and yes, that's the API Exposed by the so called "REST API Gateway", which you can configure in your spicedb deployment

and it's not enabled by default, what you see there is just the actual gRPC API, the dashboard (which I pressume the authzed folks use to build their fancier authzed.com dashboard) and the metrics endpoint

there is a preshared token you specify when starting SpiceDB

but that's the only token you need for authn

yeah, that seems to be the case, Any document on how Rest api could configured over SpiceDB and invoked would help

@User the flag is...

right, there is a preshared token - but it's not like the API tokens offered in authzed.com right?

I can use the same with Zed , Go , Java , Python. Is the same key I need to use as Bearer token in rest api invocation ?

yes

so you add

--http-enabled

and that should enable the REST gateway

is there Bearer token required while connecting to SpiceDB via Rest api ? if yes , is that the preshared key

yes and yes

ok gr8, will surely try this out and get back , thanks for the quick response

anytime and thanks to @User for helping too!

thanks, I am able to connect to Spice DB via Rest API now! Any postman collection ? or sample on how to create the schema using Rest API ? The document says pass following in payload { "schema": "string" } How to pass on a namespace, relationship, permission? any example would help as those currently seems missing in the documentation

Sure, schema is quite clear to me, I am going through the Rest API documentation where need to know how to pass on the schema in POST I assume Rest api are also one of the recommended way going ahead for accessing the system . https://petstore.swagger.io/?url=https://raw.githubusercontent.com/authzed/authzed-go/main/proto/apidocs.swagger.json#/SchemaService/SchemaService_WriteSchema

Create Schema Payload under documentation says { "schema": "string" } an example would help how to define schema with namespace / relations / permissions Tried below in payload but it failed { "schema": "definition user {relation manager user}" }

Please take a look at https://docs.authzed.com/reference/schema-lang for the examples

I have now a not-so-simple-but-not-so-complex schema, with about 7M relations loaded. I'm seeing response times that I'm finding very slow (these are measured at spicedb egress): - P50 = 70ms - P95 = 150ms - P99 = 660ms That's with 10 pods (which I find enormous), enabling the dispatch clustering or not doesn't seem to make a huge difference, all requests with

minimizeLatency

consistency requirement. What sort of performance should I be expecting? I was seriously hoping for about 10x shorter response times on each of these 3 quantiles 🤔 Do these number seem indeed less-than-optimal, or are my expectations too high?

what does the hardware look like on each node?

We've found in the common case it's better to have fewer pods, but rather have nodes that have more cores to squeeze out more throughput. This is so less work is delegated over the network and so that the Go runtime has more cores to process things in parallel.

I'm not sure about the nodes, but each of the 10 pod has up to 200mCPU. I started out with 2 pods, each with up to 500mCPU, but got horrendous response times (multiple minutes). My local testing was showing me that SpiceDB's response time are climbing up very fast as request concurrency increases (even with as little as 10 concurrent requests), so I tried scaling out. I'm happy to try fewer pods again, though!

We discovered the sensitivity to cores following an exploration of elevated latency for Authzed.com. You can read more about it here: https://authzed.com/blog/post-mortem-feb-2022/

You can always profile your instances the same way to see where the time is being spent.

I really doubt that's my problem, this is our staging environment where we have very low traffic (<1req/s). I'd really be expecting any sort of hardware to be able to handle that

hmm, that intuition makes sense

I recommend taking a peak at a CPU profile and metrics for your datastore to see if there's any obvious time spent there.