Cloud PDP Capabilities

Look up what the Permit Cloud PDP supports: policy models, permission check APIs, rate limits, and observability. This page is for developers who decide between the Cloud PDP and a self-hosted Edge PDP, or who hit a Cloud PDP limit.

What is the Cloud PDP?

The Cloud PDP is the managed policy decision point (PDP) that Permit.io runs in its own infrastructure. The Cloud PDP serves authorization decisions over HTTPS at https://cloudpdp.api.permit.io. It exposes the same permission check APIs as an Edge PDP (the permitio/pdp-v2 container you run), so an SDK connects to the Cloud PDP by setting the PDP URL.

Use the Cloud PDP when you don't want to run, upgrade, or scale PDP containers.

Use an Edge PDP when you need attribute-based access control (ABAC), control over network placement, or container-level configuration.

Supported policy models

Policy model	Cloud PDP	Edge PDP
Role-based access control (RBAC)	Supported	Supported
Relationship-based access control (ReBAC)	Supported	Supported
Multi-tenant authorization	Supported	Supported
Attribute-based access control (ABAC)	Not supported	Supported
Custom policy as code (custom Rego through GitOps)	Not supported	Supported

The Cloud PDP and an Edge PDP evaluate the same policy model from your Permit project. The difference is where the PDP runs and which runtime features you configure yourself.

Not supported on Cloud PDP

• ABAC: use an Edge PDP.
• Custom policy as code: use an Edge PDP with GitOps.

Supported permission check APIs

The Cloud PDP serves these permission check APIs for the policy models above. The SDKs call these endpoints for you, so most applications use SDK methods instead of HTTP requests.

Question	HTTP endpoint	Docs
Can this user perform this action on this resource?	POST /allowed	Check (permit.check())
Several checks in one request	POST /allowed/bulk	Bulk check
What can this user do?	POST /user-permissions	User permissions
Which users can perform this action on this resource?	POST /authorized_users	Authorized users

AuthZen API endpoints

The Cloud PDP implements the OpenID AuthZen Authorization API 1.0 evaluation and search endpoints:

AuthZen operation	HTTP endpoint
Access evaluation	POST /access/v1/evaluation
Bulk access evaluations	POST /access/v1/evaluations
Subject search	POST /access/v1/search/subject
Resource search	POST /access/v1/search/resource
Action search	POST /access/v1/search/action

APIs available only on an Edge PDP

The Cloud PDP doesn't serve these APIs. A call to them requires an Edge PDP:

• All-tenants check (permit.checkAllTenants() in Node.js, permit.AllTenantsCheck() in Go).
• Local APIs under /local/, such as /local/role_assignments. See List role assignments.

Rate limiting

The Cloud PDP applies rate limits to protect the shared service. You don't configure the limits.

Rate limits

The Cloud PDP counts requests per client IP address over a 1-minute window. When a client exceeds a limit, the Cloud PDP returns HTTP 429 Too Many Requests.

Endpoint	Method	Limit
/allowed/bulk	POST	200 req/min
/access/v1/evaluations	POST	200 req/min
/access/v1/search/*	POST	300 req/min
/user-permissions	POST	500 req/min
/authorized_users	POST	500 req/min
/allowed	POST	1000 req/min
/access/v1/evaluation	POST	1000 req/min
All POST requests	POST	1500 req/min
All requests	Any	3000 req/min

When a client exceeds a rate limit, the response body is:

{
  "error": "rate_limited",
  "message": "You have exceeded the rate limit. Please try again later."
}

Shared public IP addresses

The limits are set to accommodate corporate networks where many users share one public IP address. If a large deployment behind a shared IP address receives 429 responses, email support@permit.io.

Handle 429 responses

When your application receives an HTTP 429 response from the Cloud PDP:

1. Check the response body. An "error": "rate_limited" body confirms a rate limit, not an application error.
2. Retry with backoff. Wait a few seconds, then retry the request.
3. Reduce concurrency. If several services share one public IP address, reduce their parallel requests, or use /allowed/bulk to combine checks.

If your workload needs a higher request rate than these limits, run an Edge PDP. An Edge PDP has no built-in rate limits.

Observability and logs

• Decision logs: the Cloud PDP sends decision logs to Permit. They appear in the Audit Logs screen and the audit log APIs in the same format as logs from an Edge PDP.
• Debug Mode: Debug Mode adds context to decision logs. For the Cloud PDP, you enable Debug Mode through the PDP configuration of your environment with the Permit API. You don't run or configure a Cloud PDP container. See Debug Mode.

Not provided by Cloud PDP

The Cloud PDP is a managed service, so it doesn't expose these container-level features:

• A /metrics endpoint or a custom metrics sink.
• The logs forwarder (Fluent Bit) configuration.
• Access to the underlying OPA process, OPAL services, or internal logs.

To monitor Cloud PDP usage, use the Audit Logs screen, and add metrics and logging around the PDP calls in your application.

Data handling

Permit manages policy and data ingestion, replication, and storage for the Cloud PDP, and operates the service: patching, upgrades, and tuning. With an Edge PDP, you own that lifecycle: image upgrades, rollout strategy, and observability stack.

The Cloud PDP reads only the data you store in Permit: users, tenants, resource instances, relationship tuples, and role assignments. You can't configure OPAL Scopes or custom data sources for the Cloud PDP.

Use an Edge PDP if you need any of these:

• Custom external data sources through OPAL Scopes. See Use an external data source.
• Read-your-own-writes with Send Consistent Updates.
• Offline mode, backups, or control over the network path to Permit.

Cloud PDP vs Edge PDP comparison

Capability	Cloud PDP	Edge PDP (permitio/pdp-v2)
Deployment	Managed by Permit	You run and operate the container image
Policy models	RBAC, ReBAC	RBAC, ReBAC, ABAC
Multi-tenant authorization	Supported	Supported
Single and bulk checks, user permissions, authorized users	Supported	Supported
AuthZen API	Supported	Supported
All-tenants check	Not supported	Supported
Local APIs (/local/*)	Not supported	Supported
External data through OPAL Scopes	Not supported	Supported
Debug Mode configuration	Environment PDP configuration through the Permit API	Environment PDP configuration, or the PDP_DEBUG environment variable per container
Logs forwarder (Fluent Bit)	Not supported	Supported
Metrics and APM	Not supported	/metrics endpoint and Datadog APM tracing
Updates and maintenance	Operated by Permit	You manage image versions, rollouts, and maintenance
Send Consistent Updates (read-your-own-writes)	Not supported	Supported with proxy_facts_via_pdp
Rate limiting	Built in, per IP address	None built in

When to use each PDP

Use the Cloud PDP when:

• You want a managed PDP without containers to operate.
• Your policies use RBAC and ReBAC.
• You call the standard check APIs: /allowed, /allowed/bulk, /user-permissions, /authorized_users, and the AuthZen endpoints.
• Your request rate fits within the rate limits.

Use an Edge PDP when:

• You need ABAC.
• You need control over deployment topology, networks, and scaling.
• You depend on local APIs, custom data sources, read-your-own-writes, or container-level observability.

Related pages

• PDP overview: connect an SDK to the Cloud PDP or run an Edge PDP.
• Cloud PDP benchmarks: server-side latency measurements.
• PDP configuration: environment variables for an Edge PDP.