Disable ReBAC to optimize PDP performance

Disable relationship-based access control (ReBAC) for one environment with a single API call. This page is for operators whose policies use only role-based (RBAC) or attribute-based (ABAC) rules and who want to reduce the work the policy decision point (PDP) does for each check.

When rebac_disabled is true in the environment settings, Permit generates the environment's policy without ReBAC support. Use this setting only when the environment has no resource roles, relations, or relationship tuples that your checks depend on.

Prerequisites

• The ID or key of your project and environment. See Get the project and environment IDs.
• An API key with permission to update the environment. See Get your API key.

Disable ReBAC for an environment

1. Send a PATCH request to https://api.permit.io/v2/projects/{proj_id}/envs/{env_id} with settings.rebac_disabled set to true. In the following command, replace <project-id>, <env-id>, and API_SECRET_KEY with your project ID or key, environment ID or key, and API key.

   curl --location --request PATCH 'https://api.permit.io/v2/projects/<project-id>/envs/<env-id>' \
   --header 'authorization: Bearer API_SECRET_KEY' \
   --header 'Content-Type: application/json' \
   --data '{
       "settings": {
           "rebac_disabled": true
       }
   }'

2. Restart every running PDP connected to the environment.

Verify the setting

Send a GET request to https://api.permit.io/v2/projects/<project-id>/envs/<env-id> with the same authorization header. The settings object in the response contains "rebac_disabled": true.

Scope and side effects

Topic	Behavior
Scope	The setting applies only to the environment in the request path. Other environments in the project keep ReBAC.
Effect on checks	The generated policy has no ReBAC rules. Permission checks that depend on resource roles or relationships stop granting access in this environment.
When the change applies	Restart running PDPs after you change the setting.
Revert	Send the same PATCH request with "rebac_disabled": false, then restart the PDPs.

Check ReBAC usage first

If the environment has resource roles or relationship tuples that grant access, disabling ReBAC removes those grants from permission checks. Users who rely on a ReBAC role lose that access.

Get help

For help with PDP performance, ask in the Permit community on Slack or email help@permit.io.

Related pages

• ReBAC policies overview
• PDP overview