Open Policy Agent (OPA) REST API

Name: Open Policy Agent (OPA) REST API
Brand: Open Policy Agent (OPA) REST API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityCompliancenone16 EndpointsREST

For Agents

Upload Rego policies, push policy data, and evaluate authorization queries against a running Open Policy Agent instance.

Install Jentic One Beta

Connect the Open Policy Agent (OPA) REST API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Open Policy Agent (OPA) REST API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Open Policy Agent (OPA) REST API.

Upload, retrieve, and delete Rego policy modules by ID

Push and read JSON data documents at arbitrary paths under /v1/data

Evaluate an ad-hoc Rego query against the loaded policies and data

GET STARTED

Start building with Open Policy Agent (OPA) REST API

Explore with Jentic

View OpenAPI Document

Use Cases

Patterns agents use Open Policy Agent (OPA) REST API for, with concrete tasks.

★ Externalised authorization for microservices

A microservice delegates authorization decisions to OPA by POSTing the request context to /v1/data/{path} and reading the allow result, instead of embedding rules in code. This keeps policy changes out of service deploys and centralises audit, particularly useful when many services share the same authorization model.

PUT a Rego policy under /v1/policies/rbac, then POST input to /v1/data/rbac/allow and read the result field.

Kubernetes admission control via OPA

An admission controller calls OPA to decide whether a Kubernetes resource creation is allowed, based on namespace, labels, and image registry policy. OPA's /v1/data path returns a structured allow/deny decision with reasons that the controller surfaces back to kubectl.

POST the admission review payload to /v1/data/kubernetes/admission and parse the deny array from the response.

Partial evaluation for SQL filter generation

An application uses OPA's /v1/compile endpoint to perform partial evaluation, turning a high-level access policy into a residual query that can be folded into a database WHERE clause. This pushes row-level filtering down to the data layer while keeping the rules declarative.

POST a compile request to /v1/compile with the user query and unknowns, then translate the residual into a SQL WHERE fragment.

Agent-driven policy management through Jentic

An AI platform agent that maintains authorization rules across environments calls OPA via Jentic to deploy and verify Rego policies. Jentic exposes the policy and data endpoints as discoverable tools so the agent can promote a policy from staging to production with a single tool call.

Search Jentic for 'upload a Rego policy to OPA', load the PUT /v1/policies/{id} operation, and deploy a new policy module.

Key Endpoints

16 endpoints — jentic publishes the only available openapi specification for open policy agent (opa) rest api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

PUT

/v1/policies/{id}

Upload or replace a Rego policy module

GET

/v1/policies/{id}

Retrieve a policy module by ID

POST

/v1/data/{path}

Evaluate a policy decision at a data path

POST

/v0/data/{path}

Evaluate input-only data with v0 semantics

POST

/v1/query

Run an ad-hoc Rego query

POST

/v1/compile

Run partial evaluation

GET

/health

Check instance health

PUT

/v1/policies/{id}

Upload or replace a Rego policy module

GET

/v1/policies/{id}

Retrieve a policy module by ID

POST

/v1/data/{path}

Evaluate a policy decision at a data path

POST

/v0/data/{path}

Evaluate input-only data with v0 semantics

POST

/v1/query

Run an ad-hoc Rego query

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

OPA itself has no auth in this spec, but in real deployments it sits behind a proxy or mTLS. Jentic stores the network credentials for that proxy in its encrypted vault so the agent never handles them directly.

Intent-based discovery

Agents search by intent (e.g., 'upload a Rego policy', 'evaluate an authorization decision') and Jentic returns the matching policies, data, query, or compile operation with its input schema.

Time to first call

Direct OPA integration: a day to wire policy hot-reload and decision logging. Through Jentic: under an hour for the API surface — Rego authoring and deployment topology remain separate concerns.

FAQs

Specific to using Open Policy Agent (OPA) REST API through Jentic.

Why is there no official OpenAPI spec for Open Policy Agent (OPA) REST API?

The OPA project does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Open Policy Agent (OPA) REST API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Open Policy Agent API use?

OPA's REST API exposes no built-in authentication scheme in this spec — it is intended to run as a sidecar or local service trusted by the calling process. In production, deployments typically place OPA behind mTLS or a reverse proxy. Through Jentic, network credentials for the proxy stay in the vault rather than in the agent's prompt.

Can I evaluate a Rego policy decision via the API?

Yes. POST input data to /v1/data/{path} where {path} matches the policy's package, and OPA returns the evaluated result. For ad-hoc queries that don't map to a stored policy, use POST /v1/query instead.

What are the rate limits for the Open Policy Agent API?

OPA runs in-process or as a local sidecar, so there is no central rate limit — throughput is bounded by the host's CPU and the cost of the specific Rego rules being evaluated. Profile policies under load rather than relying on a vendor quota.

How do I deploy a new Rego policy through Jentic?

Run pip install jentic, search 'upload a Rego policy to OPA', load the PUT /v1/policies/{id} operation, and execute it with the policy id and Rego module body. Jentic handles the request shaping and returns the parsed response.

What's the difference between /v0/data and /v1/data?

The v1 path expects an input field wrapping the request and returns a structured result document, while v0 takes the input directly and returns the evaluated result without a wrapper. v1 is the modern surface; v0 is retained for backward compatibility with early OPA integrations.

Open Policy Agent (OPA) REST API

Connect the Open Policy Agent (OPA) REST API to your agent

Capabilities

Start building with Open Policy Agent (OPA) REST API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs