From ec03c1382bc53b142e8d22203ed57ae98aa7ec18 Mon Sep 17 00:00:00 2001
From: ivanauth <ivan@authzed.com>
Date: Mon, 31 Aug 2026 15:26:30 -0400
Subject: [PATCH] fix: use authzed.v1/ prefix for FGAM permission names

The `zed backup`/`zed restore` section of restricted-api-access and the
role definitions in the Postgres FDW guide used an `authzed.api/` prefix
for FGAM permission names. That prefix does not exist: FGAM permissions
are namespaced with `authzed.v1/` (PermissionNamePrefix in the FGAM
schema), which is also what the role example further down the same
restricted-api-access page uses.

A reader following either section would grant permission names that match
nothing and get PermissionDenied with no indication of the cause.
---
 .../concepts/restricted-api-access/page.mdx   | 14 +++----
 app/authzed/guides/postgres-fdw/page.mdx      | 40 +++++++++----------
 2 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/app/authzed/concepts/restricted-api-access/page.mdx b/app/authzed/concepts/restricted-api-access/page.mdx
index 150b0037..04c0a699 100644
--- a/app/authzed/concepts/restricted-api-access/page.mdx
+++ b/app/authzed/concepts/restricted-api-access/page.mdx
@@ -120,11 +120,11 @@ On a Service Account on the **source** PS:
 ```yaml
 ## For backup
 # Exporting relationships
-authzed.api/ExportBulkRelationships
-authzed.api/BulkExportRelationships
+authzed.v1/ExportBulkRelationships
+authzed.v1/BulkExportRelationships
 
 # Dumping existing schema
-authzed.api/ReadSchema
+authzed.v1/ReadSchema
 ```
 
 On a Service Account on the **destination** PS:
@@ -133,14 +133,14 @@ On a Service Account on the **destination** PS:
 ## For restore
 ## Put these on the DESTINATION PS
 # Importing relationships
-authzed.api/ImportBulkRelationships
-authzed.api/BulkImportRelationships
+authzed.v1/ImportBulkRelationships
+authzed.v1/BulkImportRelationships
 
 # Retrying failed relationships
-authzed.api/WriteRelationships
+authzed.v1/WriteRelationships
 
 # Writing new schema
-authzed.api/WriteSchema
+authzed.v1/WriteSchema
 ```
 
 ## Example Rule CEL Expressions
diff --git a/app/authzed/guides/postgres-fdw/page.mdx b/app/authzed/guides/postgres-fdw/page.mdx
index 9a1f3145..42925931 100644
--- a/app/authzed/guides/postgres-fdw/page.mdx
+++ b/app/authzed/guides/postgres-fdw/page.mdx
@@ -76,20 +76,20 @@ Create a **Role** that defines what permissions the FDW will have.
 Create a role named `fdw-full-access` with these permissions:
 
 ```
-authzed.api/ReadSchema
-authzed.api/WriteSchema
-authzed.api/ReadRelationships
-authzed.api/WriteRelationships
-authzed.api/DeleteRelationships
-authzed.api/CheckPermission
-authzed.api/LookupResources
-authzed.api/LookupSubjects
-authzed.api/ExpandPermissionTree
-authzed.api/Watch
-authzed.api/ExportBulkRelationships
-authzed.api/BulkExportRelationships
-authzed.api/ImportBulkRelationships
-authzed.api/BulkImportRelationships
+authzed.v1/ReadSchema
+authzed.v1/WriteSchema
+authzed.v1/ReadRelationships
+authzed.v1/WriteRelationships
+authzed.v1/DeleteRelationships
+authzed.v1/CheckPermission
+authzed.v1/LookupResources
+authzed.v1/LookupSubjects
+authzed.v1/ExpandPermissionTree
+authzed.v1/Watch
+authzed.v1/ExportBulkRelationships
+authzed.v1/BulkExportRelationships
+authzed.v1/ImportBulkRelationships
+authzed.v1/BulkImportRelationships
 ```
 
 **For read-only access** (recommended for analytics/reporting):
@@ -97,12 +97,12 @@ authzed.api/BulkImportRelationships
 Create a role named `fdw-read-only` with these permissions:
 
 ```
-authzed.api/ReadSchema
-authzed.api/ReadRelationships
-authzed.api/CheckPermission
-authzed.api/LookupResources
-authzed.api/LookupSubjects
-authzed.api/ExpandPermissionTree
+authzed.v1/ReadSchema
+authzed.v1/ReadRelationships
+authzed.v1/CheckPermission
+authzed.v1/LookupResources
+authzed.v1/LookupSubjects
+authzed.v1/ExpandPermissionTree
 ```
 
 <Callout type="info">