented. Actively maintained.