Consuming Fabric

Fabric is the canonical source of truth for identity, tenancy, and authorization. All services must defer to Fabric for permission decisions, tenant state, and canonical IDs.

Frontend Usage

Use Fabric as the canonical source for:

• Organizations
• Teams
• Memberships
• Invitations
• Effective permissions

Recommended Pattern

1. Authenticate user (JWT or API key)
2. Fetch GET /v1/me to get the current principal
3. Fetch memberships, orgs, and teams
4. Fetch effective permissions for the active context
5. Cache only for UX convenience
6. Never trust frontend-only authorization

TypeScript

import { FabricClient } from "@fabric-platform/sdk";

const fabric = new FabricClient({ apiKey: "fab_xxx" });

// Get current user
const me = await fabric.getMe();

// Get their organizations
const orgs = await fabric.getMyOrganizations();

// Check a permission
const result = await fabric.checkPermission({
  resource: `organization:${orgId}`,
  action: "read",
});

Python

from fabric_platform import FabricClient

fabric = FabricClient(api_key="fab_xxx")

# Get current user
me = fabric.get_me()

# Get their organizations
orgs = fabric.get_my_organizations()

# Check a permission
result = fabric.check_permission(
    action="read",
    resource=f"organization:{org_id}",
)

Rust

use fabric_sdk::FabricClient;

let client = FabricClient::new("https://gofabric.dev", api_key)?;

// Get current user
let me = client.get_me().await?;

// Get their organizations
let orgs = client.get_my_organizations().await?;

// Check a permission
let result = client.check_permission("read", Some(&format!("organization:{org_id}"))).await?;

curl

# Get current user
curl -H 'Authorization: Bearer fab_xxx' \
  https://gofabric.dev/v1/me

# Get their organizations
curl -H 'Authorization: Bearer fab_xxx' \
  https://gofabric.dev/v1/me/organizations

# Check a permission
curl -X POST https://gofabric.dev/v1/authz/check \
  -H 'Authorization: Bearer fab_xxx' \
  -H 'content-type: application/json' \
  -d '{"resource":"organization:<org-id>","action":"read"}'

Backend Usage

Backend services should:

• Call Fabric for authz checks or embed a trusted decision token
• Use Fabric org/team IDs as canonical
• Avoid duplicating org/team/role truth
• Use API keys or service account tokens for service-to-service calls

TypeScript

// Check permission before a sensitive action
const allowed = await fabric.checkPermission({
  resource: `organization:${orgId}`,
  action: "invite",
});
if (!allowed) throw new Error("Forbidden");

Python

# Check permission before a sensitive action
allowed = fabric.check_permission("invite", resource=f"organization:{org_id}")
if not allowed:
    raise PermissionError("Forbidden")

Rust

// Check permission before a sensitive action
let allowed = client.check_permission("invite", Some(&format!("organization:{org_id}"))).await?;
if !allowed { return Err("Forbidden".into()); }

curl

# Check permission before a sensitive action
curl -X POST https://gofabric.dev/v1/authz/check \
  -H 'Authorization: Bearer fab_your_api_key' \
  -H 'content-type: application/json' \
  -d '{"resource":"organization:<org-id>","action":"invite"}'

GraphQL Alternative

Fabric also provides a GraphQL API at POST /graphql (enabled with --features graphql). GraphQL is useful when:

• You need nested data in one request (e.g., organizations with their teams and members)
• You want client-driven field selection to reduce over-fetching
• You need real-time subscriptions for workflow events via WebSocket

GraphQL uses the same authentication (JWT / API key), RBAC, ACL, and audit logging as REST. See the API Endpoints reference for the full schema and API Examples for query samples.

# One request instead of multiple REST calls
{
  me { principalId }
  myOrganizations {
    id
    name
    teams(first: 10) { id name }
  }
}

Note

File uploads remain REST-only (POST /v1/assets). The GraphQL API provides assetDownloadUrl for generating signed download URLs.

Response Envelope

Every REST response conforms to a consistent envelope structure:

Field	Description
meta	request_id, trace_id, timestamp, status, version
context	principal_id, organization_id, team_id
data	The response payload
error	Error details (if applicable)
links	Pagination and related resource links

This applies uniformly across REST, SSE, WebSockets, and webhooks. GraphQL uses its own standard response format ({ data, errors, extensions }) instead of the envelope.

SSE payloads emit serialized envelope JSON in the data field of the event.