Nexus PDP feature parity
Use this page to check whether Permit Nexus PDP, a self-hosted policy decision point (PDP), supports the endpoints and capabilities your application uses before you choose Nexus PDP or move to it. The page compares Nexus PDP (permitio/pdp-v3) with the container PDP, the Edge PDP image permitio/pdp-v2.
This comparison describes Nexus PDP as of September 2026, during early access. The set of supported capabilities changes between releases, so check this page before you upgrade.
Nexus PDP compatibility with container PDP endpoints
Nexus PDP accepts the same paths, request bodies, and response bodies as the container PDP on the endpoints that Nexus PDP implements. SDK calls to those endpoints work without code changes when you point the SDK at a Nexus PDP.
Nexus PDP implements a subset of the container PDP's endpoints. Its capabilities match those of the managed Cloud PDP, running in your own network.
Capability comparison: container PDP and Nexus PDP
| Capability | Container PDP | Nexus PDP |
|---|---|---|
Check (POST /allowed) | Yes | Yes |
| Check with role-based access control (RBAC) policies | Yes | Yes |
| Check with relationship-based access control (ReBAC) policies, including role derivation | Yes | Yes |
| Check in a tenant (multi-tenancy) | Yes | Yes |
| Check with attribute-based access control (ABAC) policies: condition sets, user sets, and resource sets | Yes | No |
Bulk check (POST /allowed/bulk) | Yes | Yes |
User permissions (POST /user-permissions) | Yes | Yes |
Authorized users (POST /authorized_users) | Yes | Yes |
All-tenants check (POST /allowed/all-tenants) | Yes | No |
URL-based enforcement (POST /allowed_url) | Yes | No |
AuthZen access evaluation (POST /access/v1/evaluation) | Yes | Yes |
AuthZen access evaluations (POST /access/v1/evaluations) | Yes | Yes |
AuthZen subject, resource, and action search (POST /access/v1/search/subject, /resource, /action) | Yes | Yes |
AuthZen discovery (GET /.well-known/authzen-configuration) | Yes | Yes |
| Policy as code and custom Rego bundles | Yes | No |
| Local facts and read-your-own-writes | Yes | No |
Local enforcement APIs (/local/*) | Yes | No |
| Custom data sources | Yes | No |
| Kong and NGINX integrations | Yes | No |
| Offline or air-gapped first boot | Yes | No |
| Decision logs sent to Permit | Yes | Yes |
| Health and readiness endpoints | Yes | Yes |
Prometheus metrics (GET /metrics) | Yes | No |
Notes on specific rows
Data filtering on Nexus PDP
Nexus PDP supports /user-permissions and /authorized_users, which answer most "which resources can this user see?" questions on both PDP types. For other approaches, see Data filtering.
Offline first boot on Nexus PDP
Nexus PDP downloads its data set from the control plane on first boot. A Nexus PDP that cannot reach the control plane on its first boot does not start. After a successful first boot, Nexus PDP keeps serving decisions from its local copy during control-plane outages.
ABAC policies on Nexus PDP
A check against a policy that uses condition sets, user sets, or resource sets returns a deny on Nexus PDP, not an error. If your policies use ABAC, run the container PDP, or users lose access that the policy grants.
Next steps
- Permit Nexus PDP: what Nexus PDP is and when to choose it
- Nexus PDP architecture: the processes and ports inside the container
- How Nexus PDP syncs data: sync, consistency, cold start, and sizing
- Deploy Nexus PDP: storage, probes, logs, and the security model
- Nexus PDP configuration reference: environment variables