{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-ciam/sdks/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["InteractiveLink","Notification","CodeBlockCustom","CodeItem"]},"type":"markdown"},"seo":{"title":"Entitlements quickstart","siteUrl":"https://developers.frontegg.com/","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"entitlements-quickstart","__idx":0},"children":["Entitlements quickstart"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use Frontegg’s ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["@frontegg/e10s-client"]}]}," package from Node.js to call your ReBAC (SpiceDB) entitlements engine: evaluate feature and permission checks, route access, fine-grained entity checks, and lookup APIs."]},{"$$mdtype":"Tag","name":"br","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"InteractiveLink","attributes":{"href":"https://github.com/frontegg/entitlements-client","target":"_blank","justifyContent":"center"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Check out the repo on GitHub"]}]},{"$$mdtype":"Tag","name":"br","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Notification","attributes":{"title":"Prerequisites","type":"attention"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Deploy and configure the ReBAC engine first using the ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/ciam/guides/authorization/entitlements/agent/setup"},"children":["Entitlements setup guide"]},". You need a reachable ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["gRPC"]}," endpoint (for example SpiceDB on port ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["50051"]},") and an ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["engine token"]},". Use ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Node.js v18+"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["@frontegg/e10s-client"]}," ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["v3.0.0+"]},". For conceptual flow and engine operations, see ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/ciam/guides/authorization/entitlements/agent/nodejs"},"children":["Run with SDK"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"install-the-client","__idx":1},"children":["Install the client"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["npm"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"npm install @frontegg/e10s-client\n"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"initialize-the-client","__idx":2},"children":["Initialize the client"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["typescript"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"typescript","header":{"controls":{"copy":{}}},"source":"import { EntitlementsClientFactory, RequestContextType } from '@frontegg/e10s-client';\n\nconst e10sClient = EntitlementsClientFactory.create({\n  engineEndpoint: 'localhost:50051',\n  engineToken: 'your-engine-token',\n});\n","lang":"typescript"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"configuration-options","__idx":3},"children":["Configuration options"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can pass optional logging and fallback behavior:"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["typescript"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"typescript","header":{"controls":{"copy":{}}},"source":"import { EntitlementsClientFactory } from '@frontegg/e10s-client';\n\nconst e10sClient = EntitlementsClientFactory.create({\n  engineEndpoint: 'localhost:50051',\n  engineToken: 'your-engine-token',\n  logging: {\n    client: customLoggingClient,\n    logResults: true,\n  },\n  fallbackConfiguration: {\n    defaultFallback: false,\n  },\n});\n","lang":"typescript"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"subject-context","__idx":4},"children":["Subject context"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Subject context describes who is acting (often derived from a Frontegg JWT). Import ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SubjectContext"]}," from ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["@frontegg/e10s-client"]}," where your version exports it."]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["typescript"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"typescript","header":{"controls":{"copy":{}}},"source":"const subjectContext = {\n  tenantId: 'my-tenant-id',\n  userId: 'my-user-id',\n  permissions: ['read', 'write'],\n  attributes: { 'my-custom-attribute': 'some-value' },\n};\n","lang":"typescript"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"query-entitlements","__idx":5},"children":["Query entitlements"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["isEntitledTo"]}," with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RequestContextType"]}," for ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["feature"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["permission"]},", or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["route"]}," checks."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"feature-entitlement","__idx":6},"children":["Feature entitlement"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["typescript"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"typescript","header":{"controls":{"copy":{}}},"source":"const e10sResult = await e10sClient.isEntitledTo(subjectContext, {\n  type: RequestContextType.Feature,\n  featureKey: 'my-cool-feature',\n});\n\nif (!e10sResult.result) {\n  console.log(`User is not entitled to \"my-cool-feature\" feature`);\n}\n","lang":"typescript"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"permission-entitlement","__idx":7},"children":["Permission entitlement"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["typescript"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"typescript","header":{"controls":{"copy":{}}},"source":"const e10sResult = await e10sClient.isEntitledTo(subjectContext, {\n  type: RequestContextType.Permission,\n  permissionKey: 'read',\n});\n\nif (!e10sResult.result) {\n  console.log(`User is not entitled to \"read\" permission`);\n}\n","lang":"typescript"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"route-entitlement","__idx":8},"children":["Route entitlement"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["typescript"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"typescript","header":{"controls":{"copy":{}}},"source":"const e10sResult = await e10sClient.isEntitledTo(subjectContext, {\n  type: RequestContextType.Route,\n  method: 'GET',\n  path: '/users',\n});\n\nif (!e10sResult.result) {\n  console.log(`User is not entitled to \"GET /users\" route`);\n}\n","lang":"typescript"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"fine-grained-authorization-with-time-based-access","__idx":9},"children":["Fine-grained authorization with time-based access"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For relationships that use the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["active_at"]}," caveat, pass ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["at"]}," as an ISO 8601 string:"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["typescript"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"typescript","header":{"controls":{"copy":{}}},"source":"const e10sResult = await e10sClient.isEntitledTo(\n  {\n    entityType: 'user',\n    key: 'some@user.com',\n  },\n  {\n    type: RequestContextType.Entity,\n    entityType: 'document',\n    key: 'README.md',\n    action: 'read',\n    at: '2026-01-15T12:00:00Z',\n  },\n);\n\nif (!e10sResult.result) {\n  console.log(`User is not allowed to read document at the specified time`);\n}\n","lang":"typescript"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Notification","attributes":{"title":"Note","type":"attention"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["at"]}," parameter accepts ISO 8601 strings (UTC, for example ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["2025-12-31T23:59:59Z"]},", or with an offset). If omitted, evaluation uses the current UTC time."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"lookup-operations","__idx":10},"children":["Lookup operations"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Lookup APIs return relationships between entities (with optional ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["at"]}," for time-based evaluation)."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"lookup-target-entities","__idx":11},"children":["Lookup target entities"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Find resources (for example documents) a subject may access for a given action:"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["typescript"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"typescript","header":{"controls":{"copy":{}}},"source":"const response = await e10sClient.lookupTargetEntities({\n  entityType: 'user',\n  entityId: 'user-123',\n  TargetEntityType: 'document',\n  action: 'read',\n  limit: 100,\n  cursor: undefined,\n  at: '2026-01-15T12:00:00Z',\n});\n\nconsole.log(`Found ${response.totalReturned} target entities`);\n\nresponse.targets.forEach((target) => {\n  console.log(`${target.TargetEntityType}:${target.TargetEntityId}`);\n});\n","lang":"typescript"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"lookup-entities","__idx":12},"children":["Lookup entities"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Find subjects (for example users) allowed to act on a given resource:"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["typescript"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"typescript","header":{"controls":{"copy":{}}},"source":"const response = await e10sClient.lookupEntities({\n  TargetEntityType: 'document',\n  TargetEntityId: 'doc-456',\n  entityType: 'user',\n  action: 'read',\n  at: '2026-01-15T12:00:00Z',\n});\n\nconsole.log(`Found ${response.totalReturned} entities`);\n\nresponse.entities.forEach((entity) => {\n  console.log(`${entity.entityType}:${entity.entityId}`);\n});\n","lang":"typescript"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"monitoring-mode","__idx":13},"children":["Monitoring mode"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When monitoring is enabled, responses include a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["monitoring"]}," flag while the entitlement outcome is still logged:"]},{"$$mdtype":"Tag","name":"CodeBlockCustom","attributes":{"tabs":["json"]},"children":[{"$$mdtype":"Tag","name":"CodeItem","attributes":{},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"result\": true,\n  \"monitoring\": true\n}\n","lang":"json"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"related-documentation","__idx":14},"children":["Related documentation"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/ciam/guides/authorization/entitlements/agent/nodejs"},"children":["Run with SDK"]}," — full engine-focused walkthrough (same content scope as this page, under Entitlements setup)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/ciam/sdks/backend/java/entitlements"},"children":["Java Entitlements"]}," — JVM client for the same engine"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://www.npmjs.com/package/@frontegg/e10s-client"},"children":["npm: @frontegg/e10s-client"]}]}]}]},"headings":[{"value":"Entitlements quickstart","id":"entitlements-quickstart","depth":2},{"value":"Install the client","id":"install-the-client","depth":3},{"value":"Initialize the client","id":"initialize-the-client","depth":3},{"value":"Configuration options","id":"configuration-options","depth":3},{"value":"Subject context","id":"subject-context","depth":3},{"value":"Query entitlements","id":"query-entitlements","depth":3},{"value":"Feature entitlement","id":"feature-entitlement","depth":4},{"value":"Permission entitlement","id":"permission-entitlement","depth":4},{"value":"Route entitlement","id":"route-entitlement","depth":4},{"value":"Fine-grained authorization with time-based access","id":"fine-grained-authorization-with-time-based-access","depth":4},{"value":"Lookup operations","id":"lookup-operations","depth":3},{"value":"Lookup target entities","id":"lookup-target-entities","depth":4},{"value":"Lookup entities","id":"lookup-entities","depth":4},{"value":"Monitoring mode","id":"monitoring-mode","depth":3},{"value":"Related documentation","id":"related-documentation","depth":3}],"frontmatter":{"seo":{"title":"Entitlements quickstart"}},"lastModified":"2026-04-05T15:16:47.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/ciam/sdks/backend/node/entitlements","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}