Check permissions with the PHP SDK

Install the Permit.io PHP SDK, create a user through the Permit API, and check whether the user can perform an action. This page is for PHP backend developers. The PHP SDK, permitio/permit-php, is an API client generated with OpenAPI Generator from the Permit API specification. The SDK exposes the Permit API and the policy decision point (PDP) API as generated classes, without the permit.check() helper that the Node.js and Python SDKs provide.

Prerequisites

• PHP 7.4 or PHP 8, with the curl, json, and mbstring extensions. The SDK's composer.json requires ^7.4 || ^8.0.
• Composer.
• Your environment API key. See Get your API key.
• A Permit.io policy with a document resource and a read action. See the Quickstart.

Install the PHP SDK

Install the PHP SDK with Composer

The SDK is not published on Packagist, so Composer installs the SDK from the GitHub repository. Add the repository and the permitio/permit-php package to your composer.json:

{
  "repositories": [
    {
      "type": "vcs",
      "url": "https://github.com/permitio/permit-php.git"
    }
  ],
  "require": {
    "permitio/permit-php": "*@dev"
  }
}

Then run composer install.

Install the PHP SDK manually

Download the files from the permit-php repository, and include the SDK's autoload.php file. Replace /path/to/OpenAPIClient-php with the directory where you saved the SDK:

<?php
require_once('/path/to/OpenAPIClient-php/vendor/autoload.php');

Create a user and check a permission

The following script runs three calls:

1. APIKeysApi::getApiKeyScope() calls the Permit API to look up the project and environment of your API key.
2. UsersApi::createUser() creates the user john-smith in that project and environment.
3. AuthorizationAPIApi::isAllowedAllowedPost() asks the PDP whether john-smith can read a document in the default tenant.

The script sends the permission check to the Cloud PDP at https://cloudpdp.api.permit.io. To use a container PDP, set $pdpUrl to http://localhost:7766. Replace <Place your Permit Token here> with your environment API key.

<?php

require 'vendor/autoload.php';

use GuzzleHttp\Client;


$permitToken = '<Place your Permit Token here>';
$pdpUrl = 'https://cloudpdp.api.permit.io';
$apiUrl = 'https://api.permit.io';

$config = OpenAPI\Client\Configuration::getDefaultConfiguration()->setAccessToken($permitToken)->setHost($apiUrl);

// Get the scope of the API key
$apiInstance = new OpenAPI\Client\Api\APIKeysApi(
    new GuzzleHttp\Client(),
    $config
);
try {
    $scope = $apiInstance->getApiKeyScope();
    print_r($scope);
} catch (Exception $e) {
    echo 'Exception when calling APIKeys';
}

$usersInstance = new OpenAPI\Client\Api\UsersApi(
    new GuzzleHttp\Client(),
    $config
);

// Create user with the given data
$user_create = new \OpenAPI\Client\Model\UserCreate([
    'key' => 'john-smith',
    'email' => 'john@permit.io',
    'first_name' => 'John',
    'last_name' => 'Smith',
]);
try {
    $result = $usersInstance->createUser($scope->getProjectId(), $scope->getEnvironmentId(), $user_create);
    print_r($result);
} catch (Exception $e) {
    echo 'Exception when calling UsersApi->createUser: ', $e->getMessage(), PHP_EOL;
}


// Permit check function
$pdpConfig = OpenAPI\Client\Configuration::getDefaultConfiguration()->setAccessToken($permitToken)->setHost($pdpUrl);
$pdpInstance = new OpenAPI\Client\Api\PDP\AuthorizationAPIApi(
    new GuzzleHttp\Client(),
    $pdpConfig
);
// Create a query object - this is the data we want to check
// in this case we're checking if the user 'john-smith' is allowed to read a document
$query = new \OpenAPI\Client\Model\PDP\Query([
    'user' => ['key' => 'john-smith'],
    'action' => 'read',
    'resource' => [
        'type' => 'document',
        'tenant' => 'default'
    ]
]);
try {
    $is_allowed = $pdpInstance->isAllowedAllowedPost(
        $query,
    );

    // We'll print the result to the console
    if ($is_allowed->getAllow()) {
        echo "Permitted\n";
    } else {
        echo "Not Permitted\n";
    }
} catch (Exception $e) {
    echo 'Exception when calling PDP\AuthorizationAPIApi->isAllowedAllowedPost: ', $e->getMessage(), PHP_EOL;
}

Verify the result

Run the script with php. The script prints the API key scope, then the created user, then the check result:

• Permitted if john-smith has a role in the default tenant that grants read on document.
• Not Permitted otherwise. A user that the script creates has no roles, so the first run prints Not Permitted. Assign john-smith a role on the Directory screen of the Permit dashboard, then run the script again.

If john-smith already exists, createUser() fails and the script prints Exception when calling UsersApi->createUser: followed by the error. The permission check still runs.

Get help with the PHP SDK

• Read the SDK source and the generated API documentation in the permit-php repository.
• Ask questions in the Permit.io Slack community.

Next steps

• Sync users and assign roles.
• Check permissions with permit.check() to learn the check options that the PDP supports.
• Compare SDK features by language.