Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Is there any way to make Keto display the requested relation tuples received via HTTP POST?

what do you mean by display? you can GET them again

I'm sorry, I meant logging the requested relation tuples. I'm trying to debug the problem I posted in <#C01340V8KSM|oathkeeper> but I don't know yet how to find out which relation tuple Oathkeeper sends to Keto as part of the authorization request. When setting `log_level=debug`  and `leak_sensitive_information=true` in the global Keto config it only tells me the authorization is forbidden but not based on which checked relation tuple.

ah I see... it should log it when using the GET check API, because then the params are in the URL query

but yeah, I agree that it would help to log the checked tuple on log level debug or trace

it just needs a log statement in this func <https://github.com/ory/keto/blob/8c5eb9dcbea2827a27187e5274025c13394001ff/internal/check/engine.go#L116-L123>
maybe you would be up for a pr?

Yep! Since `remote_json` seems to only support HTTP POST I dont think theres any other way but to directly capture network traffic. And that seems inconvenient