Is Permit.io agent-ready?

Permit.io scores Band B on The Headless Index and rates AI-Ready on JAIRF (80.3/100). Its strongest area for agent use is headless operation; its weakest is webhooks and events.

Does Permit.io publish an OpenAPI spec?

Yes. Permit.io publishes an OpenAPI specification, scored under JAIRF v1.0.0. A published spec is what makes an API discoverable and callable by agents rather than only by developers reading docs.

What is Permit.io's Headless Index score?

Permit.io scores 74/100 on the Headless Index thesis-fit rubric and sits in Band B in the Auth & Identity category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.

03 / Scorecard / Auth & Identity

Permit.io

Headless Index

74/100

JAIRF

80.3/100

AI-Ready

Verified

AUG 20, 2026

Methodology v1 · JAIRF v1.0.0

Permit.io earns Band B in the Auth & Identity category of The Headless Index, with a thesis-fit score of 74/100 and a JAIRF rating of 80.3/100 (AI-Ready). Its strongest dimension is headless operation (18/20); its weakest scored dimension is webhooks and events (10/20). Permit.io publishes a machine-readable OpenAPI specification, which is what lets an agent discover and operate it without human glue code.

Editorial verdict

Permit.io is solidly built for programmatic consumption. The Headless Index thesis-fit score of 74/100 lands it in the upper-middle of the index, and JAIRF v1.0.0 puts it at 80.3/100 (Level 3, AI-Ready). In practice, vendors at this tier ship most of the primitives agents need, with one or two surfaces still leaning on documentation rather than discovery, and the rest of this verdict explains where Permit.io lands inside that pattern. On the API surface, the question is whether the API is the product or a layer beneath the dashboard. The control plane answers as a spec first (api.permit.io/v2/openapi.json), OpenAPI 3.1 covering 164 paths for projects, environments, resources, roles and condition sets. SDK coverage is real too, with permitio on npm at roughly 21k weekly downloads plus permit on PyPI, permit-golang and permit-java. The spec omits a servers block, which costs a generated client its base URL. An agent can drive this product across most practical workflows, with a handful of edges where documentation reading still beats schema discovery. On headless operability: This is the strongest part of the product. A Terraform provider is published and current (permitio/permit-io on the registry), @permitio/cli installs globally from npm, and the decision point runs on your own infrastructure as a Rust container (permitio/PDP) fed by OPAL, itself at 5.5k stars with a Helm chart. The dashboard becomes optional rather than central.^[1] On the MCP and agent-integration axis, which is the fastest-moving criterion in the index: Permit treats MCP as something to authorize rather than something to expose. permitio/permit-fastmcp adds policy checks to FastMCP servers and stays active, while the server that fronts Permit itself (github.com/permitio/permit-mcp) has not been touched since May 2025 and sits at three stars. Useful posture for the category, thin as a first-party tool.^[2] Event posture closes the loop: an agent that cannot react to state changes is reduced to polling. There is no outbound event catalogue. Searching the published spec for webhook paths returns nothing; what exists is pull-shaped audit history (/v2/pdps/{proj_id}/{env_id}/audit_logs plus /v2/audit-log-replay for reprocessing decisions). OPAL's pub/sub channel propagates policy and data updates to PDPs, but that is internal plumbing, not a signed event stream an agent can subscribe to. Net assessment: Permit.io can be operated by agents for the majority of practical workflows. The closest thing to a gap is webhooks and events^[3], which integrators should sanity-check against their own use case before committing. Strong fit for agent-driven use cases.

Verdict by Headless Index pipeline (auto)

// AI-drafted from the evidence layer. Editorial review pending.

Scores

Scorecard detail

Headless Index · 5 sub-criteria

API-first design intent16/20

scored

The control plane answers as a spec first (api.permit.io/v2/openapi.json), OpenAPI 3.1 covering 164 paths for projects, environments, resources, roles and condition sets. SDK coverage is real too, with permitio on npm at roughly 21k weekly downloads plus permit on PyPI, permit-golang and permit-java. The spec omits a servers block, which costs a generated client its base URL.

signals (5)

+AI review appliedReviewer: Editorial review on 2026-08-19
+OpenAPI specPublished, 263 operations
−GraphQL endpointNot discovered (5 probes; project-scoped endpoints require a real project ID)
+SDKs maintained5 (go, java, javascript, python, typescript); top by stars: permitio/permit-node (46 stars)
+npm weekly downloads23.4k across published packages; top: permitio @ 20.9k/week

cite (1)

github.sdks@2026-08-19

Headless operation18/20

scored

This is the strongest part of the product. A Terraform provider is published and current (permitio/permit-io on the registry), @permitio/cli installs globally from npm, and the decision point runs on your own infrastructure as a Rust container (permitio/PDP) fed by OPAL, itself at 5.5k stars with a Helm chart. The dashboard becomes optional rather than central.

signals (9)

+AI review appliedReviewer: Editorial review on 2026-08-19
+API operations exposed263 operations in OpenAPI spec
·Docs pages crawled0 pages (crawler: none)
·Auth schemes documentedAuth documentation page not reached by crawler
·Setup / quickstart docsNot reached by crawler
·Billing docsNot reached by crawler
·Teams / org docsNot reached by crawler
·CLI docsNot reached by crawler
·Schema / data model docsNot reached by crawler

cite (1)

ai_review_browser.topics_found@2026-08-19

MCP & agent posture14/20

scored

Permit treats MCP as something to authorize rather than something to expose. permitio/permit-fastmcp adds policy checks to FastMCP servers and stays active, while the server that fronts Permit itself (github.com/permitio/permit-mcp) has not been touched since May 2025 and sits at three stars. Useful posture for the category, thin as a first-party tool.

signals (4)

+AI review appliedReviewer: Editorial review on 2026-08-19
+Official MCP serverhttps://github.com/permitio/permit-mcp (3 stars, last commit 471 days ago)
·Community MCP servers3 community MCP repos; top by stars: https://github.com/permitio/mcp-context-forge (1 stars)
+Agent-friendly SDKs2 TS/JS SDKs available; top: permitio (20.9k/week downloads)

cite (1)

ai_review_browser.mcp@2026-08-19

Schema observability16/20

scored

One fetch gets an agent everything it needs to call the control plane (https://api.permit.io/v2/openapi.json, OpenAPI 3.1, 785KB). Policy itself is inspectable too, since the PDP evaluates Rego pulled from a git repo you control. The deduction is the missing servers array and the internal opal_data paths that leak into the public document.

signals (3)

+AI review appliedReviewer: Editorial review on 2026-08-19
+OpenAPIPublished at https://api.permit.io/v2/openapi.json (OpenAPI 3.1.0, 263 operations)
−GraphQL introspectionNo GraphQL endpoint discovered (5 probes; some vendors use project-scoped endpoints that require a real project handle)

cite (1)

ai_review_browser.schema@2026-08-19

Webhooks & events10/20

scored

There is no outbound event catalogue. Searching the published spec for webhook paths returns nothing; what exists is pull-shaped audit history (/v2/pdps/{proj_id}/{env_id}/audit_logs plus /v2/audit-log-replay for reprocessing decisions). OPAL's pub/sub channel propagates policy and data updates to PDPs, but that is internal plumbing, not a signed event stream an agent can subscribe to.

signals (2)

+AI review appliedReviewer: Editorial review on 2026-08-19
·Webhook docs pageNot reached by crawler within budget (0 pages crawled). Cannot confirm whether vendor offers webhooks.

cite (1)

ai_review_browser.pages_fetched@2026-08-19

JAIRF · 6 dimensions

FCFoundational Compliance

70/100

Structural validity, standards conformance, and parsability of the OpenAPI specification.

DXJDeveloper Experience & Tooling Compatibility

78.5/100

Documentation clarity, example coverage, response completeness, and ingestion health.

ARAXAI-Readiness & Agent Experience

86.8/100

Semantic clarity, intent expression, datatype specificity, and error standardization.

AUAgent Usability

90/100

Operational composability, complexity comfort, navigation affordances, and safety patterns.

SECSecurity

75/100

Authentication strength, transport security, secret hygiene, and OWASP risk posture.

AIDAI Discoverability

79.4/100

Descriptive richness, intent phrasing, workflow context, and registry signals.

Band rationale:B band: JAIRF=80.3 HeadlessIndex=74

04 / Embed

Show Permit.io's score on your site.

Drop a live badge into your README, footer, or marketing page. It updates automatically when we re-score, and every embed is a dofollow link back here.

Get embed code

Calibration

How THI compares to external scorers

Source	Score	Measures	Last checked
Fern Agent Score	not found	Documentation completeness and SDK shape (~22 checks)	—
CLIRank Agent Friendliness	not found	CLI readiness, docs quality, and overall agent affordances	—
Cloudflare Is It Agent Ready?	blocked	Cloudflare's manual agent-readiness heuristic per vendor URL	—
Jentic Scorecard	—	JAIRF-based scorecard requiring a public OpenAPI specification	—

THI 74 vs external median 0

No external scores available to calibrate against.

Peers in Auth & Identity

Supabase AuthB

Headless Index 74/100

SailPointB

Headless Index 74/100

ZITADELC

Headless Index 72/100

See full Auth & Identity ranking →

FAQ

Permit.io and agent readiness

Is Permit.io agent-ready?: Permit.io scores Band B on The Headless Index and rates AI-Ready on JAIRF (80.3/100). Its strongest area for agent use is headless operation; its weakest is webhooks and events.
Does Permit.io publish an OpenAPI spec?: Yes. Permit.io publishes an OpenAPI specification, scored under JAIRF v1.0.0. A published spec is what makes an API discoverable and callable by agents rather than only by developers reading docs.
What is Permit.io's Headless Index score?: Permit.io scores 74/100 on the Headless Index thesis-fit rubric and sits in Band B in the Auth & Identity category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.