Is this known issue? • Ory keto 0.14.0 • Ory client php-library ory/client v1.21.1 PHP ory client library, when calling:

$permResult = Ory::permission()->checkPermission(
          'Plan',
            $planId,
            'includes_feature',
            null,
            'Feature',
            $featureCheckId,
            '',
        );

Causes error because subject_set.relation needs to be empty but because it is empty, it is not included in the request causing this error:

[400] Client error: `GET <http://keto:4466/relation-tuples/check/openapi?namespace=Plan&object=planId&relation=includes_feature&subject_set.namespace=Feature&subject_set.object=featId>` resulted in a `400 Bad Request` response:{"error":{"code":400,"status":"Bad Request","message":"incomplete subject, provide \"subject_id\" or a complete \"subjec (truncated...)

And keto log:

keto-1  | time=2025-07-30T23:44:02Z level=info msg=completed handling request http_request=map[headers:map[accept:application/json content-type:application/json user-agent:OpenAPI-Generator/1.0.0/PHP] host:keto:4466 method:GET path:/relation-tuples/check/openapi query:namespace=Plan&object=planId&relation=includes_feature&subject_set.namespace=Feature&subject_set.object=featId remote:172.19.0.37:50472 scheme:http] http_response=map[headers:map[content-type:application/json] size:133 status:400 text_status:Bad Request took:86.667µs]

When doing the same request with curl:

/ # curl -s "<http://localhost:4466/relation-tuples/check/openapi>" \
>   -G \
>   --data-urlencode "namespace=Plan" \
>   --data-urlencode "object=planId" \
>   --data-urlencode "relation=includes_feature" \
>   --data-urlencode "subject_set.namespace=Feature" \
>   --data-urlencode "subject_set.object=featId" \
>   --data-urlencode "subject_set.relation="
{"allowed":true}

It works, but:

# curl -s "<http://localhost:4466/relation-tuples/check/openapi>" \
>    -G \
>    --data-urlencode "namespace=Plan" \
>    --data-urlencode "object=planId" \
>    --data-urlencode "relation=includes_feature" \
>    --data-urlencode "subject_set.namespace=Feature" \
>    --data-urlencode "subject_set.object=featId" 
{"error":{"code":400,"status":"Bad Request","message":"incomplete subject, provide \"subject_id\" or a complete \"subject_set.*\""}}

works just like the PHP ory/client library. So, my conclusion: PHP ory/client library is not working correctly with the check permissions call when using subject_set.realation value "" (emtpy string)

Can you open a issue in the SDK repo?

I can

Ah. Still let me just notify internally and see what comes of it. Auto generation of SDKs can surface things like this. If you want to mirror it to the SDK repo that would be helpful.

Yes, mirrored it to SDK repo now... I just understood that SDK repo == the php sdk repo