PDP

The Policy Decision Point (PDP) is the core Runtime component responsible for evaluating access requests against your configured Policies. It acts as the decision engine in the PlainID architecture, processing identity, resource, and contextual information to determine authorization outcomes.

You can consume this service as a Cloud or deployed as your PAA.

• Cloud PDP: Fully managed and hosted by PlainID.
• PAA PDP: Deployed as part of a self-managed PAA.

Regardless of deployment, PDP behavior remains consistent to ensure scalable, policy-driven access decisions.

This service includes a flexible configuration structure that allows you to control service behavior and optimize performance. While the default values are typically sufficient, certain use cases may benefit from customized configuration.

In Standalone PAA deployments, you can edit the JSON configuration file directly. In Kubernetes-based PAA deployments, you can inject a complete configuration map. However, the recommended method for managing configuration updates is through Environment Variables.

The Runtime service supports overriding any configuration key by using a naming convention in the extraEnv section of your values.yaml. Place your custom values in values-custom.yaml to apply changes without editing the base file.

Refer to the following sections for more information:

• Environment Variable Convention
• Common Keys
• Optimizing PDP Redis Utilization
• Enabling SSL for Runtime
• Logging Environment Variable Overrides

Environment Variable Convention

Prefix, Hierarchy, and Examples

Prefix

All Environment Variables must begin with the prefix: RTCONF_

Hierarchy

Use a double underscore (__) to separate hierarchy levels in the configuration structure. For array-based configurations, include the array index using the same syntax.

Use a single underscore (_) to separate words within a configuration key.

Examples
The following table demonstrates the naming convention and hierarchical structure for ENV_VARs.

Note: Ensure that the serviceMgmtPort is set to 80 (default)

Common Keys

Below are key Runtime settings you may want to fine-tune. For help with advanced configurations, contact PlainID Professional Services.

Optimizing PDP Redis Utilization

The PDP uses Redis to cache metadata, identity records, and responses. To reduce latency and minimize Redis load, the PDP stores metadata locally in its internal cache. The following Environment Variables let you fine-tune this behavior:

The PDP includes detailed logging for observability and performance diagnostics. Logs cover:

• Configuration overrides via Environment Variables
• Request lifecycle, including start and completion
• Authorization flow (with debug-level detail)
• Request durations and errors

JWKs Retrieval and Refresh Behavior

The PDP retrieves public keys from the configured JWKS endpoints to validate JWT tokens used in authorization flows. These JWKS URLs are defined in Scopes and Identity Templates.

To ensure continued validity of token verification, the PDP periodically refreshes the keys from the configured JWKS sources. If a refresh attempt fails, the PDP continues using the most recently successfully loaded keys and retries the refresh according to its retry policy. The only exception is the initial load, where no keys are available yet. If that attempt fails, JWT validation cannot proceed until a successful load occurs.

JWKs Runtime Load Lifecycle and Load Failures

INFO-level logs are emitted for JWKs Runtime load activity.
When a JWKs load attempt fails, the failure is logged.

"duration": 2,
"type": "pip-operator"

Logging Environment Variable Overrides

Any Environment Variable override is logged by the Runtime service. These entries appear at the Info level and follow this format:

config.json key <key-name> was overridden by <env-var-name> environment variable

Errors and validation issues related to Environment Variable syntax are also logged for easier troubleshooting.

Runtime Service Health Check

The Runtime Service GET request retrieves the PAA's runtime service health status.

K8:

Standalone:

Authorization

• None

Header

• None

Standalone Parameters

Service Response:

{
  "status": "UP",
  "details": {
    "redis": {
      "status": "UP",
      "details": {
        "read": {
          "status": "UP"
        },
        "write": {
          "status": "UP"
        }
      }
    }
  }
}

Runtime Logging API

The Runtime Logger API allows you to inspect and adjust logging levels in the Runtime service without restarting it. This ensures faster troubleshooting and dynamic log visibility during debugging sessions.

Logging Configuration

Log level changes via the API reset when the Runtime restarts. To configure them permanently:

• Helm: .Values.runtime.logLevel
• Standalone: set Runtime Environment Variables directly.

Authentication

These APIs require JWT authentication with Tenant Admin permissions.

PAA Logger Endpoints

Retrieve loggers

GET https://api.{region}.plainid.io/pip-mgmt/1.0/monitor/loggers/runtime/{PAA_ID}
GET https://api.{region}.plainid.io/pip-mgmt/1.0/monitor/loggers/runtime/{PAA_ID}/{LOGGER_NAME}

Example GET response (Runtime):

{
  "data": {
    "levels": ["OFF","TRACE","DEBUG","INFO","WARN","ERROR"],
    "loggers": {
      "com.plainid.runtime": {
        "configuredLevel": "INFO",
        "effectiveLevel": "INFO"
      },
      "root": {
        "configuredLevel": "ERROR",
        "effectiveLevel": "ERROR"
      }
    }
  }
}

Response Fields

Modify log levels

POST https://api.{region}.plainid.io/pip-mgmt/1.0/monitor/loggers/runtime/{PAA_ID}/{LOGGER_NAME}

Example Request

{
  "configuredLevel": "WARN"
}

Example Response

{
  "data": {
    "configuredLevel": "WARN",
    "effectiveLevel": "WARN"
  }
}