SERVICE #10 · IDENTITY FOUNDATION

Zarela Auth / Identity

The identity foundation for the Zarela platform. Establishes who someone is, manages accounts and multi-tenant centers, and powers the persona/role model every other service depends on.

Service is live. This is the API surface, not an end-user app. Apps and services integrate through the endpoints below.

Quick links

API documentation →

Swagger / OpenAPI explorer

Service descriptor →

Version, capabilities, links (JSON)

Health →

Readiness & dependency status

OIDC discovery →

Issuer, endpoints, JWKS

JWKS →

Public keys for token verification

Metrics →

Prometheus exposition

Two authorization spaces — never mixed

AuthN — Keycloak issues RS256 JWTs (Authorization Code + PKCE); every service verifies via JWKS. Required claim: uid.
AuthZ — OpenFGA answers relationship questions (member#circle, assignee#case, …) via a Policy Enforcement Point in each service. Fail-closed.
Consent — orthogonal gate owned by the Consent service; access ≠ consent. Both must pass.

Endpoints

GET /info GET /health/live GET /health/ready GET /.well-known/jwks.json GET /.well-known/openid-configuration POST /authz/check POST /authz/batch-check /admin/roles /admin/tenants /identity/* GET /metrics