How do I keep each user’s data private?
Every call needs to check who is asking for which record. APIblaze does it for you, before your API runs.
Access follows how people connect to each record: who booked it, who it was shared with, who manages the restaurant it belongs to. Start from your spec or a sentence in plain English.
Put APIblaze in front of your API
$ npx apiblaze@latest create --target https://ninopizzas.com/openapi.yamlPaste it in a terminal. No sign-up, no servers. It reads the spec and asks one question: should only the person who created a record be able to change it? The link is a sample restaurant API; swap in your own.
One edited URL, someone else’s booking
The most common way private data leaks. Ben booked reservation 41, then changes the URL to 42, which is Ana’s. This hole, broken object-level authorization, is number one on OWASP’s list of API security risks.
GET /restaurants/nino/reservations/4242 is Ana’s booking200 OK
{
"id": "42",
"diner_name": "Ana",
"diner_email": "ana@ninopizzas.com",
"party_size": 2
}Ana’s name and email, sent to Ben.
403 Forbidden
{
"error": "Forbidden",
"reason": "Not allowed for this user"
}Your API never saw the call.
Access that follows how people connect to a record
Roles say what kind of user someone is. Relationships say which records are theirs. Pick a person to see why they can, or can’t, open reservation 42.
Reservation 42 · Nino’s Pizza
Table for 2, Friday at 8 pm. Booked by Ana.
She manages the restaurant it was booked at.
→ 3 of 3 allowed
type usertype restaurantrelationsdefine manager: [user]type reservationrelationsdefine restaurant: [restaurant]define owner: [user]define guest: [user]define can_view: owner or guest or manager from restaurantdefine can_change: owner or manager from restaurantdefine can_cancel: owner or manager from restaurant
The lit lines are why Maria gets in.
Whoever creates a record owns it
When a booking succeeds, APIblaze records who made it. Every later call on that record is checked against it before your API is asked.
Ana: POST /reservations
POST /reservations
201 {"id": "42"}
user:ana owner reservation:42
Ana now owns reservation 42
201 Created
- Later
Ben: GET /reservations/42
can ben view reservation:42? no
Checked before your API is asked
403 Forbidden
Start from your spec, or a sentence
Most APIs need one rule first: each record belongs to whoever created it, or an admin. For anything else, describe it in plain English and review the draft before anything is saved.
In the dashboard, under Authorization
Protect what people create
We read your spec and found 3 things people create through your API. Turn a rule on and each one belongs to whoever created it.
- restaurants
- reservations
- tables
Or from your terminal
Lock each record to whoever created it
$ npx apiblaze@latest rule myapiAny other rule, in plain English
$ npx apiblaze@latest rule myapi "guests can view a reservation, and managers can cancel any reservation at their restaurant"Design a bigger set of rules in a chat
$ npx apiblaze@latest agent authz myapi
Replace myapi with your project’s name. These need a login. Rules save in shadow first, and each plain-English sentence is billed as one AI turn.
Watch first, then enforce
Once you add rules, they start in shadow, so you can turn them on without locking anyone out. Records made before the rules have no owner yet, and the CLI warns you about them before you enforce.
Shadow: owners are recorded, nobody is blocked until you enforce.
- Ana opens her reservation 42200
- Ben opens reservation 42200
- Luca books a tableowner recorded201
Changed your mind? This turns enforcement off again:
$ npx apiblaze@latest config myapi authorization.enforce_authorization falseCommon questions
- Routes with a rule
Is every route protected once I turn this on?
A route is checked only once it has a rule, so a new route stays open until it gets one. The dashboard counts the routes that have no rule, so none slip by unseen.
- Your API does
Does APIblaze filter list results?
Lists come back as your API returns them. Your API is told who is asking, in x-abz-user-id, so it can return only that person’s records. Add a list rule and it also receives the ids they may see, in X-Authorized-Objects.
- A 403
What does a refused caller get?
A 403 with {"error":"Forbidden","reason":"Not allowed for this user"}. Your API never sees the call. If the check itself cannot run, the call is refused too, never let through.
- Within 90 seconds
How fast does a change take effect?
Answers are cached briefly to keep calls fast, so a new rule, grant or removal can take up to about 90 seconds to apply everywhere.
- Through your API
Can users share a record with someone?
Give your API a share call. You can add a rule to it that lets only the owner share, and records who the record was shared with.
- Access stays
What happens when a record is deleted?
Deleting a record does not remove who could access it. That is harmless as long as your API never reuses an id.
- No
Does it work on an open API with no login?
A rule has to know who is calling: a signed-in user, an API key issued to that person, or your own server naming them in X-End-User-Id.
- Yes
Do AI agents using my MCP server get the same checks?
Each tool call reaches your API with the caller’s own credentials, so your rules apply. Ben’s assistant cannot read Ana’s booking either.
- Yes
Can I write the rules myself?
Press Model on the Authorization page to edit the model as OpenFGA JSON. Each route’s rule can be edited there too.
- Not yet
Can access depend on time or attributes, like office hours?
Rules are relationships: who owns a record, who was given it, who manages what it belongs to. Time and attribute conditions are not supported yet.
- OpenFGA
What is it built on?
OpenFGA, the open-source authorization engine modelled on Google’s Zanzibar. APIblaze runs it for you, so there is no policy server to host.
Prices are on the pricing page.
Keep each user’s data private
No sign-up, no servers. Every call checked against who owns, was given, or manages the record.
$ npx apiblaze@latest create --target https://ninopizzas.com/openapi.yaml