Nexus PDP feature parity
Use this page to check whether Permit Nexus PDP, a self-hosted policy decision point (PDP), supports the endpoints and capabilities your application uses before you choose Nexus PDP or move to it. The page compares Nexus PDP (permitio/nexus-pdp) with the container PDP, the Edge PDP image permitio/pdp-v2.
This comparison describes Nexus PDP as of November 2026. The set of supported capabilities changes between releases, so check this page before you upgrade.
Nexus PDP compatibility with container PDP endpoints
Nexus PDP accepts the same paths, request bodies, and response bodies as the container PDP on the endpoints that Nexus PDP implements. SDK calls to those endpoints work without other code changes when you set the SDK's PDP URL to a Nexus PDP and its token to the Nexus PDP API key.
Nexus PDP implements a subset of the container PDP's endpoints. Its capabilities match those of the managed Cloud PDP, running in your own network.
Capability comparison: container PDP and Nexus PDP
| Capability | Container PDP | Nexus PDP |
|---|---|---|
Check (POST /allowed) | Yes | Yes |
| Check with role-based access control (RBAC) policies | Yes | Yes |
| Check with relationship-based access control (ReBAC) policies, including role derivation | Yes | Yes |
| Check in a tenant (multi-tenancy) | Yes | Yes |
| Check with attribute-based access control (ABAC) policies: condition sets, user sets, and resource sets | Yes | No |
Bulk check (POST /allowed/bulk) | Yes | Yes |
User permissions (POST /user-permissions) | Yes | Yes |
Authorized users (POST /authorized_users) | Yes | Yes |
User tenants (POST /user-tenants) | Yes | Yes |
All-tenants check (POST /allowed/all-tenants) | Yes | No |
URL-based enforcement (POST /allowed_url) | Yes | No |
AuthZen access evaluation (POST /access/v1/evaluation) | Yes | Yes |
AuthZen access evaluations (POST /access/v1/evaluations) | Yes | Yes |
AuthZen subject, resource, and action search (POST /access/v1/search/subject, /resource, /action) | Yes | Yes |
AuthZen discovery (GET /.well-known/authzen-configuration) | Yes | Yes |
| Policy as code and custom Rego bundles | Yes | No |
| Local facts and read-your-own-writes | Yes | No |
Local enforcement APIs (/local/*) | Yes | No |
| Custom data sources | Yes | No |
| Kong and NGINX integrations | Yes | No |
| Offline or air-gapped boot | Yes | No |
| Decision logs sent to Permit | Yes | Yes |
| Health and readiness endpoints | Yes | Partial |
Prometheus metrics (GET /metrics) | Yes | No |
Notes on specific rows
Data filtering on Nexus PDP
Nexus PDP supports /user-permissions and /authorized_users, which answer most "which resources can this user see?" questions on both PDP types. For other approaches, see Data filtering.
AuthZen search on Nexus PDP
Nexus PDP answers all three AuthZen search endpoints the way the container PDP does. Both PDPs share these limits:
- Neither PDP paginates search results. A search returns all its results in one response, and
page.next_tokenis always empty. - On both PDPs, resource search doesn't filter by the requested action. It returns every resource of the requested type on which the subject has any permission.
Action search differs in one way. Nexus PDP matches a tenant set in the resource's properties and returns that tenant's actions. The container PDP doesn't match it yet, so on the container PDP a search that sets one returns no actions.
Health and readiness on Nexus PDP
The container PDP serves GET /health, GET /healthy, and GET /ready on port 7000. On Nexus PDP, port 7000 serves GET /health and GET /healthy, which always return 200, and has no /ready. Readiness is GET /health/ready on the management port, 7001. Point every probe at port 7001. See Health and readiness.
Booting without the control plane on Nexus PDP
Nexus PDP signs up with the control plane every time it starts, not only on its first boot. A Nexus PDP that cannot reach the control plane when it starts does not start.
A running Nexus PDP that loses the control plane keeps answering on port 7000 from its local copy. Its readiness endpoint, GET /health/ready on port 7001, returns 503 within about 30 seconds, so Kubernetes stops sending it traffic through its Service.
ABAC policies on Nexus PDP
A check against a policy that uses condition sets, user sets, or resource sets returns a deny on Nexus PDP, not an error. If your policies use ABAC, run the container PDP, or users lose access that the policy grants.
Next steps
- Permit Nexus PDP: what Nexus PDP is and when to choose it
- Nexus PDP architecture: the processes and ports inside the container
- How Nexus PDP syncs data: sync, consistency, cold start, and sizing
- Deploy Nexus PDP: storage, probes, logs, and the security model
- Nexus PDP configuration reference: environment variables