{"id":13510682,"url":"https://github.com/permitio/opal","last_synced_at":"2026-01-22T19:32:03.763Z","repository":{"id":37005974,"uuid":"338791379","full_name":"permitio/opal","owner":"permitio","description":"Policy and data administration, distribution, and real-time updates on top of Policy Agents (OPA, Cedar, ...)","archived":false,"fork":false,"pushed_at":"2025-08-22T22:58:37.000Z","size":6994,"stargazers_count":5347,"open_issues_count":74,"forks_count":230,"subscribers_count":32,"default_branch":"master","last_synced_at":"2025-08-29T15:26:14.322Z","etag":null,"topics":["authorization","cedar","hacktoberfest","microservices","opa","opal","open-policy-agent","openfga","policy","policy-as-code","pubsub","realtime","websocket"],"latest_commit_sha":null,"homepage":"https://opal.ac","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/permitio.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2021-02-14T11:37:31.000Z","updated_at":"2025-08-26T10:45:05.000Z","dependencies_parsed_at":"2023-10-02T08:57:00.852Z","dependency_job_id":"ac962981-5424-483f-9271-afce6fdbf290","html_url":"https://github.com/permitio/opal","commit_stats":{"total_commits":1182,"total_committers":39,"mean_commits":"30.307692307692307","dds":0.565989847715736,"last_synced_commit":"cb4da1689edeeab36e01f456b71de05bfa2437cc"},"previous_names":[],"tags_count":56,"template":false,"template_full_name":null,"purl":"pkg:github/permitio/opal","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/permitio%2Fopal","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/permitio%2Fopal/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/permitio%2Fopal/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/permitio%2Fopal/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/permitio","download_url":"https://codeload.github.com/permitio/opal/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/permitio%2Fopal/sbom","scorecard":{"id":728025,"data":{"date":"2025-08-11","repo":{"name":"github.com/permitio/opal","commit":"df69da9ffeacd34e783b8a05ab83c8b61acd7df8"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.6,"checks":[{"name":"Code-Review","score":9,"reason":"Found 27/28 approved changesets -- score normalized to 9","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Maintained","score":10,"reason":"18 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: jobLevel 'contents' permission set to 'write': .github/workflows/on_release.yml:28","Warn: no topLevel permission defined: .github/workflows/on_release.yml:1","Warn: no topLevel permission defined: .github/workflows/pre-commit.yml:1","Warn: no topLevel permission defined: .github/workflows/sync_opal_plus.yml:1","Warn: no topLevel permission defined: .github/workflows/tests.yml:1"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact 0.8.3 not signed: https://api.github.com/repos/permitio/opal/releases/237125082","Warn: release artifact 0.8.2 not signed: https://api.github.com/repos/permitio/opal/releases/236553037","Warn: release artifact 0.8.2-rc.2 not signed: https://api.github.com/repos/permitio/opal/releases/232997333","Warn: release artifact 0.8.2-rc.1 not signed: https://api.github.com/repos/permitio/opal/releases/232947284","Warn: release artifact 0.8.1 not signed: https://api.github.com/repos/permitio/opal/releases/229455448","Warn: release artifact 0.8.3 does not have provenance: https://api.github.com/repos/permitio/opal/releases/237125082","Warn: release artifact 0.8.2 does not have provenance: https://api.github.com/repos/permitio/opal/releases/236553037","Warn: release artifact 0.8.2-rc.2 does not have provenance: https://api.github.com/repos/permitio/opal/releases/232997333","Warn: release artifact 0.8.2-rc.1 does not have provenance: https://api.github.com/repos/permitio/opal/releases/232947284","Warn: release artifact 0.8.1 does not have provenance: https://api.github.com/repos/permitio/opal/releases/229455448"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/on_release.yml:22"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/on_release.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/on_release.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/on_release.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/on_release.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/on_release.yml:60: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/on_release.yml:73: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/on_release.yml:106: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/on_release.yml:121: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/on_release.yml:136: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/on_release.yml:151: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/on_release.yml:165: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/on_release.yml:180: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/on_release.yml:194: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/on_release.yml:209: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/on_release.yml:221: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/on_release.yml:261: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/on_release.yml:271: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/on_release.yml:283: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/on_release.yml:295: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/on_release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pre-commit.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/pre-commit.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pre-commit.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/pre-commit.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pre-commit.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/pre-commit.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sync_opal_plus.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/sync_opal_plus.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sync_opal_plus.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/sync_opal_plus.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sync_opal_plus.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/sync_opal_plus.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/tests.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/tests.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/tests.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/tests.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/tests.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/tests.yml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/tests.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/tests.yml:79: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/tests.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/tests.yml:92: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/tests.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:104: update your workflow using https://app.stepsecurity.io/secureworkflow/permitio/opal/tests.yml/master?enable=pin","Warn: containerImage not pinned by hash: docker/Dockerfile:4","Warn: containerImage not pinned by hash: docker/Dockerfile:17","Warn: containerImage not pinned by hash: docker/Dockerfile:56","Warn: containerImage not pinned by hash: docker/Dockerfile:83","Warn: containerImage not pinned by hash: docker/Dockerfile:101","Warn: containerImage not pinned by hash: docker/Dockerfile:122","Warn: containerImage not pinned by hash: docker/Dockerfile:124","Warn: containerImage not pinned by hash: docker/Dockerfile:144","Warn: pipCommand not pinned by hash: docker/Dockerfile:13","Warn: pipCommand not pinned by hash: docker/Dockerfile:13","Warn: pipCommand not pinned by hash: .github/workflows/on_release.yml:229","Warn: pipCommand not pinned by hash: .github/workflows/on_release.yml:248","Warn: pipCommand not pinned by hash: .github/workflows/pre-commit.yml:18","Warn: pipCommand not pinned by hash: .github/workflows/tests.yml:41","Warn: pipCommand not pinned by hash: .github/workflows/tests.yml:42","Warn: pipCommand not pinned by hash: .github/workflows/tests.yml:43","Warn: pipCommand not pinned by hash: .github/workflows/tests.yml:44","Warn: pipCommand not pinned by hash: .github/workflows/tests.yml:110","Warn: pipCommand not pinned by hash: .github/workflows/tests.yml:111","Warn: pipCommand not pinned by hash: .github/workflows/tests.yml:112","Info:   0 out of  11 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of  22 third-party GitHubAction dependencies pinned","Info:   0 out of  12 pipCommand dependencies pinned","Info:   0 out of   8 containerImage dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":0,"reason":"15 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-jr5f-v2jv-69x6","Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw","Warn: Project is vulnerable to: GHSA-vhxf-7vqr-mrjg","Warn: Project is vulnerable to: GHSA-f7f6-9jq7-3rqj","Warn: Project is vulnerable to: GHSA-fjxv-7rqg-78g4","Warn: Project is vulnerable to: GHSA-4www-5p9h-95mh","Warn: Project is vulnerable to: GHSA-9gqv-wp59-fq42","Warn: Project is vulnerable to: GHSA-m5qc-5hw7-8vg7","Warn: Project is vulnerable to: GHSA-76c9-3jph-rj3q","Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j","Warn: Project is vulnerable to: GHSA-x7hr-w5r2-h6wg","Warn: Project is vulnerable to: GHSA-4v9v-hfq4-rm2v","Warn: Project is vulnerable to: GHSA-9jgg-88mc-972h","Warn: Project is vulnerable to: PYSEC-2025-49 / GHSA-5rjg-fvgr-3xxf","Warn: Project is vulnerable to: PYSEC-2022-43017 / GHSA-qwmp-2cf2-g9g6"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-22T13:28:03.234Z","repository_id":37005974,"created_at":"2025-08-22T13:28:03.234Z","updated_at":"2025-08-22T13:28:03.234Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":273797723,"owners_count":25170124,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-05T02:00:09.113Z","response_time":402,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authorization","cedar","hacktoberfest","microservices","opa","opal","open-policy-agent","openfga","policy","policy-as-code","pubsub","realtime","websocket"],"created_at":"2024-08-01T02:01:49.587Z","updated_at":"2026-01-22T19:32:03.745Z","avatar_url":"https://github.com/permitio.png","language":"Python","readme":"\u003cp  align=\"center\"\u003e\n \u003cimg src=\"https://github.com/permitio/opal/assets/4082578/4e21f85f-30ab-43e2-92de-b82f78888c71\" height=170 alt=\"opal\" border=\"0\" /\u003e\n\u003c/p\u003e\n\u003ch1 align=\"center\"\u003e\n⚡OPAL⚡\n\u003c/h1\u003e\n\n\u003ch2 align=\"center\"\u003e\nOpen Policy Administration Layer\n\u003c/h2\u003e\n\n\u003ca href=\"https://github.com/permitio/opal/actions?query=workflow%3ATests\" target=\"_blank\"\u003e\n    \u003cimg src=\"https://github.com/permitio/opal/workflows/Tests/badge.svg\" alt=\"Tests\"\u003e\n\u003c/a\u003e\n\u003ca href=\"https://pypi.org/project/opal-server/\" target=\"_blank\"\u003e\n    \u003cimg src=\"https://img.shields.io/pypi/v/opal-server?color=%2331C654\u0026label=OPAL%20Server%20%28PyPi%29\" alt=\"Package\"\u003e\n\u003c/a\u003e\n\u003ca href=\"https://pypi.org/project/opal-client/\" target=\"_blank\"\u003e\n    \u003cimg src=\"https://img.shields.io/pypi/v/opal-client?color=%2331C654\u0026label=OPAL%20Client%20%28PyPi%29\" alt=\"Package\"\u003e\n\u003c/a\u003e\n\u003ca href=\"https://pepy.tech/project/opal-server\" target=\"_blank\"\u003e\n    \u003cimg src=\"https://static.pepy.tech/personalized-badge/opal-client?period=total\u0026units=international_system\u0026left_color=black\u0026right_color=blue\u0026left_text=Downloads\" alt=\"Downloads\"\u003e\n\u003c/a\u003e\n\n\u003ca href=\"https://hub.docker.com/r/permitio/opal-server\" target=\"_blank\"\u003e\n    \u003cimg src=\"https://img.shields.io/docker/pulls/permitio/opal-client?label=Docker%20pulls\" alt=\"Docker pulls\"\u003e\n\u003c/a\u003e\n\n\u003ca href=\"https://bit.ly/permit-slack\" target=\"_blank\"\u003e\n    \u003cimg src=\"https://img.shields.io/badge/Slack%20Community-4A154B?logo=slack\u0026logoColor=white\" alt=\"Join our Slack!\"\u003e\n\u003c/a\u003e\n\u003ca href=\"https://twitter.com/intent/follow?original_referer=https%3A%2F%2Fpublish.twitter.com%2F%3FbuttonType%3DFollowButton%26query%3Dhttps%253A%252F%252Ftwitter.com%252Fpermit_io%26widget%3DButton\u0026ref_src=twsrc%5Etfw\u0026region=follow_link\u0026screen_name=permit_io\u0026tw_p=followbutton\"\u003e\u003cimg src=\"https://img.shields.io/twitter/follow/permit_io?label=Follow%20%40permit_io\u0026style=social\"\u003e\n\u003c/a\u003e\n\n## What is OPAL?\n\nOPAL is an administration layer for Policy Engines such as \u003ca target=\"_blank\" href=\"https://www.openpolicyagent.org/\"\u003eOpen Policy Agent (OPA)\u003c/a\u003e, and \u003ca target=\"_blank\" href=\"https://github.com/permitio/cedar-agent\"\u003eAWS' Cedar Agent\u003c/a\u003e detecting changes to both policy and policy data in realtime and pushing live updates to your agents. OPAL brings open-policy up to the speed needed by live applications.\n\nAs your app's data state changes (whether it's via your APIs, DBs, git, S3 or 3rd-party SaaS services), OPAL will make sure your services are always in sync with the authorization data and policy they need (and only those they need).\n\nCheck out OPAL's main site at \u003ca target=\"_blank\" href=\"https://opal.ac\"\u003eOPAL.ac\u003c/a\u003e\n\n## OPAL Use Cases\n\nOPAL is the easiest way to keep your solution's authorization layer up-to-date in realtime. It aggregates policy and data from across the field and integrates them seamlessly into the authorization layer, and is microservices and cloud-native.\n\nHere are some of the main use cases for using OPAL:\n* **End-to-End [Fine-Grained Authorization](https://www.permit.io/blog/what-is-fine-grained-authorization-fga) service** that can be used with any policy language or data store\n* [Google-Zanzibar](https://www.permit.io/blog/what-is-google-zanzibar) support for Policy as Code engines such as OPA and AWS Cedar\n* Streamline permissions in microservice architectures using [centralized policy configuration with decentralized data](https://www.permit.io/blog/best-practices-for-implementing-hybrid-cloud-security) sources and policy engines\n* Manage and automate the deployment of multiple Open Policy Agent engines in a Cloud-Native environment\n\n\u003cimg src=\"https://github.com/permitio/opal/assets/4082578/99d3dd95-a7ff-45c2-805e-3d533f8b1e8c\" alt=\"simplified\" border=\"0\"\u003e\n\nOPAL  uses a client-server stateless architecture. OPAL-Servers publish policy and data updates over a lightweight (websocket) PubSub Channel, which OPAL-clients subscribe to via topics. Upon updates, each client fetches data directly (from the source) to load it into its managed Policy Engine instance.\n\n\n### OPA + OPAL == 💜\n\nWhile OPA (Open Policy Agent) decouples policy from code in a highly-performant and elegant way, the challenge of keeping policy agents up-to-date remains.\nThis is especially true in applications, where each user interaction or API call may affect access-control decisions.\nOPAL runs in the background, supercharging policy agents and keeping them in sync with events in real time.\n\n### AWS Cedar + OPAL == 💪\n\nCedar is a very powerful policy language, which powers AWS' AVP (Amazon Verified Permissions) - but what if you want to enjoy the power of Cedar on another cloud, locally, or on premise?\nThis is where [Cedar-Agent](https://github.com/permitio/cedar-agent) and OPAL come in.\n\nThis [video](https://youtu.be/tG8jrdcc7Zo) briefly explains OPAL and how it works with OPA, and a deeper dive into it at [this OWASP DevSlop talk](https://www.youtube.com/watch?v=1_Iz0tRQCH4).\n\n## Who's Using OPAL?\nOPAL is being used as the core engine of Permit.io Authorization Service and serves in production:\n* \\\u003e 10,000 policy engines deployment\n* \\\u003e 100,000 policy changes and data synchronizations every day\n* \\\u003e 10,000,000 authorization checks every day\n\nBesides Permit, OPAL is being used in Production in **Tesla**, **Walmart**, **The NBA**, **Intel**, **Cisco**, **Live-Oak Bank**, and thousands of other development teams and companies of all sizes.\n\n## Documentation\n\n- 📃 \u0026nbsp; [Full documentation is available here](https://docs.opal.ac)\n- 💡 \u0026nbsp; [Intro to OPAL](https://docs.opal.ac/getting-started/intro)\n- 🚀 \u0026nbsp; Getting Started:\n\n  OPAL is available both as **python packages** with a built-in CLI as well as pre-built **docker images** ready-to-go.\n\n  - [Play with a live playground environment in docker-compose](https://docs.opal.ac/getting-started/quickstart/opal-playground/overview)\n  \u003c!-- - this tutorial is great for learning about OPAL core features and see what OPAL can do for you. --\u003e\n  - [Try the getting started guide for containers](https://docs.opal.ac/getting-started/running-opal/overview)\n  \u003c!-- - this tutorial will show you how to configure OPAL to your specific needs and run the official docker containers locally or in production. --\u003e\n\n  - [Check out the Helm Chart for Kubernetes](https://github.com/permitio/opal-helm-chart)\n\n- A video demo of OPAL is available [here](https://www.youtube.com/watch?v=IkR6EGY3QfM)\n\n- You can also check out this webinar and Q\u0026A about OPAL [on our YouTube channel](https://www.youtube.com/watch?v=A5adHlkmdC0\u0026t=1s)\n  \u003cbr\u003e\n\n- 💪 \u0026nbsp; TL;DR - This one command will download and run a working configuration of OPAL server and OPAL client on your machine:\n\n```\ncurl -L https://raw.githubusercontent.com/permitio/opal/master/docker/docker-compose-example.yml \\\n\u003e docker-compose.yml \u0026\u0026 docker compose up\n```\n\n\u003cp\u003e\n  \u003ca href=\"https://asciinema.org/a/409288\" target=\"_blank\"\u003e\n    \u003cimg src=\"https://asciinema.org/a/409288.svg\" /\u003e\n  \u003c/a\u003e\n\u003c/p\u003e\n\n- 🧠 \u0026nbsp; \"How-To\"s\n\n  - [How to get started with OPAL (Packages and CLI)](https://docs.opal.ac/getting-started/running-opal/as-python-package/overview)\n\n  - [How to get started with OPAL (Container Images)](https://docs.opal.ac/getting-started/running-opal/overview)\n\n  - [How to trigger Data Updates via OPAL](https://docs.opal.ac/tutorials/trigger_data_updates)\n\n  - [How to extend OPAL to fetch data from your sources with FetchProviders](https://docs.opal.ac/tutorials/write_your_own_fetch_provider)\n\n  - [How to configure OPAL (basic concepts)](https://docs.opal.ac/tutorials/configure_opal)\n\n  - [How to Use OPAL with Cedar in a Multi-Language Project](https://www.permit.io/blog/scaling-authorization-with-cedar-and-opal)\n\n- 🎨 \u0026nbsp; [Key concepts and design](https://docs.opal.ac/overview/design)\n- 🏗️ \u0026nbsp; [Architecture](https://docs.opal.ac/overview/architecture)\n\u003cbr\u003e\n\n📖 For further reading, check out our [Blog](https://io.permit.io/opal-readme-blog)\n\n## Community\n\n We would love to chat with you about OPAL. [Join our Slack community](https://io.permit.io/opal-readme-slack) to chat about authorization, open-source, realtime communication, tech, or anything else!\n\nYou can raise questions and ask for features to be added to the road-map in our [**Github discussions**](https://github.com/permitio/opal/discussions), report issues in [**Github issues**](https://github.com/permitio/opal/issues)\n\u003c/br\u003e\n\u003c/br\u003e\nIf you like our project, please consider giving us a ⭐️\n\u003c/br\u003e\n\n[![Button][join-slack-link]][badge-slack-link] \u003c/br\u003e [![Button][follow-twitter-link]][badge-twitter-link]\n\n## Contributing to OPAL\n\nWe would love for you to contribute to this project and help make it even better than it is today! 💎\n\nAs a contributor, here are the guidelines we would like you to follow:\n - [Code of Conduct](CODE_OF_CONDUCT.md)\n - [Question or Problem?](CONTRIBUTING.md#question)\n - [Issues and Bugs](CONTRIBUTING.md#issue)\n - [Feature Requests](CONTRIBUTING.md#feature)\n - [Development Guidelines](CONTRIBUTING.md#development)\n\n[join-slack-link]: https://i.ibb.co/wzrGHQL/Group-749.png\n[badge-slack-link]: https://io.permit.io/join_community\n[follow-twitter-link]: https://i.ibb.co/k4x55Lr/Group-750.png\n[badge-twitter-link]: https://twitter.com/opal_ac\n\n## There's more!\n\n- Check out [OPToggles](https://github.com/permitio/OPToggles), which enables you to create user targeted feature flags/toggles based on Open Policy managed authorization rules!\n- Check out [Cedar-Agent](https://github.com/permitio/cedar-agent), the easiest way to deploy \u0026 run AWS Cedar.\n","funding_links":[],"categories":["Python","Projects by main language","Uncategorized","后端开发框架及项目","websocket","Security \u0026 Compliance","Authorization"],"sub_categories":["python","Uncategorized","后端项目_其他","ReBAC frameworks"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpermitio%2Fopal","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpermitio%2Fopal","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpermitio%2Fopal/lists"}