snapshot of https://github.com/ory/keto.git (master, 2026-09-16; blobs > 131072B omitted)

gen/go/ory/keto/relation_tuples/v1alpha2/check_service.pb.go

@@ -0,0 +1,594 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: ory/keto/relation_tuples/v1alpha2/check_service.proto
+
+package relationtuples
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// The request for a CheckService.Check RPC.
+// Checks whether a specific subject is related to an object.
+type CheckRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The namespace to evaluate the check.
+	//
+	// Note: If you use the expand-API and the check
+	// evaluates a RelationTuple specifying a SubjectSet as
+	// subject or due to a rewrite rule in a namespace config
+	// this check request may involve other namespaces automatically.
+	//
+	// Deprecated: Marked as deprecated in ory/keto/relation_tuples/v1alpha2/check_service.proto.
+	Namespace string `protobuf:"bytes,1,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	// The related object in this check.
+	//
+	// Deprecated: Marked as deprecated in ory/keto/relation_tuples/v1alpha2/check_service.proto.
+	Object string `protobuf:"bytes,2,opt,name=object,proto3" json:"object,omitempty"`
+	// The relation between the Object and the Subject.
+	//
+	// Deprecated: Marked as deprecated in ory/keto/relation_tuples/v1alpha2/check_service.proto.
+	Relation string `protobuf:"bytes,3,opt,name=relation,proto3" json:"relation,omitempty"`
+	// The related subject in this check.
+	//
+	// Deprecated: Marked as deprecated in ory/keto/relation_tuples/v1alpha2/check_service.proto.
+	Subject *Subject       `protobuf:"bytes,4,opt,name=subject,proto3" json:"subject,omitempty"`
+	Tuple   *RelationTuple `protobuf:"bytes,8,opt,name=tuple,proto3" json:"tuple,omitempty"`
+	// This field is not implemented yet and has no effect.
+	// <!--
+	// Set this field to `true` in case your application
+	// needs to authorize depending on up to date ACLs,
+	// also called a "content-change check".
+	//
+	// If set to `true` the `snaptoken` field is ignored,
+	// the check is evaluated at the latest snapshot
+	// (globally consistent) and the response includes a
+	// snaptoken for clients to store along with object
+	// contents that can be used for subsequent checks
+	// of the same content version.
+	//
+	// Example use case:
+	//   - You need to authorize a user to modify/delete some resource
+	//     and it is unacceptable that if the permission to do that had
+	//     just been revoked some seconds ago so that the change had not
+	//     yet been fully replicated to all availability zones.
+	//
+	// -->
+	Latest bool `protobuf:"varint,5,opt,name=latest,proto3" json:"latest,omitempty"`
+	// This field is not implemented yet and has no effect.
+	// <!--
+	// Optional. Like reads, a check is always evaluated at a
+	// consistent snapshot no earlier than the given snaptoken.
+	//
+	// Leave this field blank if you want to evaluate the check
+	// based on eventually consistent ACLs, benefiting from very
+	// low latency, but possibly slightly stale results.
+	//
+	// If the specified token is too old and no longer known,
+	// the server falls back as if no snaptoken had been specified.
+	//
+	// If not specified the server tries to evaluate the check
+	// on the best snapshot version where it is very likely that
+	// ACLs had already been replicated to all availability zones.
+	// -->
+	Snaptoken string `protobuf:"bytes,6,opt,name=snaptoken,proto3" json:"snaptoken,omitempty"`
+	// The maximum depth to search for a relation.
+	//
+	// If the value is less than 1 or greater than the global
+	// max-depth then the global max-depth will be used instead.
+	MaxDepth      int32 `protobuf:"varint,7,opt,name=max_depth,json=maxDepth,proto3" json:"max_depth,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CheckRequest) Reset() {
+	*x = CheckRequest{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_check_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CheckRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckRequest) ProtoMessage() {}
+
+func (x *CheckRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_check_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckRequest.ProtoReflect.Descriptor instead.
+func (*CheckRequest) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_check_service_proto_rawDescGZIP(), []int{0}
+}
+
+// Deprecated: Marked as deprecated in ory/keto/relation_tuples/v1alpha2/check_service.proto.
+func (x *CheckRequest) GetNamespace() string {
+	if x != nil {
+		return x.Namespace
+	}
+	return ""
+}
+
+// Deprecated: Marked as deprecated in ory/keto/relation_tuples/v1alpha2/check_service.proto.
+func (x *CheckRequest) GetObject() string {
+	if x != nil {
+		return x.Object
+	}
+	return ""
+}
+
+// Deprecated: Marked as deprecated in ory/keto/relation_tuples/v1alpha2/check_service.proto.
+func (x *CheckRequest) GetRelation() string {
+	if x != nil {
+		return x.Relation
+	}
+	return ""
+}
+
+// Deprecated: Marked as deprecated in ory/keto/relation_tuples/v1alpha2/check_service.proto.
+func (x *CheckRequest) GetSubject() *Subject {
+	if x != nil {
+		return x.Subject
+	}
+	return nil
+}
+
+func (x *CheckRequest) GetTuple() *RelationTuple {
+	if x != nil {
+		return x.Tuple
+	}
+	return nil
+}
+
+func (x *CheckRequest) GetLatest() bool {
+	if x != nil {
+		return x.Latest
+	}
+	return false
+}
+
+func (x *CheckRequest) GetSnaptoken() string {
+	if x != nil {
+		return x.Snaptoken
+	}
+	return ""
+}
+
+func (x *CheckRequest) GetMaxDepth() int32 {
+	if x != nil {
+		return x.MaxDepth
+	}
+	return 0
+}
+
+// The response for a CheckService.Check rpc.
+type CheckResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Whether the specified subject (id)
+	// is related to the requested object.
+	//
+	// It is false by default if no ACL matches.
+	Allowed bool `protobuf:"varint,1,opt,name=allowed,proto3" json:"allowed,omitempty"`
+	// This field is not implemented yet and has no effect.
+	// <!--
+	// The last known snapshot token ONLY specified if
+	// the request had not specified a snaptoken,
+	// since this performed a "content-change request"
+	// and consistently fetched the last known snapshot token.
+	//
+	// This field is not set if the request had specified a snaptoken!
+	//
+	// If set, clients should cache and use this token
+	// for subsequent requests to have minimal latency,
+	// but allow slightly stale responses (only some milliseconds or seconds).
+	// -->
+	Snaptoken     string `protobuf:"bytes,2,opt,name=snaptoken,proto3" json:"snaptoken,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CheckResponse) Reset() {
+	*x = CheckResponse{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_check_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CheckResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckResponse) ProtoMessage() {}
+
+func (x *CheckResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_check_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckResponse.ProtoReflect.Descriptor instead.
+func (*CheckResponse) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_check_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *CheckResponse) GetAllowed() bool {
+	if x != nil {
+		return x.Allowed
+	}
+	return false
+}
+
+func (x *CheckResponse) GetSnaptoken() string {
+	if x != nil {
+		return x.Snaptoken
+	}
+	return ""
+}
+
+// The response for an individual check in the CheckService.BatchCheck rpc.
+type CheckResponseWithError struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Whether the specified subject (id)
+	// is related to the requested object.
+	//
+	// It is false by default if no ACL matches.
+	Allowed bool `protobuf:"varint,1,opt,name=allowed,proto3" json:"allowed,omitempty"`
+	// If there was an error checking the tuple,
+	// this will contain the error message.
+	//
+	// If the check was performed successfully, this will be empty.
+	Error string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
+	// This field is not implemented yet and has no effect.
+	// <!--
+	// The last known snapshot token ONLY specified if
+	// the request had not specified a snaptoken,
+	// since this performed a "content-change request"
+	// and consistently fetched the last known snapshot token.
+	//
+	// This field is not set if the request had specified a snaptoken!
+	//
+	// If set, clients should cache and use this token
+	// for subsequent requests to have minimal latency,
+	// but allow slightly stale responses (only some milliseconds or seconds).
+	// -->
+	Snaptoken     string `protobuf:"bytes,3,opt,name=snaptoken,proto3" json:"snaptoken,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CheckResponseWithError) Reset() {
+	*x = CheckResponseWithError{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_check_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CheckResponseWithError) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckResponseWithError) ProtoMessage() {}
+
+func (x *CheckResponseWithError) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_check_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckResponseWithError.ProtoReflect.Descriptor instead.
+func (*CheckResponseWithError) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_check_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *CheckResponseWithError) GetAllowed() bool {
+	if x != nil {
+		return x.Allowed
+	}
+	return false
+}
+
+func (x *CheckResponseWithError) GetError() string {
+	if x != nil {
+		return x.Error
+	}
+	return ""
+}
+
+func (x *CheckResponseWithError) GetSnaptoken() string {
+	if x != nil {
+		return x.Snaptoken
+	}
+	return ""
+}
+
+// The request for a CheckService.BatchCheck RPC.
+// Checks a batch of relations.
+type BatchCheckRequest struct {
+	state  protoimpl.MessageState `protogen:"open.v1"`
+	Tuples []*RelationTuple       `protobuf:"bytes,1,rep,name=tuples,proto3" json:"tuples,omitempty"`
+	// This field is not implemented yet and has no effect.
+	// <!--
+	// Set this field to `true` in case your application
+	// needs to authorize depending on up to date ACLs,
+	// also called a "content-change check".
+	//
+	// If set to `true` the `snaptoken` field is ignored,
+	// the check is evaluated at the latest snapshot
+	// (globally consistent) and the response includes a
+	// snaptoken for clients to store along with object
+	// contents that can be used for subsequent checks
+	// of the same content version.
+	//
+	// Example use case:
+	//   - You need to authorize a user to modify/delete some resource
+	//     and it is unacceptable that if the permission to do that had
+	//     just been revoked some seconds ago so that the change had not
+	//     yet been fully replicated to all availability zones.
+	//
+	// -->
+	Latest bool `protobuf:"varint,2,opt,name=latest,proto3" json:"latest,omitempty"`
+	// This field is not implemented yet and has no effect.
+	// <!--
+	// Optional. Like reads, a check is always evaluated at a
+	// consistent snapshot no earlier than the given snaptoken.
+	//
+	// Leave this field blank if you want to evaluate the check
+	// based on eventually consistent ACLs, benefiting from very
+	// low latency, but possibly slightly stale results.
+	//
+	// If the specified token is too old and no longer known,
+	// the server falls back as if no snaptoken had been specified.
+	//
+	// If not specified the server tries to evaluate the check
+	// on the best snapshot version where it is very likely that
+	// ACLs had already been replicated to all availability zones.
+	// -->
+	Snaptoken string `protobuf:"bytes,3,opt,name=snaptoken,proto3" json:"snaptoken,omitempty"`
+	// The maximum depth to search for a relation.
+	//
+	// If the value is less than 1 or greater than the global
+	// max-depth then the global max-depth will be used instead.
+	MaxDepth      int32 `protobuf:"varint,4,opt,name=max_depth,json=maxDepth,proto3" json:"max_depth,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BatchCheckRequest) Reset() {
+	*x = BatchCheckRequest{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_check_service_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BatchCheckRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BatchCheckRequest) ProtoMessage() {}
+
+func (x *BatchCheckRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_check_service_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BatchCheckRequest.ProtoReflect.Descriptor instead.
+func (*BatchCheckRequest) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_check_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *BatchCheckRequest) GetTuples() []*RelationTuple {
+	if x != nil {
+		return x.Tuples
+	}
+	return nil
+}
+
+func (x *BatchCheckRequest) GetLatest() bool {
+	if x != nil {
+		return x.Latest
+	}
+	return false
+}
+
+func (x *BatchCheckRequest) GetSnaptoken() string {
+	if x != nil {
+		return x.Snaptoken
+	}
+	return ""
+}
+
+func (x *BatchCheckRequest) GetMaxDepth() int32 {
+	if x != nil {
+		return x.MaxDepth
+	}
+	return 0
+}
+
+// The response for a CheckService.BatchCheck rpc.
+type BatchCheckResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The results of the batch check. The order of these
+	// results will match the order of the input.
+	Results       []*CheckResponseWithError `protobuf:"bytes,1,rep,name=results,proto3" json:"results,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BatchCheckResponse) Reset() {
+	*x = BatchCheckResponse{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_check_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BatchCheckResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BatchCheckResponse) ProtoMessage() {}
+
+func (x *BatchCheckResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_check_service_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BatchCheckResponse.ProtoReflect.Descriptor instead.
+func (*BatchCheckResponse) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_check_service_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *BatchCheckResponse) GetResults() []*CheckResponseWithError {
+	if x != nil {
+		return x.Results
+	}
+	return nil
+}
+
+var File_ory_keto_relation_tuples_v1alpha2_check_service_proto protoreflect.FileDescriptor
+
+const file_ory_keto_relation_tuples_v1alpha2_check_service_proto_rawDesc = "" +
+	"\n" +
+	"5ory/keto/relation_tuples/v1alpha2/check_service.proto\x12!ory.keto.relation_tuples.v1alpha2\x1a7ory/keto/relation_tuples/v1alpha2/relation_tuples.proto\"\xd1\x02\n" +
+	"\fCheckRequest\x12 \n" +
+	"\tnamespace\x18\x01 \x01(\tB\x02\x18\x01R\tnamespace\x12\x1a\n" +
+	"\x06object\x18\x02 \x01(\tB\x02\x18\x01R\x06object\x12\x1e\n" +
+	"\brelation\x18\x03 \x01(\tB\x02\x18\x01R\brelation\x12H\n" +
+	"\asubject\x18\x04 \x01(\v2*.ory.keto.relation_tuples.v1alpha2.SubjectB\x02\x18\x01R\asubject\x12F\n" +
+	"\x05tuple\x18\b \x01(\v20.ory.keto.relation_tuples.v1alpha2.RelationTupleR\x05tuple\x12\x16\n" +
+	"\x06latest\x18\x05 \x01(\bR\x06latest\x12\x1c\n" +
+	"\tsnaptoken\x18\x06 \x01(\tR\tsnaptoken\x12\x1b\n" +
+	"\tmax_depth\x18\a \x01(\x05R\bmaxDepth\"G\n" +
+	"\rCheckResponse\x12\x18\n" +
+	"\aallowed\x18\x01 \x01(\bR\aallowed\x12\x1c\n" +
+	"\tsnaptoken\x18\x02 \x01(\tR\tsnaptoken\"f\n" +
+	"\x16CheckResponseWithError\x12\x18\n" +
+	"\aallowed\x18\x01 \x01(\bR\aallowed\x12\x14\n" +
+	"\x05error\x18\x02 \x01(\tR\x05error\x12\x1c\n" +
+	"\tsnaptoken\x18\x03 \x01(\tR\tsnaptoken\"\xb0\x01\n" +
+	"\x11BatchCheckRequest\x12H\n" +
+	"\x06tuples\x18\x01 \x03(\v20.ory.keto.relation_tuples.v1alpha2.RelationTupleR\x06tuples\x12\x16\n" +
+	"\x06latest\x18\x02 \x01(\bR\x06latest\x12\x1c\n" +
+	"\tsnaptoken\x18\x03 \x01(\tR\tsnaptoken\x12\x1b\n" +
+	"\tmax_depth\x18\x04 \x01(\x05R\bmaxDepth\"i\n" +
+	"\x12BatchCheckResponse\x12S\n" +
+	"\aresults\x18\x01 \x03(\v29.ory.keto.relation_tuples.v1alpha2.CheckResponseWithErrorR\aresults2\xf5\x01\n" +
+	"\fCheckService\x12j\n" +
+	"\x05Check\x12/.ory.keto.relation_tuples.v1alpha2.CheckRequest\x1a0.ory.keto.relation_tuples.v1alpha2.CheckResponse\x12y\n" +
+	"\n" +
+	"BatchCheck\x124.ory.keto.relation_tuples.v1alpha2.BatchCheckRequest\x1a5.ory.keto.relation_tuples.v1alpha2.BatchCheckResponseB\xaa\x02\n" +
+	"%com.ory.keto.relation_tuples.v1alpha2B\x11CheckServiceProtoP\x01ZKgithub.com/ory/keto/gen/go/ory/keto/relation_tuples/v1alpha2;relationtuples\xa2\x02\x03OKR\xaa\x02 Ory.Keto.RelationTuples.V1alpha2\xca\x02 Ory\\Keto\\RelationTuples\\V1alpha2\xe2\x02,Ory\\Keto\\RelationTuples\\V1alpha2\\GPBMetadata\xea\x02#Ory::Keto::RelationTuples::V1alpha2b\x06proto3"
+
+var (
+	file_ory_keto_relation_tuples_v1alpha2_check_service_proto_rawDescOnce sync.Once
+	file_ory_keto_relation_tuples_v1alpha2_check_service_proto_rawDescData []byte
+)
+
+func file_ory_keto_relation_tuples_v1alpha2_check_service_proto_rawDescGZIP() []byte {
+	file_ory_keto_relation_tuples_v1alpha2_check_service_proto_rawDescOnce.Do(func() {
+		file_ory_keto_relation_tuples_v1alpha2_check_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_ory_keto_relation_tuples_v1alpha2_check_service_proto_rawDesc), len(file_ory_keto_relation_tuples_v1alpha2_check_service_proto_rawDesc)))
+	})
+	return file_ory_keto_relation_tuples_v1alpha2_check_service_proto_rawDescData
+}
+
+var file_ory_keto_relation_tuples_v1alpha2_check_service_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
+var file_ory_keto_relation_tuples_v1alpha2_check_service_proto_goTypes = []any{
+	(*CheckRequest)(nil),           // 0: ory.keto.relation_tuples.v1alpha2.CheckRequest
+	(*CheckResponse)(nil),          // 1: ory.keto.relation_tuples.v1alpha2.CheckResponse
+	(*CheckResponseWithError)(nil), // 2: ory.keto.relation_tuples.v1alpha2.CheckResponseWithError
+	(*BatchCheckRequest)(nil),      // 3: ory.keto.relation_tuples.v1alpha2.BatchCheckRequest
+	(*BatchCheckResponse)(nil),     // 4: ory.keto.relation_tuples.v1alpha2.BatchCheckResponse
+	(*Subject)(nil),                // 5: ory.keto.relation_tuples.v1alpha2.Subject
+	(*RelationTuple)(nil),          // 6: ory.keto.relation_tuples.v1alpha2.RelationTuple
+}
+var file_ory_keto_relation_tuples_v1alpha2_check_service_proto_depIdxs = []int32{
+	5, // 0: ory.keto.relation_tuples.v1alpha2.CheckRequest.subject:type_name -> ory.keto.relation_tuples.v1alpha2.Subject
+	6, // 1: ory.keto.relation_tuples.v1alpha2.CheckRequest.tuple:type_name -> ory.keto.relation_tuples.v1alpha2.RelationTuple
+	6, // 2: ory.keto.relation_tuples.v1alpha2.BatchCheckRequest.tuples:type_name -> ory.keto.relation_tuples.v1alpha2.RelationTuple
+	2, // 3: ory.keto.relation_tuples.v1alpha2.BatchCheckResponse.results:type_name -> ory.keto.relation_tuples.v1alpha2.CheckResponseWithError
+	0, // 4: ory.keto.relation_tuples.v1alpha2.CheckService.Check:input_type -> ory.keto.relation_tuples.v1alpha2.CheckRequest
+	3, // 5: ory.keto.relation_tuples.v1alpha2.CheckService.BatchCheck:input_type -> ory.keto.relation_tuples.v1alpha2.BatchCheckRequest
+	1, // 6: ory.keto.relation_tuples.v1alpha2.CheckService.Check:output_type -> ory.keto.relation_tuples.v1alpha2.CheckResponse
+	4, // 7: ory.keto.relation_tuples.v1alpha2.CheckService.BatchCheck:output_type -> ory.keto.relation_tuples.v1alpha2.BatchCheckResponse
+	6, // [6:8] is the sub-list for method output_type
+	4, // [4:6] is the sub-list for method input_type
+	4, // [4:4] is the sub-list for extension type_name
+	4, // [4:4] is the sub-list for extension extendee
+	0, // [0:4] is the sub-list for field type_name
+}
+
+func init() { file_ory_keto_relation_tuples_v1alpha2_check_service_proto_init() }
+func file_ory_keto_relation_tuples_v1alpha2_check_service_proto_init() {
+	if File_ory_keto_relation_tuples_v1alpha2_check_service_proto != nil {
+		return
+	}
+	file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_ory_keto_relation_tuples_v1alpha2_check_service_proto_rawDesc), len(file_ory_keto_relation_tuples_v1alpha2_check_service_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   5,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_ory_keto_relation_tuples_v1alpha2_check_service_proto_goTypes,
+		DependencyIndexes: file_ory_keto_relation_tuples_v1alpha2_check_service_proto_depIdxs,
+		MessageInfos:      file_ory_keto_relation_tuples_v1alpha2_check_service_proto_msgTypes,
+	}.Build()
+	File_ory_keto_relation_tuples_v1alpha2_check_service_proto = out.File
+	file_ory_keto_relation_tuples_v1alpha2_check_service_proto_goTypes = nil
+	file_ory_keto_relation_tuples_v1alpha2_check_service_proto_depIdxs = nil
+}

gen/go/ory/keto/relation_tuples/v1alpha2/check_service_grpc.pb.go

@@ -0,0 +1,174 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             (unknown)
+// source: ory/keto/relation_tuples/v1alpha2/check_service.proto
+
+package relationtuples
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	CheckService_Check_FullMethodName      = "/ory.keto.relation_tuples.v1alpha2.CheckService/Check"
+	CheckService_BatchCheck_FullMethodName = "/ory.keto.relation_tuples.v1alpha2.CheckService/BatchCheck"
+)
+
+// CheckServiceClient is the client API for CheckService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// The service that performs authorization checks
+// based on the stored Access Control Lists.
+//
+// This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+type CheckServiceClient interface {
+	// Performs an authorization check.
+	Check(ctx context.Context, in *CheckRequest, opts ...grpc.CallOption) (*CheckResponse, error)
+	BatchCheck(ctx context.Context, in *BatchCheckRequest, opts ...grpc.CallOption) (*BatchCheckResponse, error)
+}
+
+type checkServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewCheckServiceClient(cc grpc.ClientConnInterface) CheckServiceClient {
+	return &checkServiceClient{cc}
+}
+
+func (c *checkServiceClient) Check(ctx context.Context, in *CheckRequest, opts ...grpc.CallOption) (*CheckResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CheckResponse)
+	err := c.cc.Invoke(ctx, CheckService_Check_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *checkServiceClient) BatchCheck(ctx context.Context, in *BatchCheckRequest, opts ...grpc.CallOption) (*BatchCheckResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(BatchCheckResponse)
+	err := c.cc.Invoke(ctx, CheckService_BatchCheck_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// CheckServiceServer is the server API for CheckService service.
+// All implementations must embed UnimplementedCheckServiceServer
+// for forward compatibility.
+//
+// The service that performs authorization checks
+// based on the stored Access Control Lists.
+//
+// This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+type CheckServiceServer interface {
+	// Performs an authorization check.
+	Check(context.Context, *CheckRequest) (*CheckResponse, error)
+	BatchCheck(context.Context, *BatchCheckRequest) (*BatchCheckResponse, error)
+	mustEmbedUnimplementedCheckServiceServer()
+}
+
+// UnimplementedCheckServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedCheckServiceServer struct{}
+
+func (UnimplementedCheckServiceServer) Check(context.Context, *CheckRequest) (*CheckResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method Check not implemented")
+}
+func (UnimplementedCheckServiceServer) BatchCheck(context.Context, *BatchCheckRequest) (*BatchCheckResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method BatchCheck not implemented")
+}
+func (UnimplementedCheckServiceServer) mustEmbedUnimplementedCheckServiceServer() {}
+func (UnimplementedCheckServiceServer) testEmbeddedByValue()                      {}
+
+// UnsafeCheckServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to CheckServiceServer will
+// result in compilation errors.
+type UnsafeCheckServiceServer interface {
+	mustEmbedUnimplementedCheckServiceServer()
+}
+
+func RegisterCheckServiceServer(s grpc.ServiceRegistrar, srv CheckServiceServer) {
+	// If the following call panics, it indicates UnimplementedCheckServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&CheckService_ServiceDesc, srv)
+}
+
+func _CheckService_Check_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CheckRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CheckServiceServer).Check(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: CheckService_Check_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CheckServiceServer).Check(ctx, req.(*CheckRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _CheckService_BatchCheck_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(BatchCheckRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CheckServiceServer).BatchCheck(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: CheckService_BatchCheck_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CheckServiceServer).BatchCheck(ctx, req.(*BatchCheckRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// CheckService_ServiceDesc is the grpc.ServiceDesc for CheckService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var CheckService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "ory.keto.relation_tuples.v1alpha2.CheckService",
+	HandlerType: (*CheckServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Check",
+			Handler:    _CheckService_Check_Handler,
+		},
+		{
+			MethodName: "BatchCheck",
+			Handler:    _CheckService_BatchCheck_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "ory/keto/relation_tuples/v1alpha2/check_service.proto",
+}

gen/go/ory/keto/relation_tuples/v1alpha2/expand_service.pb.go

@@ -0,0 +1,388 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: ory/keto/relation_tuples/v1alpha2/expand_service.proto
+
+package relationtuples
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type NodeType int32
+
+const (
+	NodeType_NODE_TYPE_UNSPECIFIED NodeType = 0
+	// This node expands to a union of all children.
+	NodeType_NODE_TYPE_UNION NodeType = 1
+	// Not implemented yet.
+	NodeType_NODE_TYPE_EXCLUSION NodeType = 2
+	// Not implemented yet.
+	NodeType_NODE_TYPE_INTERSECTION NodeType = 3
+	// This node is a leaf and contains no children.
+	// Its subject is a `SubjectID` unless `max_depth` was reached.
+	NodeType_NODE_TYPE_LEAF NodeType = 4
+)
+
+// Enum value maps for NodeType.
+var (
+	NodeType_name = map[int32]string{
+		0: "NODE_TYPE_UNSPECIFIED",
+		1: "NODE_TYPE_UNION",
+		2: "NODE_TYPE_EXCLUSION",
+		3: "NODE_TYPE_INTERSECTION",
+		4: "NODE_TYPE_LEAF",
+	}
+	NodeType_value = map[string]int32{
+		"NODE_TYPE_UNSPECIFIED":  0,
+		"NODE_TYPE_UNION":        1,
+		"NODE_TYPE_EXCLUSION":    2,
+		"NODE_TYPE_INTERSECTION": 3,
+		"NODE_TYPE_LEAF":         4,
+	}
+)
+
+func (x NodeType) Enum() *NodeType {
+	p := new(NodeType)
+	*p = x
+	return p
+}
+
+func (x NodeType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (NodeType) Descriptor() protoreflect.EnumDescriptor {
+	return file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_enumTypes[0].Descriptor()
+}
+
+func (NodeType) Type() protoreflect.EnumType {
+	return &file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_enumTypes[0]
+}
+
+func (x NodeType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use NodeType.Descriptor instead.
+func (NodeType) EnumDescriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_rawDescGZIP(), []int{0}
+}
+
+// The request for an ExpandService.Expand RPC.
+// Expands the given subject set.
+type ExpandRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The subject to expand.
+	Subject *Subject `protobuf:"bytes,1,opt,name=subject,proto3" json:"subject,omitempty"`
+	// The maximum depth of tree to build.
+	//
+	// If the value is less than 1 or greater than the global
+	// max-depth then the global max-depth will be used instead.
+	//
+	// It is important to set this parameter to a meaningful
+	// value. Ponder how deep you really want to display this.
+	MaxDepth int32 `protobuf:"varint,2,opt,name=max_depth,json=maxDepth,proto3" json:"max_depth,omitempty"`
+	// This field is not implemented yet and has no effect.
+	// <!--
+	// Optional. Like reads, a expand is always evaluated at a
+	// consistent snapshot no earlier than the given snaptoken.
+	//
+	// Leave this field blank if you want to expand
+	// based on eventually consistent ACLs, benefiting from very
+	// low latency, but possibly slightly stale results.
+	//
+	// If the specified token is too old and no longer known,
+	// the server falls back as if no snaptoken had been specified.
+	//
+	// If not specified the server tries to build the tree
+	// on the best snapshot version where it is very likely that
+	// ACLs had already been replicated to all availability zones.
+	// -->
+	Snaptoken     string `protobuf:"bytes,3,opt,name=snaptoken,proto3" json:"snaptoken,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExpandRequest) Reset() {
+	*x = ExpandRequest{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExpandRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExpandRequest) ProtoMessage() {}
+
+func (x *ExpandRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExpandRequest.ProtoReflect.Descriptor instead.
+func (*ExpandRequest) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ExpandRequest) GetSubject() *Subject {
+	if x != nil {
+		return x.Subject
+	}
+	return nil
+}
+
+func (x *ExpandRequest) GetMaxDepth() int32 {
+	if x != nil {
+		return x.MaxDepth
+	}
+	return 0
+}
+
+func (x *ExpandRequest) GetSnaptoken() string {
+	if x != nil {
+		return x.Snaptoken
+	}
+	return ""
+}
+
+// The response for a ExpandService.Expand RPC.
+type ExpandResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The tree the requested subject set expands to.
+	// The requested subject set is the subject of the root.
+	//
+	// This field can be nil in some circumstances.
+	Tree          *SubjectTree `protobuf:"bytes,1,opt,name=tree,proto3" json:"tree,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExpandResponse) Reset() {
+	*x = ExpandResponse{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExpandResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExpandResponse) ProtoMessage() {}
+
+func (x *ExpandResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExpandResponse.ProtoReflect.Descriptor instead.
+func (*ExpandResponse) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ExpandResponse) GetTree() *SubjectTree {
+	if x != nil {
+		return x.Tree
+	}
+	return nil
+}
+
+type SubjectTree struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The type of the node.
+	NodeType NodeType `protobuf:"varint,1,opt,name=node_type,json=nodeType,proto3,enum=ory.keto.relation_tuples.v1alpha2.NodeType" json:"node_type,omitempty"`
+	// The subject this node represents.
+	// Deprecated: More information is now available in the tuple field.
+	//
+	// Deprecated: Marked as deprecated in ory/keto/relation_tuples/v1alpha2/expand_service.proto.
+	Subject *Subject `protobuf:"bytes,2,opt,name=subject,proto3" json:"subject,omitempty"`
+	// The relation tuple this node represents.
+	Tuple *RelationTuple `protobuf:"bytes,4,opt,name=tuple,proto3" json:"tuple,omitempty"`
+	// The children of this node.
+	//
+	// This is never set if `node_type` == `NODE_TYPE_LEAF`.
+	Children      []*SubjectTree `protobuf:"bytes,3,rep,name=children,proto3" json:"children,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SubjectTree) Reset() {
+	*x = SubjectTree{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SubjectTree) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SubjectTree) ProtoMessage() {}
+
+func (x *SubjectTree) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SubjectTree.ProtoReflect.Descriptor instead.
+func (*SubjectTree) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *SubjectTree) GetNodeType() NodeType {
+	if x != nil {
+		return x.NodeType
+	}
+	return NodeType_NODE_TYPE_UNSPECIFIED
+}
+
+// Deprecated: Marked as deprecated in ory/keto/relation_tuples/v1alpha2/expand_service.proto.
+func (x *SubjectTree) GetSubject() *Subject {
+	if x != nil {
+		return x.Subject
+	}
+	return nil
+}
+
+func (x *SubjectTree) GetTuple() *RelationTuple {
+	if x != nil {
+		return x.Tuple
+	}
+	return nil
+}
+
+func (x *SubjectTree) GetChildren() []*SubjectTree {
+	if x != nil {
+		return x.Children
+	}
+	return nil
+}
+
+var File_ory_keto_relation_tuples_v1alpha2_expand_service_proto protoreflect.FileDescriptor
+
+const file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_rawDesc = "" +
+	"\n" +
+	"6ory/keto/relation_tuples/v1alpha2/expand_service.proto\x12!ory.keto.relation_tuples.v1alpha2\x1a7ory/keto/relation_tuples/v1alpha2/relation_tuples.proto\"\x90\x01\n" +
+	"\rExpandRequest\x12D\n" +
+	"\asubject\x18\x01 \x01(\v2*.ory.keto.relation_tuples.v1alpha2.SubjectR\asubject\x12\x1b\n" +
+	"\tmax_depth\x18\x02 \x01(\x05R\bmaxDepth\x12\x1c\n" +
+	"\tsnaptoken\x18\x03 \x01(\tR\tsnaptoken\"T\n" +
+	"\x0eExpandResponse\x12B\n" +
+	"\x04tree\x18\x01 \x01(\v2..ory.keto.relation_tuples.v1alpha2.SubjectTreeR\x04tree\"\xb5\x02\n" +
+	"\vSubjectTree\x12H\n" +
+	"\tnode_type\x18\x01 \x01(\x0e2+.ory.keto.relation_tuples.v1alpha2.NodeTypeR\bnodeType\x12H\n" +
+	"\asubject\x18\x02 \x01(\v2*.ory.keto.relation_tuples.v1alpha2.SubjectB\x02\x18\x01R\asubject\x12F\n" +
+	"\x05tuple\x18\x04 \x01(\v20.ory.keto.relation_tuples.v1alpha2.RelationTupleR\x05tuple\x12J\n" +
+	"\bchildren\x18\x03 \x03(\v2..ory.keto.relation_tuples.v1alpha2.SubjectTreeR\bchildren*\x83\x01\n" +
+	"\bNodeType\x12\x19\n" +
+	"\x15NODE_TYPE_UNSPECIFIED\x10\x00\x12\x13\n" +
+	"\x0fNODE_TYPE_UNION\x10\x01\x12\x17\n" +
+	"\x13NODE_TYPE_EXCLUSION\x10\x02\x12\x1a\n" +
+	"\x16NODE_TYPE_INTERSECTION\x10\x03\x12\x12\n" +
+	"\x0eNODE_TYPE_LEAF\x10\x042~\n" +
+	"\rExpandService\x12m\n" +
+	"\x06Expand\x120.ory.keto.relation_tuples.v1alpha2.ExpandRequest\x1a1.ory.keto.relation_tuples.v1alpha2.ExpandResponseB\xab\x02\n" +
+	"%com.ory.keto.relation_tuples.v1alpha2B\x12ExpandServiceProtoP\x01ZKgithub.com/ory/keto/gen/go/ory/keto/relation_tuples/v1alpha2;relationtuples\xa2\x02\x03OKR\xaa\x02 Ory.Keto.RelationTuples.V1alpha2\xca\x02 Ory\\Keto\\RelationTuples\\V1alpha2\xe2\x02,Ory\\Keto\\RelationTuples\\V1alpha2\\GPBMetadata\xea\x02#Ory::Keto::RelationTuples::V1alpha2b\x06proto3"
+
+var (
+	file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_rawDescOnce sync.Once
+	file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_rawDescData []byte
+)
+
+func file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_rawDescGZIP() []byte {
+	file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_rawDescOnce.Do(func() {
+		file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_rawDesc), len(file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_rawDesc)))
+	})
+	return file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_rawDescData
+}
+
+var file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_goTypes = []any{
+	(NodeType)(0),          // 0: ory.keto.relation_tuples.v1alpha2.NodeType
+	(*ExpandRequest)(nil),  // 1: ory.keto.relation_tuples.v1alpha2.ExpandRequest
+	(*ExpandResponse)(nil), // 2: ory.keto.relation_tuples.v1alpha2.ExpandResponse
+	(*SubjectTree)(nil),    // 3: ory.keto.relation_tuples.v1alpha2.SubjectTree
+	(*Subject)(nil),        // 4: ory.keto.relation_tuples.v1alpha2.Subject
+	(*RelationTuple)(nil),  // 5: ory.keto.relation_tuples.v1alpha2.RelationTuple
+}
+var file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_depIdxs = []int32{
+	4, // 0: ory.keto.relation_tuples.v1alpha2.ExpandRequest.subject:type_name -> ory.keto.relation_tuples.v1alpha2.Subject
+	3, // 1: ory.keto.relation_tuples.v1alpha2.ExpandResponse.tree:type_name -> ory.keto.relation_tuples.v1alpha2.SubjectTree
+	0, // 2: ory.keto.relation_tuples.v1alpha2.SubjectTree.node_type:type_name -> ory.keto.relation_tuples.v1alpha2.NodeType
+	4, // 3: ory.keto.relation_tuples.v1alpha2.SubjectTree.subject:type_name -> ory.keto.relation_tuples.v1alpha2.Subject
+	5, // 4: ory.keto.relation_tuples.v1alpha2.SubjectTree.tuple:type_name -> ory.keto.relation_tuples.v1alpha2.RelationTuple
+	3, // 5: ory.keto.relation_tuples.v1alpha2.SubjectTree.children:type_name -> ory.keto.relation_tuples.v1alpha2.SubjectTree
+	1, // 6: ory.keto.relation_tuples.v1alpha2.ExpandService.Expand:input_type -> ory.keto.relation_tuples.v1alpha2.ExpandRequest
+	2, // 7: ory.keto.relation_tuples.v1alpha2.ExpandService.Expand:output_type -> ory.keto.relation_tuples.v1alpha2.ExpandResponse
+	7, // [7:8] is the sub-list for method output_type
+	6, // [6:7] is the sub-list for method input_type
+	6, // [6:6] is the sub-list for extension type_name
+	6, // [6:6] is the sub-list for extension extendee
+	0, // [0:6] is the sub-list for field type_name
+}
+
+func init() { file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_init() }
+func file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_init() {
+	if File_ory_keto_relation_tuples_v1alpha2_expand_service_proto != nil {
+		return
+	}
+	file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_rawDesc), len(file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_rawDesc)),
+			NumEnums:      1,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_goTypes,
+		DependencyIndexes: file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_depIdxs,
+		EnumInfos:         file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_enumTypes,
+		MessageInfos:      file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_msgTypes,
+	}.Build()
+	File_ory_keto_relation_tuples_v1alpha2_expand_service_proto = out.File
+	file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_goTypes = nil
+	file_ory_keto_relation_tuples_v1alpha2_expand_service_proto_depIdxs = nil
+}

gen/go/ory/keto/relation_tuples/v1alpha2/expand_service_grpc.pb.go

@@ -0,0 +1,136 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             (unknown)
+// source: ory/keto/relation_tuples/v1alpha2/expand_service.proto
+
+package relationtuples
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	ExpandService_Expand_FullMethodName = "/ory.keto.relation_tuples.v1alpha2.ExpandService/Expand"
+)
+
+// ExpandServiceClient is the client API for ExpandService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// The service that performs subject set expansion
+// based on the stored Access Control Lists.
+//
+// This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+type ExpandServiceClient interface {
+	// Expands the subject set into a tree of subjects.
+	Expand(ctx context.Context, in *ExpandRequest, opts ...grpc.CallOption) (*ExpandResponse, error)
+}
+
+type expandServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewExpandServiceClient(cc grpc.ClientConnInterface) ExpandServiceClient {
+	return &expandServiceClient{cc}
+}
+
+func (c *expandServiceClient) Expand(ctx context.Context, in *ExpandRequest, opts ...grpc.CallOption) (*ExpandResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ExpandResponse)
+	err := c.cc.Invoke(ctx, ExpandService_Expand_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ExpandServiceServer is the server API for ExpandService service.
+// All implementations must embed UnimplementedExpandServiceServer
+// for forward compatibility.
+//
+// The service that performs subject set expansion
+// based on the stored Access Control Lists.
+//
+// This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+type ExpandServiceServer interface {
+	// Expands the subject set into a tree of subjects.
+	Expand(context.Context, *ExpandRequest) (*ExpandResponse, error)
+	mustEmbedUnimplementedExpandServiceServer()
+}
+
+// UnimplementedExpandServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedExpandServiceServer struct{}
+
+func (UnimplementedExpandServiceServer) Expand(context.Context, *ExpandRequest) (*ExpandResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method Expand not implemented")
+}
+func (UnimplementedExpandServiceServer) mustEmbedUnimplementedExpandServiceServer() {}
+func (UnimplementedExpandServiceServer) testEmbeddedByValue()                       {}
+
+// UnsafeExpandServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ExpandServiceServer will
+// result in compilation errors.
+type UnsafeExpandServiceServer interface {
+	mustEmbedUnimplementedExpandServiceServer()
+}
+
+func RegisterExpandServiceServer(s grpc.ServiceRegistrar, srv ExpandServiceServer) {
+	// If the following call panics, it indicates UnimplementedExpandServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&ExpandService_ServiceDesc, srv)
+}
+
+func _ExpandService_Expand_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ExpandRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ExpandServiceServer).Expand(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ExpandService_Expand_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ExpandServiceServer).Expand(ctx, req.(*ExpandRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// ExpandService_ServiceDesc is the grpc.ServiceDesc for ExpandService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ExpandService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "ory.keto.relation_tuples.v1alpha2.ExpandService",
+	HandlerType: (*ExpandServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Expand",
+			Handler:    _ExpandService_Expand_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "ory/keto/relation_tuples/v1alpha2/expand_service.proto",
+}

gen/go/ory/keto/relation_tuples/v1alpha2/namespaces_service.pb.go

@@ -0,0 +1,219 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: ory/keto/relation_tuples/v1alpha2/namespaces_service.proto
+
+package relationtuples
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Request for ReadService.ListNamespaces RPC.
+type ListNamespacesRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListNamespacesRequest) Reset() {
+	*x = ListNamespacesRequest{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListNamespacesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListNamespacesRequest) ProtoMessage() {}
+
+func (x *ListNamespacesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListNamespacesRequest.ProtoReflect.Descriptor instead.
+func (*ListNamespacesRequest) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_rawDescGZIP(), []int{0}
+}
+
+type ListNamespacesResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Namespaces    []*Namespace           `protobuf:"bytes,1,rep,name=namespaces,proto3" json:"namespaces,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListNamespacesResponse) Reset() {
+	*x = ListNamespacesResponse{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListNamespacesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListNamespacesResponse) ProtoMessage() {}
+
+func (x *ListNamespacesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListNamespacesResponse.ProtoReflect.Descriptor instead.
+func (*ListNamespacesResponse) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ListNamespacesResponse) GetNamespaces() []*Namespace {
+	if x != nil {
+		return x.Namespaces
+	}
+	return nil
+}
+
+type Namespace struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Namespace) Reset() {
+	*x = Namespace{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Namespace) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Namespace) ProtoMessage() {}
+
+func (x *Namespace) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Namespace.ProtoReflect.Descriptor instead.
+func (*Namespace) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *Namespace) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+var File_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto protoreflect.FileDescriptor
+
+const file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_rawDesc = "" +
+	"\n" +
+	":ory/keto/relation_tuples/v1alpha2/namespaces_service.proto\x12!ory.keto.relation_tuples.v1alpha2\"\x17\n" +
+	"\x15ListNamespacesRequest\"f\n" +
+	"\x16ListNamespacesResponse\x12L\n" +
+	"\n" +
+	"namespaces\x18\x01 \x03(\v2,.ory.keto.relation_tuples.v1alpha2.NamespaceR\n" +
+	"namespaces\"\x1f\n" +
+	"\tNamespace\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name2\x9b\x01\n" +
+	"\x11NamespacesService\x12\x85\x01\n" +
+	"\x0eListNamespaces\x128.ory.keto.relation_tuples.v1alpha2.ListNamespacesRequest\x1a9.ory.keto.relation_tuples.v1alpha2.ListNamespacesResponseB\xaf\x02\n" +
+	"%com.ory.keto.relation_tuples.v1alpha2B\x16NamespacesServiceProtoP\x01ZKgithub.com/ory/keto/gen/go/ory/keto/relation_tuples/v1alpha2;relationtuples\xa2\x02\x03OKR\xaa\x02 Ory.Keto.RelationTuples.V1alpha2\xca\x02 Ory\\Keto\\RelationTuples\\V1alpha2\xe2\x02,Ory\\Keto\\RelationTuples\\V1alpha2\\GPBMetadata\xea\x02#Ory::Keto::RelationTuples::V1alpha2b\x06proto3"
+
+var (
+	file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_rawDescOnce sync.Once
+	file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_rawDescData []byte
+)
+
+func file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_rawDescGZIP() []byte {
+	file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_rawDescOnce.Do(func() {
+		file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_rawDesc), len(file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_rawDesc)))
+	})
+	return file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_rawDescData
+}
+
+var file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_goTypes = []any{
+	(*ListNamespacesRequest)(nil),  // 0: ory.keto.relation_tuples.v1alpha2.ListNamespacesRequest
+	(*ListNamespacesResponse)(nil), // 1: ory.keto.relation_tuples.v1alpha2.ListNamespacesResponse
+	(*Namespace)(nil),              // 2: ory.keto.relation_tuples.v1alpha2.Namespace
+}
+var file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_depIdxs = []int32{
+	2, // 0: ory.keto.relation_tuples.v1alpha2.ListNamespacesResponse.namespaces:type_name -> ory.keto.relation_tuples.v1alpha2.Namespace
+	0, // 1: ory.keto.relation_tuples.v1alpha2.NamespacesService.ListNamespaces:input_type -> ory.keto.relation_tuples.v1alpha2.ListNamespacesRequest
+	1, // 2: ory.keto.relation_tuples.v1alpha2.NamespacesService.ListNamespaces:output_type -> ory.keto.relation_tuples.v1alpha2.ListNamespacesResponse
+	2, // [2:3] is the sub-list for method output_type
+	1, // [1:2] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_init() }
+func file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_init() {
+	if File_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_rawDesc), len(file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_goTypes,
+		DependencyIndexes: file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_depIdxs,
+		MessageInfos:      file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_msgTypes,
+	}.Build()
+	File_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto = out.File
+	file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_goTypes = nil
+	file_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto_depIdxs = nil
+}

gen/go/ory/keto/relation_tuples/v1alpha2/namespaces_service_grpc.pb.go

@@ -0,0 +1,134 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             (unknown)
+// source: ory/keto/relation_tuples/v1alpha2/namespaces_service.proto
+
+package relationtuples
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	NamespacesService_ListNamespaces_FullMethodName = "/ory.keto.relation_tuples.v1alpha2.NamespacesService/ListNamespaces"
+)
+
+// NamespacesServiceClient is the client API for NamespacesService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// The service to query namespaces.
+//
+// This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+type NamespacesServiceClient interface {
+	// Lists Namespaces
+	ListNamespaces(ctx context.Context, in *ListNamespacesRequest, opts ...grpc.CallOption) (*ListNamespacesResponse, error)
+}
+
+type namespacesServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewNamespacesServiceClient(cc grpc.ClientConnInterface) NamespacesServiceClient {
+	return &namespacesServiceClient{cc}
+}
+
+func (c *namespacesServiceClient) ListNamespaces(ctx context.Context, in *ListNamespacesRequest, opts ...grpc.CallOption) (*ListNamespacesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListNamespacesResponse)
+	err := c.cc.Invoke(ctx, NamespacesService_ListNamespaces_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// NamespacesServiceServer is the server API for NamespacesService service.
+// All implementations must embed UnimplementedNamespacesServiceServer
+// for forward compatibility.
+//
+// The service to query namespaces.
+//
+// This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+type NamespacesServiceServer interface {
+	// Lists Namespaces
+	ListNamespaces(context.Context, *ListNamespacesRequest) (*ListNamespacesResponse, error)
+	mustEmbedUnimplementedNamespacesServiceServer()
+}
+
+// UnimplementedNamespacesServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedNamespacesServiceServer struct{}
+
+func (UnimplementedNamespacesServiceServer) ListNamespaces(context.Context, *ListNamespacesRequest) (*ListNamespacesResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListNamespaces not implemented")
+}
+func (UnimplementedNamespacesServiceServer) mustEmbedUnimplementedNamespacesServiceServer() {}
+func (UnimplementedNamespacesServiceServer) testEmbeddedByValue()                           {}
+
+// UnsafeNamespacesServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to NamespacesServiceServer will
+// result in compilation errors.
+type UnsafeNamespacesServiceServer interface {
+	mustEmbedUnimplementedNamespacesServiceServer()
+}
+
+func RegisterNamespacesServiceServer(s grpc.ServiceRegistrar, srv NamespacesServiceServer) {
+	// If the following call panics, it indicates UnimplementedNamespacesServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&NamespacesService_ServiceDesc, srv)
+}
+
+func _NamespacesService_ListNamespaces_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListNamespacesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NamespacesServiceServer).ListNamespaces(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: NamespacesService_ListNamespaces_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NamespacesServiceServer).ListNamespaces(ctx, req.(*ListNamespacesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// NamespacesService_ServiceDesc is the grpc.ServiceDesc for NamespacesService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var NamespacesService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "ory.keto.relation_tuples.v1alpha2.NamespacesService",
+	HandlerType: (*NamespacesServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "ListNamespaces",
+			Handler:    _NamespacesService_ListNamespaces_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "ory/keto/relation_tuples/v1alpha2/namespaces_service.proto",
+}

gen/go/ory/keto/relation_tuples/v1alpha2/read_service.pb.go

@@ -0,0 +1,371 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: ory/keto/relation_tuples/v1alpha2/read_service.proto
+
+package relationtuples
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	fieldmaskpb "google.golang.org/protobuf/types/known/fieldmaskpb"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Request for ReadService.ListRelationTuples RPC.
+// See `ListRelationTuplesRequest_Query` for how to filter the query.
+type ListRelationTuplesRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// All query constraints are concatenated
+	// with a logical AND operator.
+	//
+	// The RelationTuple list from ListRelationTuplesResponse
+	// is ordered from the newest RelationTuple to the oldest.
+	//
+	// Deprecated: Marked as deprecated in ory/keto/relation_tuples/v1alpha2/read_service.proto.
+	Query         *ListRelationTuplesRequest_Query `protobuf:"bytes,1,opt,name=query,proto3" json:"query,omitempty"`
+	RelationQuery *RelationQuery                   `protobuf:"bytes,6,opt,name=relation_query,json=relationQuery,proto3" json:"relation_query,omitempty"`
+	// This field is not implemented yet and has no effect.
+	// <!--
+	// Optional. The list of fields to be expanded
+	// in the RelationTuple list returned in `ListRelationTuplesResponse`.
+	// Leaving this field unspecified means all fields are expanded.
+	//
+	// Available fields:
+	// "object", "relation", "subject",
+	// "namespace", "subject.id", "subject.namespace",
+	// "subject.object", "subject.relation"
+	// -->
+	ExpandMask *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=expand_mask,json=expandMask,proto3" json:"expand_mask,omitempty"`
+	// This field is not implemented yet and has no effect.
+	// <!--
+	// Optional. The snapshot token for this read.
+	// -->
+	Snaptoken string `protobuf:"bytes,3,opt,name=snaptoken,proto3" json:"snaptoken,omitempty"`
+	// Optional. The maximum number of
+	// RelationTuples to return in the response.
+	//
+	// Default: 100
+	PageSize int32 `protobuf:"varint,4,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// Optional. An opaque pagination token returned from
+	// a previous call to `ListRelationTuples` that
+	// indicates where the page should start at.
+	//
+	// An empty token denotes the first page. All successive
+	// pages require the token from the previous page.
+	PageToken     string `protobuf:"bytes,5,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListRelationTuplesRequest) Reset() {
+	*x = ListRelationTuplesRequest{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_read_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRelationTuplesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRelationTuplesRequest) ProtoMessage() {}
+
+func (x *ListRelationTuplesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_read_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRelationTuplesRequest.ProtoReflect.Descriptor instead.
+func (*ListRelationTuplesRequest) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_read_service_proto_rawDescGZIP(), []int{0}
+}
+
+// Deprecated: Marked as deprecated in ory/keto/relation_tuples/v1alpha2/read_service.proto.
+func (x *ListRelationTuplesRequest) GetQuery() *ListRelationTuplesRequest_Query {
+	if x != nil {
+		return x.Query
+	}
+	return nil
+}
+
+func (x *ListRelationTuplesRequest) GetRelationQuery() *RelationQuery {
+	if x != nil {
+		return x.RelationQuery
+	}
+	return nil
+}
+
+func (x *ListRelationTuplesRequest) GetExpandMask() *fieldmaskpb.FieldMask {
+	if x != nil {
+		return x.ExpandMask
+	}
+	return nil
+}
+
+func (x *ListRelationTuplesRequest) GetSnaptoken() string {
+	if x != nil {
+		return x.Snaptoken
+	}
+	return ""
+}
+
+func (x *ListRelationTuplesRequest) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListRelationTuplesRequest) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+// The response of a ReadService.ListRelationTuples RPC.
+type ListRelationTuplesResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The relationships matching the list request.
+	RelationTuples []*RelationTuple `protobuf:"bytes,1,rep,name=relation_tuples,json=relationTuples,proto3" json:"relation_tuples,omitempty"`
+	// The token required to get the next page.
+	// If this is the last page, the token will be the empty string.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListRelationTuplesResponse) Reset() {
+	*x = ListRelationTuplesResponse{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_read_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRelationTuplesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRelationTuplesResponse) ProtoMessage() {}
+
+func (x *ListRelationTuplesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_read_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRelationTuplesResponse.ProtoReflect.Descriptor instead.
+func (*ListRelationTuplesResponse) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_read_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ListRelationTuplesResponse) GetRelationTuples() []*RelationTuple {
+	if x != nil {
+		return x.RelationTuples
+	}
+	return nil
+}
+
+func (x *ListRelationTuplesResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
+// The query for listing relationships.
+// Clients can specify any optional field to
+// partially filter for specific relationships.
+//
+// Example use cases (namespace is always required):
+//   - object only: display a list of all permissions referring to a specific object
+//   - relation only: get all groups that have members; get all directories that have content
+//   - object & relation: display all subjects that have a specific permission relation
+//   - subject & relation: display all groups a subject belongs to; display all objects a subject has access to
+//   - object & relation & subject: check whether the relation tuple already exists
+type ListRelationTuplesRequest_Query struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Required. The namespace to query.
+	Namespace string `protobuf:"bytes,1,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	// Optional. The object to query for.
+	Object string `protobuf:"bytes,2,opt,name=object,proto3" json:"object,omitempty"`
+	// Optional. The relation to query for.
+	Relation string `protobuf:"bytes,3,opt,name=relation,proto3" json:"relation,omitempty"`
+	// Optional. The subject to query for.
+	Subject       *Subject `protobuf:"bytes,4,opt,name=subject,proto3" json:"subject,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListRelationTuplesRequest_Query) Reset() {
+	*x = ListRelationTuplesRequest_Query{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_read_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRelationTuplesRequest_Query) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRelationTuplesRequest_Query) ProtoMessage() {}
+
+func (x *ListRelationTuplesRequest_Query) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_read_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRelationTuplesRequest_Query.ProtoReflect.Descriptor instead.
+func (*ListRelationTuplesRequest_Query) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_read_service_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *ListRelationTuplesRequest_Query) GetNamespace() string {
+	if x != nil {
+		return x.Namespace
+	}
+	return ""
+}
+
+func (x *ListRelationTuplesRequest_Query) GetObject() string {
+	if x != nil {
+		return x.Object
+	}
+	return ""
+}
+
+func (x *ListRelationTuplesRequest_Query) GetRelation() string {
+	if x != nil {
+		return x.Relation
+	}
+	return ""
+}
+
+func (x *ListRelationTuplesRequest_Query) GetSubject() *Subject {
+	if x != nil {
+		return x.Subject
+	}
+	return nil
+}
+
+var File_ory_keto_relation_tuples_v1alpha2_read_service_proto protoreflect.FileDescriptor
+
+const file_ory_keto_relation_tuples_v1alpha2_read_service_proto_rawDesc = "" +
+	"\n" +
+	"4ory/keto/relation_tuples/v1alpha2/read_service.proto\x12!ory.keto.relation_tuples.v1alpha2\x1a7ory/keto/relation_tuples/v1alpha2/relation_tuples.proto\x1a google/protobuf/field_mask.proto\"\x8b\x04\n" +
+	"\x19ListRelationTuplesRequest\x12\\\n" +
+	"\x05query\x18\x01 \x01(\v2B.ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest.QueryB\x02\x18\x01R\x05query\x12W\n" +
+	"\x0erelation_query\x18\x06 \x01(\v20.ory.keto.relation_tuples.v1alpha2.RelationQueryR\rrelationQuery\x12;\n" +
+	"\vexpand_mask\x18\x02 \x01(\v2\x1a.google.protobuf.FieldMaskR\n" +
+	"expandMask\x12\x1c\n" +
+	"\tsnaptoken\x18\x03 \x01(\tR\tsnaptoken\x12\x1b\n" +
+	"\tpage_size\x18\x04 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x05 \x01(\tR\tpageToken\x1a\x9f\x01\n" +
+	"\x05Query\x12\x1c\n" +
+	"\tnamespace\x18\x01 \x01(\tR\tnamespace\x12\x16\n" +
+	"\x06object\x18\x02 \x01(\tR\x06object\x12\x1a\n" +
+	"\brelation\x18\x03 \x01(\tR\brelation\x12D\n" +
+	"\asubject\x18\x04 \x01(\v2*.ory.keto.relation_tuples.v1alpha2.SubjectR\asubject\"\x9f\x01\n" +
+	"\x1aListRelationTuplesResponse\x12Y\n" +
+	"\x0frelation_tuples\x18\x01 \x03(\v20.ory.keto.relation_tuples.v1alpha2.RelationTupleR\x0erelationTuples\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken2\xa1\x01\n" +
+	"\vReadService\x12\x91\x01\n" +
+	"\x12ListRelationTuples\x12<.ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest\x1a=.ory.keto.relation_tuples.v1alpha2.ListRelationTuplesResponseB\xa9\x02\n" +
+	"%com.ory.keto.relation_tuples.v1alpha2B\x10ReadServiceProtoP\x01ZKgithub.com/ory/keto/gen/go/ory/keto/relation_tuples/v1alpha2;relationtuples\xa2\x02\x03OKR\xaa\x02 Ory.Keto.RelationTuples.V1alpha2\xca\x02 Ory\\Keto\\RelationTuples\\V1alpha2\xe2\x02,Ory\\Keto\\RelationTuples\\V1alpha2\\GPBMetadata\xea\x02#Ory::Keto::RelationTuples::V1alpha2b\x06proto3"
+
+var (
+	file_ory_keto_relation_tuples_v1alpha2_read_service_proto_rawDescOnce sync.Once
+	file_ory_keto_relation_tuples_v1alpha2_read_service_proto_rawDescData []byte
+)
+
+func file_ory_keto_relation_tuples_v1alpha2_read_service_proto_rawDescGZIP() []byte {
+	file_ory_keto_relation_tuples_v1alpha2_read_service_proto_rawDescOnce.Do(func() {
+		file_ory_keto_relation_tuples_v1alpha2_read_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_ory_keto_relation_tuples_v1alpha2_read_service_proto_rawDesc), len(file_ory_keto_relation_tuples_v1alpha2_read_service_proto_rawDesc)))
+	})
+	return file_ory_keto_relation_tuples_v1alpha2_read_service_proto_rawDescData
+}
+
+var file_ory_keto_relation_tuples_v1alpha2_read_service_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_ory_keto_relation_tuples_v1alpha2_read_service_proto_goTypes = []any{
+	(*ListRelationTuplesRequest)(nil),       // 0: ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest
+	(*ListRelationTuplesResponse)(nil),      // 1: ory.keto.relation_tuples.v1alpha2.ListRelationTuplesResponse
+	(*ListRelationTuplesRequest_Query)(nil), // 2: ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest.Query
+	(*RelationQuery)(nil),                   // 3: ory.keto.relation_tuples.v1alpha2.RelationQuery
+	(*fieldmaskpb.FieldMask)(nil),           // 4: google.protobuf.FieldMask
+	(*RelationTuple)(nil),                   // 5: ory.keto.relation_tuples.v1alpha2.RelationTuple
+	(*Subject)(nil),                         // 6: ory.keto.relation_tuples.v1alpha2.Subject
+}
+var file_ory_keto_relation_tuples_v1alpha2_read_service_proto_depIdxs = []int32{
+	2, // 0: ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest.query:type_name -> ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest.Query
+	3, // 1: ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest.relation_query:type_name -> ory.keto.relation_tuples.v1alpha2.RelationQuery
+	4, // 2: ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest.expand_mask:type_name -> google.protobuf.FieldMask
+	5, // 3: ory.keto.relation_tuples.v1alpha2.ListRelationTuplesResponse.relation_tuples:type_name -> ory.keto.relation_tuples.v1alpha2.RelationTuple
+	6, // 4: ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest.Query.subject:type_name -> ory.keto.relation_tuples.v1alpha2.Subject
+	0, // 5: ory.keto.relation_tuples.v1alpha2.ReadService.ListRelationTuples:input_type -> ory.keto.relation_tuples.v1alpha2.ListRelationTuplesRequest
+	1, // 6: ory.keto.relation_tuples.v1alpha2.ReadService.ListRelationTuples:output_type -> ory.keto.relation_tuples.v1alpha2.ListRelationTuplesResponse
+	6, // [6:7] is the sub-list for method output_type
+	5, // [5:6] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
+}
+
+func init() { file_ory_keto_relation_tuples_v1alpha2_read_service_proto_init() }
+func file_ory_keto_relation_tuples_v1alpha2_read_service_proto_init() {
+	if File_ory_keto_relation_tuples_v1alpha2_read_service_proto != nil {
+		return
+	}
+	file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_ory_keto_relation_tuples_v1alpha2_read_service_proto_rawDesc), len(file_ory_keto_relation_tuples_v1alpha2_read_service_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_ory_keto_relation_tuples_v1alpha2_read_service_proto_goTypes,
+		DependencyIndexes: file_ory_keto_relation_tuples_v1alpha2_read_service_proto_depIdxs,
+		MessageInfos:      file_ory_keto_relation_tuples_v1alpha2_read_service_proto_msgTypes,
+	}.Build()
+	File_ory_keto_relation_tuples_v1alpha2_read_service_proto = out.File
+	file_ory_keto_relation_tuples_v1alpha2_read_service_proto_goTypes = nil
+	file_ory_keto_relation_tuples_v1alpha2_read_service_proto_depIdxs = nil
+}

gen/go/ory/keto/relation_tuples/v1alpha2/read_service_grpc.pb.go

@@ -0,0 +1,134 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             (unknown)
+// source: ory/keto/relation_tuples/v1alpha2/read_service.proto
+
+package relationtuples
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	ReadService_ListRelationTuples_FullMethodName = "/ory.keto.relation_tuples.v1alpha2.ReadService/ListRelationTuples"
+)
+
+// ReadServiceClient is the client API for ReadService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// The service to query relationships.
+//
+// This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+type ReadServiceClient interface {
+	// Lists ACL relationships.
+	ListRelationTuples(ctx context.Context, in *ListRelationTuplesRequest, opts ...grpc.CallOption) (*ListRelationTuplesResponse, error)
+}
+
+type readServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewReadServiceClient(cc grpc.ClientConnInterface) ReadServiceClient {
+	return &readServiceClient{cc}
+}
+
+func (c *readServiceClient) ListRelationTuples(ctx context.Context, in *ListRelationTuplesRequest, opts ...grpc.CallOption) (*ListRelationTuplesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListRelationTuplesResponse)
+	err := c.cc.Invoke(ctx, ReadService_ListRelationTuples_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ReadServiceServer is the server API for ReadService service.
+// All implementations must embed UnimplementedReadServiceServer
+// for forward compatibility.
+//
+// The service to query relationships.
+//
+// This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis).
+type ReadServiceServer interface {
+	// Lists ACL relationships.
+	ListRelationTuples(context.Context, *ListRelationTuplesRequest) (*ListRelationTuplesResponse, error)
+	mustEmbedUnimplementedReadServiceServer()
+}
+
+// UnimplementedReadServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedReadServiceServer struct{}
+
+func (UnimplementedReadServiceServer) ListRelationTuples(context.Context, *ListRelationTuplesRequest) (*ListRelationTuplesResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListRelationTuples not implemented")
+}
+func (UnimplementedReadServiceServer) mustEmbedUnimplementedReadServiceServer() {}
+func (UnimplementedReadServiceServer) testEmbeddedByValue()                     {}
+
+// UnsafeReadServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ReadServiceServer will
+// result in compilation errors.
+type UnsafeReadServiceServer interface {
+	mustEmbedUnimplementedReadServiceServer()
+}
+
+func RegisterReadServiceServer(s grpc.ServiceRegistrar, srv ReadServiceServer) {
+	// If the following call panics, it indicates UnimplementedReadServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&ReadService_ServiceDesc, srv)
+}
+
+func _ReadService_ListRelationTuples_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListRelationTuplesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ReadServiceServer).ListRelationTuples(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ReadService_ListRelationTuples_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ReadServiceServer).ListRelationTuples(ctx, req.(*ListRelationTuplesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// ReadService_ServiceDesc is the grpc.ServiceDesc for ReadService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ReadService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "ory.keto.relation_tuples.v1alpha2.ReadService",
+	HandlerType: (*ReadServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "ListRelationTuples",
+			Handler:    _ReadService_ListRelationTuples_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "ory/keto/relation_tuples/v1alpha2/read_service.proto",
+}

gen/go/ory/keto/relation_tuples/v1alpha2/relation_tuples.pb.go

@@ -0,0 +1,432 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: ory/keto/relation_tuples/v1alpha2/relation_tuples.proto
+
+package relationtuples
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// RelationTuple defines a relation between an Object and a Subject.
+type RelationTuple struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The namespace this relation tuple lives in.
+	Namespace string `protobuf:"bytes,1,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	// The object related by this tuple.
+	// It is an object in the namespace of the tuple.
+	Object string `protobuf:"bytes,2,opt,name=object,proto3" json:"object,omitempty"`
+	// The relation between an Object and a Subject.
+	Relation string `protobuf:"bytes,3,opt,name=relation,proto3" json:"relation,omitempty"`
+	// The subject related by this tuple.
+	// A Subject either represents a concrete subject id or
+	// a `SubjectSet` that expands to more Subjects.
+	Subject       *Subject `protobuf:"bytes,4,opt,name=subject,proto3" json:"subject,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RelationTuple) Reset() {
+	*x = RelationTuple{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RelationTuple) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RelationTuple) ProtoMessage() {}
+
+func (x *RelationTuple) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RelationTuple.ProtoReflect.Descriptor instead.
+func (*RelationTuple) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *RelationTuple) GetNamespace() string {
+	if x != nil {
+		return x.Namespace
+	}
+	return ""
+}
+
+func (x *RelationTuple) GetObject() string {
+	if x != nil {
+		return x.Object
+	}
+	return ""
+}
+
+func (x *RelationTuple) GetRelation() string {
+	if x != nil {
+		return x.Relation
+	}
+	return ""
+}
+
+func (x *RelationTuple) GetSubject() *Subject {
+	if x != nil {
+		return x.Subject
+	}
+	return nil
+}
+
+// The query for listing relationships.
+// Clients can specify any optional field to
+// partially filter for specific relationships.
+//
+// Example use cases (namespace is always required):
+//   - object only: display a list of all permissions referring to a specific object
+//   - relation only: get all groups that have members; get all directories that have content
+//   - object & relation: display all subjects that have a specific permission relation
+//   - subject & relation: display all groups a subject belongs to; display all objects a subject has access to
+//   - object & relation & subject: check whether the relation tuple already exists
+type RelationQuery struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The namespace this relation tuple lives in.
+	Namespace *string `protobuf:"bytes,1,opt,name=namespace,proto3,oneof" json:"namespace,omitempty"`
+	// The object related by this tuple.
+	// It is an object in the namespace of the tuple.
+	Object *string `protobuf:"bytes,2,opt,name=object,proto3,oneof" json:"object,omitempty"`
+	// The relation between an Object and a Subject.
+	Relation *string `protobuf:"bytes,3,opt,name=relation,proto3,oneof" json:"relation,omitempty"`
+	// The subject related by this tuple.
+	// A Subject either represents a concrete subject id or
+	// a `SubjectSet` that expands to more Subjects.
+	Subject       *Subject `protobuf:"bytes,4,opt,name=subject,proto3,oneof" json:"subject,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RelationQuery) Reset() {
+	*x = RelationQuery{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RelationQuery) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RelationQuery) ProtoMessage() {}
+
+func (x *RelationQuery) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RelationQuery.ProtoReflect.Descriptor instead.
+func (*RelationQuery) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *RelationQuery) GetNamespace() string {
+	if x != nil && x.Namespace != nil {
+		return *x.Namespace
+	}
+	return ""
+}
+
+func (x *RelationQuery) GetObject() string {
+	if x != nil && x.Object != nil {
+		return *x.Object
+	}
+	return ""
+}
+
+func (x *RelationQuery) GetRelation() string {
+	if x != nil && x.Relation != nil {
+		return *x.Relation
+	}
+	return ""
+}
+
+func (x *RelationQuery) GetSubject() *Subject {
+	if x != nil {
+		return x.Subject
+	}
+	return nil
+}
+
+// Subject is either a concrete subject id or
+// a `SubjectSet` expanding to more Subjects.
+type Subject struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The reference of this abstract subject.
+	//
+	// Types that are valid to be assigned to Ref:
+	//
+	//	*Subject_Id
+	//	*Subject_Set
+	Ref           isSubject_Ref `protobuf_oneof:"ref"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Subject) Reset() {
+	*x = Subject{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Subject) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Subject) ProtoMessage() {}
+
+func (x *Subject) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Subject.ProtoReflect.Descriptor instead.
+func (*Subject) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *Subject) GetRef() isSubject_Ref {
+	if x != nil {
+		return x.Ref
+	}
+	return nil
+}
+
+func (x *Subject) GetId() string {
+	if x != nil {
+		if x, ok := x.Ref.(*Subject_Id); ok {
+			return x.Id
+		}
+	}
+	return ""
+}
+
+func (x *Subject) GetSet() *SubjectSet {
+	if x != nil {
+		if x, ok := x.Ref.(*Subject_Set); ok {
+			return x.Set
+		}
+	}
+	return nil
+}
+
+type isSubject_Ref interface {
+	isSubject_Ref()
+}
+
+type Subject_Id struct {
+	// A concrete id of the subject.
+	Id string `protobuf:"bytes,1,opt,name=id,proto3,oneof"`
+}
+
+type Subject_Set struct {
+	// A subject set that expands to more Subjects.
+	// More information are available under [concepts](../concepts/15_subjects.mdx).
+	Set *SubjectSet `protobuf:"bytes,2,opt,name=set,proto3,oneof"`
+}
+
+func (*Subject_Id) isSubject_Ref() {}
+
+func (*Subject_Set) isSubject_Ref() {}
+
+// SubjectSet refers to all subjects who have
+// the same `relation` on an `object`.
+type SubjectSet struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The namespace of the object and relation
+	// referenced in this subject set.
+	Namespace string `protobuf:"bytes,1,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	// The object related by this subject set.
+	Object string `protobuf:"bytes,2,opt,name=object,proto3" json:"object,omitempty"`
+	// The relation between the object and the subjects.
+	Relation      string `protobuf:"bytes,3,opt,name=relation,proto3" json:"relation,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SubjectSet) Reset() {
+	*x = SubjectSet{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SubjectSet) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SubjectSet) ProtoMessage() {}
+
+func (x *SubjectSet) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SubjectSet.ProtoReflect.Descriptor instead.
+func (*SubjectSet) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *SubjectSet) GetNamespace() string {
+	if x != nil {
+		return x.Namespace
+	}
+	return ""
+}
+
+func (x *SubjectSet) GetObject() string {
+	if x != nil {
+		return x.Object
+	}
+	return ""
+}
+
+func (x *SubjectSet) GetRelation() string {
+	if x != nil {
+		return x.Relation
+	}
+	return ""
+}
+
+var File_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto protoreflect.FileDescriptor
+
+const file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_rawDesc = "" +
+	"\n" +
+	"7ory/keto/relation_tuples/v1alpha2/relation_tuples.proto\x12!ory.keto.relation_tuples.v1alpha2\"\xa7\x01\n" +
+	"\rRelationTuple\x12\x1c\n" +
+	"\tnamespace\x18\x01 \x01(\tR\tnamespace\x12\x16\n" +
+	"\x06object\x18\x02 \x01(\tR\x06object\x12\x1a\n" +
+	"\brelation\x18\x03 \x01(\tR\brelation\x12D\n" +
+	"\asubject\x18\x04 \x01(\v2*.ory.keto.relation_tuples.v1alpha2.SubjectR\asubject\"\xed\x01\n" +
+	"\rRelationQuery\x12!\n" +
+	"\tnamespace\x18\x01 \x01(\tH\x00R\tnamespace\x88\x01\x01\x12\x1b\n" +
+	"\x06object\x18\x02 \x01(\tH\x01R\x06object\x88\x01\x01\x12\x1f\n" +
+	"\brelation\x18\x03 \x01(\tH\x02R\brelation\x88\x01\x01\x12I\n" +
+	"\asubject\x18\x04 \x01(\v2*.ory.keto.relation_tuples.v1alpha2.SubjectH\x03R\asubject\x88\x01\x01B\f\n" +
+	"\n" +
+	"_namespaceB\t\n" +
+	"\a_objectB\v\n" +
+	"\t_relationB\n" +
+	"\n" +
+	"\b_subject\"e\n" +
+	"\aSubject\x12\x10\n" +
+	"\x02id\x18\x01 \x01(\tH\x00R\x02id\x12A\n" +
+	"\x03set\x18\x02 \x01(\v2-.ory.keto.relation_tuples.v1alpha2.SubjectSetH\x00R\x03setB\x05\n" +
+	"\x03ref\"^\n" +
+	"\n" +
+	"SubjectSet\x12\x1c\n" +
+	"\tnamespace\x18\x01 \x01(\tR\tnamespace\x12\x16\n" +
+	"\x06object\x18\x02 \x01(\tR\x06object\x12\x1a\n" +
+	"\brelation\x18\x03 \x01(\tR\brelationB\xac\x02\n" +
+	"%com.ory.keto.relation_tuples.v1alpha2B\x13RelationTuplesProtoP\x01ZKgithub.com/ory/keto/gen/go/ory/keto/relation_tuples/v1alpha2;relationtuples\xa2\x02\x03OKR\xaa\x02 Ory.Keto.RelationTuples.V1alpha2\xca\x02 Ory\\Keto\\RelationTuples\\V1alpha2\xe2\x02,Ory\\Keto\\RelationTuples\\V1alpha2\\GPBMetadata\xea\x02#Ory::Keto::RelationTuples::V1alpha2b\x06proto3"
+
+var (
+	file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_rawDescOnce sync.Once
+	file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_rawDescData []byte
+)
+
+func file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_rawDescGZIP() []byte {
+	file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_rawDescOnce.Do(func() {
+		file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_rawDesc), len(file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_rawDesc)))
+	})
+	return file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_rawDescData
+}
+
+var file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_goTypes = []any{
+	(*RelationTuple)(nil), // 0: ory.keto.relation_tuples.v1alpha2.RelationTuple
+	(*RelationQuery)(nil), // 1: ory.keto.relation_tuples.v1alpha2.RelationQuery
+	(*Subject)(nil),       // 2: ory.keto.relation_tuples.v1alpha2.Subject
+	(*SubjectSet)(nil),    // 3: ory.keto.relation_tuples.v1alpha2.SubjectSet
+}
+var file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_depIdxs = []int32{
+	2, // 0: ory.keto.relation_tuples.v1alpha2.RelationTuple.subject:type_name -> ory.keto.relation_tuples.v1alpha2.Subject
+	2, // 1: ory.keto.relation_tuples.v1alpha2.RelationQuery.subject:type_name -> ory.keto.relation_tuples.v1alpha2.Subject
+	3, // 2: ory.keto.relation_tuples.v1alpha2.Subject.set:type_name -> ory.keto.relation_tuples.v1alpha2.SubjectSet
+	3, // [3:3] is the sub-list for method output_type
+	3, // [3:3] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_init() }
+func file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_init() {
+	if File_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto != nil {
+		return
+	}
+	file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_msgTypes[1].OneofWrappers = []any{}
+	file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_msgTypes[2].OneofWrappers = []any{
+		(*Subject_Id)(nil),
+		(*Subject_Set)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_rawDesc), len(file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_goTypes,
+		DependencyIndexes: file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_depIdxs,
+		MessageInfos:      file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_msgTypes,
+	}.Build()
+	File_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto = out.File
+	file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_goTypes = nil
+	file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_depIdxs = nil
+}

gen/go/ory/keto/relation_tuples/v1alpha2/relationtuplesconnect/check_service.connect.go

@@ -0,0 +1,142 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: ory/keto/relation_tuples/v1alpha2/check_service.proto
+
+package relationtuplesconnect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1alpha2 "github.com/ory/keto/gen/go/ory/keto/relation_tuples/v1alpha2"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// CheckServiceName is the fully-qualified name of the CheckService service.
+	CheckServiceName = "ory.keto.relation_tuples.v1alpha2.CheckService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// CheckServiceCheckProcedure is the fully-qualified name of the CheckService's Check RPC.
+	CheckServiceCheckProcedure = "/ory.keto.relation_tuples.v1alpha2.CheckService/Check"
+	// CheckServiceBatchCheckProcedure is the fully-qualified name of the CheckService's BatchCheck RPC.
+	CheckServiceBatchCheckProcedure = "/ory.keto.relation_tuples.v1alpha2.CheckService/BatchCheck"
+)
+
+// CheckServiceClient is a client for the ory.keto.relation_tuples.v1alpha2.CheckService service.
+type CheckServiceClient interface {
+	// Performs an authorization check.
+	Check(context.Context, *connect.Request[v1alpha2.CheckRequest]) (*connect.Response[v1alpha2.CheckResponse], error)
+	BatchCheck(context.Context, *connect.Request[v1alpha2.BatchCheckRequest]) (*connect.Response[v1alpha2.BatchCheckResponse], error)
+}
+
+// NewCheckServiceClient constructs a client for the ory.keto.relation_tuples.v1alpha2.CheckService
+// service. By default, it uses the Connect protocol with the binary Protobuf Codec, asks for
+// gzipped responses, and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply
+// the connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewCheckServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) CheckServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	checkServiceMethods := v1alpha2.File_ory_keto_relation_tuples_v1alpha2_check_service_proto.Services().ByName("CheckService").Methods()
+	return &checkServiceClient{
+		check: connect.NewClient[v1alpha2.CheckRequest, v1alpha2.CheckResponse](
+			httpClient,
+			baseURL+CheckServiceCheckProcedure,
+			connect.WithSchema(checkServiceMethods.ByName("Check")),
+			connect.WithClientOptions(opts...),
+		),
+		batchCheck: connect.NewClient[v1alpha2.BatchCheckRequest, v1alpha2.BatchCheckResponse](
+			httpClient,
+			baseURL+CheckServiceBatchCheckProcedure,
+			connect.WithSchema(checkServiceMethods.ByName("BatchCheck")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// checkServiceClient implements CheckServiceClient.
+type checkServiceClient struct {
+	check      *connect.Client[v1alpha2.CheckRequest, v1alpha2.CheckResponse]
+	batchCheck *connect.Client[v1alpha2.BatchCheckRequest, v1alpha2.BatchCheckResponse]
+}
+
+// Check calls ory.keto.relation_tuples.v1alpha2.CheckService.Check.
+func (c *checkServiceClient) Check(ctx context.Context, req *connect.Request[v1alpha2.CheckRequest]) (*connect.Response[v1alpha2.CheckResponse], error) {
+	return c.check.CallUnary(ctx, req)
+}
+
+// BatchCheck calls ory.keto.relation_tuples.v1alpha2.CheckService.BatchCheck.
+func (c *checkServiceClient) BatchCheck(ctx context.Context, req *connect.Request[v1alpha2.BatchCheckRequest]) (*connect.Response[v1alpha2.BatchCheckResponse], error) {
+	return c.batchCheck.CallUnary(ctx, req)
+}
+
+// CheckServiceHandler is an implementation of the ory.keto.relation_tuples.v1alpha2.CheckService
+// service.
+type CheckServiceHandler interface {
+	// Performs an authorization check.
+	Check(context.Context, *connect.Request[v1alpha2.CheckRequest]) (*connect.Response[v1alpha2.CheckResponse], error)
+	BatchCheck(context.Context, *connect.Request[v1alpha2.BatchCheckRequest]) (*connect.Response[v1alpha2.BatchCheckResponse], error)
+}
+
+// NewCheckServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewCheckServiceHandler(svc CheckServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	checkServiceMethods := v1alpha2.File_ory_keto_relation_tuples_v1alpha2_check_service_proto.Services().ByName("CheckService").Methods()
+	checkServiceCheckHandler := connect.NewUnaryHandler(
+		CheckServiceCheckProcedure,
+		svc.Check,
+		connect.WithSchema(checkServiceMethods.ByName("Check")),
+		connect.WithHandlerOptions(opts...),
+	)
+	checkServiceBatchCheckHandler := connect.NewUnaryHandler(
+		CheckServiceBatchCheckProcedure,
+		svc.BatchCheck,
+		connect.WithSchema(checkServiceMethods.ByName("BatchCheck")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/ory.keto.relation_tuples.v1alpha2.CheckService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case CheckServiceCheckProcedure:
+			checkServiceCheckHandler.ServeHTTP(w, r)
+		case CheckServiceBatchCheckProcedure:
+			checkServiceBatchCheckHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedCheckServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedCheckServiceHandler struct{}
+
+func (UnimplementedCheckServiceHandler) Check(context.Context, *connect.Request[v1alpha2.CheckRequest]) (*connect.Response[v1alpha2.CheckResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ory.keto.relation_tuples.v1alpha2.CheckService.Check is not implemented"))
+}
+
+func (UnimplementedCheckServiceHandler) BatchCheck(context.Context, *connect.Request[v1alpha2.BatchCheckRequest]) (*connect.Response[v1alpha2.BatchCheckResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ory.keto.relation_tuples.v1alpha2.CheckService.BatchCheck is not implemented"))
+}

gen/go/ory/keto/relation_tuples/v1alpha2/relationtuplesconnect/expand_service.connect.go

@@ -0,0 +1,115 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: ory/keto/relation_tuples/v1alpha2/expand_service.proto
+
+package relationtuplesconnect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1alpha2 "github.com/ory/keto/gen/go/ory/keto/relation_tuples/v1alpha2"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// ExpandServiceName is the fully-qualified name of the ExpandService service.
+	ExpandServiceName = "ory.keto.relation_tuples.v1alpha2.ExpandService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// ExpandServiceExpandProcedure is the fully-qualified name of the ExpandService's Expand RPC.
+	ExpandServiceExpandProcedure = "/ory.keto.relation_tuples.v1alpha2.ExpandService/Expand"
+)
+
+// ExpandServiceClient is a client for the ory.keto.relation_tuples.v1alpha2.ExpandService service.
+type ExpandServiceClient interface {
+	// Expands the subject set into a tree of subjects.
+	Expand(context.Context, *connect.Request[v1alpha2.ExpandRequest]) (*connect.Response[v1alpha2.ExpandResponse], error)
+}
+
+// NewExpandServiceClient constructs a client for the
+// ory.keto.relation_tuples.v1alpha2.ExpandService service. By default, it uses the Connect protocol
+// with the binary Protobuf Codec, asks for gzipped responses, and sends uncompressed requests. To
+// use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or connect.WithGRPCWeb()
+// options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewExpandServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) ExpandServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	expandServiceMethods := v1alpha2.File_ory_keto_relation_tuples_v1alpha2_expand_service_proto.Services().ByName("ExpandService").Methods()
+	return &expandServiceClient{
+		expand: connect.NewClient[v1alpha2.ExpandRequest, v1alpha2.ExpandResponse](
+			httpClient,
+			baseURL+ExpandServiceExpandProcedure,
+			connect.WithSchema(expandServiceMethods.ByName("Expand")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// expandServiceClient implements ExpandServiceClient.
+type expandServiceClient struct {
+	expand *connect.Client[v1alpha2.ExpandRequest, v1alpha2.ExpandResponse]
+}
+
+// Expand calls ory.keto.relation_tuples.v1alpha2.ExpandService.Expand.
+func (c *expandServiceClient) Expand(ctx context.Context, req *connect.Request[v1alpha2.ExpandRequest]) (*connect.Response[v1alpha2.ExpandResponse], error) {
+	return c.expand.CallUnary(ctx, req)
+}
+
+// ExpandServiceHandler is an implementation of the ory.keto.relation_tuples.v1alpha2.ExpandService
+// service.
+type ExpandServiceHandler interface {
+	// Expands the subject set into a tree of subjects.
+	Expand(context.Context, *connect.Request[v1alpha2.ExpandRequest]) (*connect.Response[v1alpha2.ExpandResponse], error)
+}
+
+// NewExpandServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewExpandServiceHandler(svc ExpandServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	expandServiceMethods := v1alpha2.File_ory_keto_relation_tuples_v1alpha2_expand_service_proto.Services().ByName("ExpandService").Methods()
+	expandServiceExpandHandler := connect.NewUnaryHandler(
+		ExpandServiceExpandProcedure,
+		svc.Expand,
+		connect.WithSchema(expandServiceMethods.ByName("Expand")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/ory.keto.relation_tuples.v1alpha2.ExpandService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case ExpandServiceExpandProcedure:
+			expandServiceExpandHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedExpandServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedExpandServiceHandler struct{}
+
+func (UnimplementedExpandServiceHandler) Expand(context.Context, *connect.Request[v1alpha2.ExpandRequest]) (*connect.Response[v1alpha2.ExpandResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ory.keto.relation_tuples.v1alpha2.ExpandService.Expand is not implemented"))
+}

gen/go/ory/keto/relation_tuples/v1alpha2/relationtuplesconnect/namespaces_service.connect.go

@@ -0,0 +1,117 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: ory/keto/relation_tuples/v1alpha2/namespaces_service.proto
+
+package relationtuplesconnect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1alpha2 "github.com/ory/keto/gen/go/ory/keto/relation_tuples/v1alpha2"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// NamespacesServiceName is the fully-qualified name of the NamespacesService service.
+	NamespacesServiceName = "ory.keto.relation_tuples.v1alpha2.NamespacesService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// NamespacesServiceListNamespacesProcedure is the fully-qualified name of the NamespacesService's
+	// ListNamespaces RPC.
+	NamespacesServiceListNamespacesProcedure = "/ory.keto.relation_tuples.v1alpha2.NamespacesService/ListNamespaces"
+)
+
+// NamespacesServiceClient is a client for the ory.keto.relation_tuples.v1alpha2.NamespacesService
+// service.
+type NamespacesServiceClient interface {
+	// Lists Namespaces
+	ListNamespaces(context.Context, *connect.Request[v1alpha2.ListNamespacesRequest]) (*connect.Response[v1alpha2.ListNamespacesResponse], error)
+}
+
+// NewNamespacesServiceClient constructs a client for the
+// ory.keto.relation_tuples.v1alpha2.NamespacesService service. By default, it uses the Connect
+// protocol with the binary Protobuf Codec, asks for gzipped responses, and sends uncompressed
+// requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or
+// connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewNamespacesServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) NamespacesServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	namespacesServiceMethods := v1alpha2.File_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto.Services().ByName("NamespacesService").Methods()
+	return &namespacesServiceClient{
+		listNamespaces: connect.NewClient[v1alpha2.ListNamespacesRequest, v1alpha2.ListNamespacesResponse](
+			httpClient,
+			baseURL+NamespacesServiceListNamespacesProcedure,
+			connect.WithSchema(namespacesServiceMethods.ByName("ListNamespaces")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// namespacesServiceClient implements NamespacesServiceClient.
+type namespacesServiceClient struct {
+	listNamespaces *connect.Client[v1alpha2.ListNamespacesRequest, v1alpha2.ListNamespacesResponse]
+}
+
+// ListNamespaces calls ory.keto.relation_tuples.v1alpha2.NamespacesService.ListNamespaces.
+func (c *namespacesServiceClient) ListNamespaces(ctx context.Context, req *connect.Request[v1alpha2.ListNamespacesRequest]) (*connect.Response[v1alpha2.ListNamespacesResponse], error) {
+	return c.listNamespaces.CallUnary(ctx, req)
+}
+
+// NamespacesServiceHandler is an implementation of the
+// ory.keto.relation_tuples.v1alpha2.NamespacesService service.
+type NamespacesServiceHandler interface {
+	// Lists Namespaces
+	ListNamespaces(context.Context, *connect.Request[v1alpha2.ListNamespacesRequest]) (*connect.Response[v1alpha2.ListNamespacesResponse], error)
+}
+
+// NewNamespacesServiceHandler builds an HTTP handler from the service implementation. It returns
+// the path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewNamespacesServiceHandler(svc NamespacesServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	namespacesServiceMethods := v1alpha2.File_ory_keto_relation_tuples_v1alpha2_namespaces_service_proto.Services().ByName("NamespacesService").Methods()
+	namespacesServiceListNamespacesHandler := connect.NewUnaryHandler(
+		NamespacesServiceListNamespacesProcedure,
+		svc.ListNamespaces,
+		connect.WithSchema(namespacesServiceMethods.ByName("ListNamespaces")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/ory.keto.relation_tuples.v1alpha2.NamespacesService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case NamespacesServiceListNamespacesProcedure:
+			namespacesServiceListNamespacesHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedNamespacesServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedNamespacesServiceHandler struct{}
+
+func (UnimplementedNamespacesServiceHandler) ListNamespaces(context.Context, *connect.Request[v1alpha2.ListNamespacesRequest]) (*connect.Response[v1alpha2.ListNamespacesResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ory.keto.relation_tuples.v1alpha2.NamespacesService.ListNamespaces is not implemented"))
+}

gen/go/ory/keto/relation_tuples/v1alpha2/relationtuplesconnect/read_service.connect.go

@@ -0,0 +1,115 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: ory/keto/relation_tuples/v1alpha2/read_service.proto
+
+package relationtuplesconnect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1alpha2 "github.com/ory/keto/gen/go/ory/keto/relation_tuples/v1alpha2"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// ReadServiceName is the fully-qualified name of the ReadService service.
+	ReadServiceName = "ory.keto.relation_tuples.v1alpha2.ReadService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// ReadServiceListRelationTuplesProcedure is the fully-qualified name of the ReadService's
+	// ListRelationTuples RPC.
+	ReadServiceListRelationTuplesProcedure = "/ory.keto.relation_tuples.v1alpha2.ReadService/ListRelationTuples"
+)
+
+// ReadServiceClient is a client for the ory.keto.relation_tuples.v1alpha2.ReadService service.
+type ReadServiceClient interface {
+	// Lists ACL relationships.
+	ListRelationTuples(context.Context, *connect.Request[v1alpha2.ListRelationTuplesRequest]) (*connect.Response[v1alpha2.ListRelationTuplesResponse], error)
+}
+
+// NewReadServiceClient constructs a client for the ory.keto.relation_tuples.v1alpha2.ReadService
+// service. By default, it uses the Connect protocol with the binary Protobuf Codec, asks for
+// gzipped responses, and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply
+// the connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewReadServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) ReadServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	readServiceMethods := v1alpha2.File_ory_keto_relation_tuples_v1alpha2_read_service_proto.Services().ByName("ReadService").Methods()
+	return &readServiceClient{
+		listRelationTuples: connect.NewClient[v1alpha2.ListRelationTuplesRequest, v1alpha2.ListRelationTuplesResponse](
+			httpClient,
+			baseURL+ReadServiceListRelationTuplesProcedure,
+			connect.WithSchema(readServiceMethods.ByName("ListRelationTuples")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// readServiceClient implements ReadServiceClient.
+type readServiceClient struct {
+	listRelationTuples *connect.Client[v1alpha2.ListRelationTuplesRequest, v1alpha2.ListRelationTuplesResponse]
+}
+
+// ListRelationTuples calls ory.keto.relation_tuples.v1alpha2.ReadService.ListRelationTuples.
+func (c *readServiceClient) ListRelationTuples(ctx context.Context, req *connect.Request[v1alpha2.ListRelationTuplesRequest]) (*connect.Response[v1alpha2.ListRelationTuplesResponse], error) {
+	return c.listRelationTuples.CallUnary(ctx, req)
+}
+
+// ReadServiceHandler is an implementation of the ory.keto.relation_tuples.v1alpha2.ReadService
+// service.
+type ReadServiceHandler interface {
+	// Lists ACL relationships.
+	ListRelationTuples(context.Context, *connect.Request[v1alpha2.ListRelationTuplesRequest]) (*connect.Response[v1alpha2.ListRelationTuplesResponse], error)
+}
+
+// NewReadServiceHandler builds an HTTP handler from the service implementation. It returns the path
+// on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewReadServiceHandler(svc ReadServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	readServiceMethods := v1alpha2.File_ory_keto_relation_tuples_v1alpha2_read_service_proto.Services().ByName("ReadService").Methods()
+	readServiceListRelationTuplesHandler := connect.NewUnaryHandler(
+		ReadServiceListRelationTuplesProcedure,
+		svc.ListRelationTuples,
+		connect.WithSchema(readServiceMethods.ByName("ListRelationTuples")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/ory.keto.relation_tuples.v1alpha2.ReadService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case ReadServiceListRelationTuplesProcedure:
+			readServiceListRelationTuplesHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedReadServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedReadServiceHandler struct{}
+
+func (UnimplementedReadServiceHandler) ListRelationTuples(context.Context, *connect.Request[v1alpha2.ListRelationTuplesRequest]) (*connect.Response[v1alpha2.ListRelationTuplesResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ory.keto.relation_tuples.v1alpha2.ReadService.ListRelationTuples is not implemented"))
+}

gen/go/ory/keto/relation_tuples/v1alpha2/relationtuplesconnect/version.connect.go

@@ -0,0 +1,117 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: ory/keto/relation_tuples/v1alpha2/version.proto
+
+package relationtuplesconnect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1alpha2 "github.com/ory/keto/gen/go/ory/keto/relation_tuples/v1alpha2"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// VersionServiceName is the fully-qualified name of the VersionService service.
+	VersionServiceName = "ory.keto.relation_tuples.v1alpha2.VersionService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// VersionServiceGetVersionProcedure is the fully-qualified name of the VersionService's GetVersion
+	// RPC.
+	VersionServiceGetVersionProcedure = "/ory.keto.relation_tuples.v1alpha2.VersionService/GetVersion"
+)
+
+// VersionServiceClient is a client for the ory.keto.relation_tuples.v1alpha2.VersionService
+// service.
+type VersionServiceClient interface {
+	// Returns the version of the Ory Keto instance.
+	GetVersion(context.Context, *connect.Request[v1alpha2.GetVersionRequest]) (*connect.Response[v1alpha2.GetVersionResponse], error)
+}
+
+// NewVersionServiceClient constructs a client for the
+// ory.keto.relation_tuples.v1alpha2.VersionService service. By default, it uses the Connect
+// protocol with the binary Protobuf Codec, asks for gzipped responses, and sends uncompressed
+// requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or
+// connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewVersionServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) VersionServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	versionServiceMethods := v1alpha2.File_ory_keto_relation_tuples_v1alpha2_version_proto.Services().ByName("VersionService").Methods()
+	return &versionServiceClient{
+		getVersion: connect.NewClient[v1alpha2.GetVersionRequest, v1alpha2.GetVersionResponse](
+			httpClient,
+			baseURL+VersionServiceGetVersionProcedure,
+			connect.WithSchema(versionServiceMethods.ByName("GetVersion")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// versionServiceClient implements VersionServiceClient.
+type versionServiceClient struct {
+	getVersion *connect.Client[v1alpha2.GetVersionRequest, v1alpha2.GetVersionResponse]
+}
+
+// GetVersion calls ory.keto.relation_tuples.v1alpha2.VersionService.GetVersion.
+func (c *versionServiceClient) GetVersion(ctx context.Context, req *connect.Request[v1alpha2.GetVersionRequest]) (*connect.Response[v1alpha2.GetVersionResponse], error) {
+	return c.getVersion.CallUnary(ctx, req)
+}
+
+// VersionServiceHandler is an implementation of the
+// ory.keto.relation_tuples.v1alpha2.VersionService service.
+type VersionServiceHandler interface {
+	// Returns the version of the Ory Keto instance.
+	GetVersion(context.Context, *connect.Request[v1alpha2.GetVersionRequest]) (*connect.Response[v1alpha2.GetVersionResponse], error)
+}
+
+// NewVersionServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewVersionServiceHandler(svc VersionServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	versionServiceMethods := v1alpha2.File_ory_keto_relation_tuples_v1alpha2_version_proto.Services().ByName("VersionService").Methods()
+	versionServiceGetVersionHandler := connect.NewUnaryHandler(
+		VersionServiceGetVersionProcedure,
+		svc.GetVersion,
+		connect.WithSchema(versionServiceMethods.ByName("GetVersion")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/ory.keto.relation_tuples.v1alpha2.VersionService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case VersionServiceGetVersionProcedure:
+			versionServiceGetVersionHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedVersionServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedVersionServiceHandler struct{}
+
+func (UnimplementedVersionServiceHandler) GetVersion(context.Context, *connect.Request[v1alpha2.GetVersionRequest]) (*connect.Response[v1alpha2.GetVersionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ory.keto.relation_tuples.v1alpha2.VersionService.GetVersion is not implemented"))
+}

gen/go/ory/keto/relation_tuples/v1alpha2/relationtuplesconnect/write_service.connect.go

@@ -0,0 +1,147 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: ory/keto/relation_tuples/v1alpha2/write_service.proto
+
+package relationtuplesconnect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1alpha2 "github.com/ory/keto/gen/go/ory/keto/relation_tuples/v1alpha2"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// WriteServiceName is the fully-qualified name of the WriteService service.
+	WriteServiceName = "ory.keto.relation_tuples.v1alpha2.WriteService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// WriteServiceTransactRelationTuplesProcedure is the fully-qualified name of the WriteService's
+	// TransactRelationTuples RPC.
+	WriteServiceTransactRelationTuplesProcedure = "/ory.keto.relation_tuples.v1alpha2.WriteService/TransactRelationTuples"
+	// WriteServiceDeleteRelationTuplesProcedure is the fully-qualified name of the WriteService's
+	// DeleteRelationTuples RPC.
+	WriteServiceDeleteRelationTuplesProcedure = "/ory.keto.relation_tuples.v1alpha2.WriteService/DeleteRelationTuples"
+)
+
+// WriteServiceClient is a client for the ory.keto.relation_tuples.v1alpha2.WriteService service.
+type WriteServiceClient interface {
+	// Writes one or more relationships in a single transaction.
+	TransactRelationTuples(context.Context, *connect.Request[v1alpha2.TransactRelationTuplesRequest]) (*connect.Response[v1alpha2.TransactRelationTuplesResponse], error)
+	// Deletes relationships based on relation query
+	DeleteRelationTuples(context.Context, *connect.Request[v1alpha2.DeleteRelationTuplesRequest]) (*connect.Response[v1alpha2.DeleteRelationTuplesResponse], error)
+}
+
+// NewWriteServiceClient constructs a client for the ory.keto.relation_tuples.v1alpha2.WriteService
+// service. By default, it uses the Connect protocol with the binary Protobuf Codec, asks for
+// gzipped responses, and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply
+// the connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewWriteServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) WriteServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	writeServiceMethods := v1alpha2.File_ory_keto_relation_tuples_v1alpha2_write_service_proto.Services().ByName("WriteService").Methods()
+	return &writeServiceClient{
+		transactRelationTuples: connect.NewClient[v1alpha2.TransactRelationTuplesRequest, v1alpha2.TransactRelationTuplesResponse](
+			httpClient,
+			baseURL+WriteServiceTransactRelationTuplesProcedure,
+			connect.WithSchema(writeServiceMethods.ByName("TransactRelationTuples")),
+			connect.WithClientOptions(opts...),
+		),
+		deleteRelationTuples: connect.NewClient[v1alpha2.DeleteRelationTuplesRequest, v1alpha2.DeleteRelationTuplesResponse](
+			httpClient,
+			baseURL+WriteServiceDeleteRelationTuplesProcedure,
+			connect.WithSchema(writeServiceMethods.ByName("DeleteRelationTuples")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// writeServiceClient implements WriteServiceClient.
+type writeServiceClient struct {
+	transactRelationTuples *connect.Client[v1alpha2.TransactRelationTuplesRequest, v1alpha2.TransactRelationTuplesResponse]
+	deleteRelationTuples   *connect.Client[v1alpha2.DeleteRelationTuplesRequest, v1alpha2.DeleteRelationTuplesResponse]
+}
+
+// TransactRelationTuples calls
+// ory.keto.relation_tuples.v1alpha2.WriteService.TransactRelationTuples.
+func (c *writeServiceClient) TransactRelationTuples(ctx context.Context, req *connect.Request[v1alpha2.TransactRelationTuplesRequest]) (*connect.Response[v1alpha2.TransactRelationTuplesResponse], error) {
+	return c.transactRelationTuples.CallUnary(ctx, req)
+}
+
+// DeleteRelationTuples calls ory.keto.relation_tuples.v1alpha2.WriteService.DeleteRelationTuples.
+func (c *writeServiceClient) DeleteRelationTuples(ctx context.Context, req *connect.Request[v1alpha2.DeleteRelationTuplesRequest]) (*connect.Response[v1alpha2.DeleteRelationTuplesResponse], error) {
+	return c.deleteRelationTuples.CallUnary(ctx, req)
+}
+
+// WriteServiceHandler is an implementation of the ory.keto.relation_tuples.v1alpha2.WriteService
+// service.
+type WriteServiceHandler interface {
+	// Writes one or more relationships in a single transaction.
+	TransactRelationTuples(context.Context, *connect.Request[v1alpha2.TransactRelationTuplesRequest]) (*connect.Response[v1alpha2.TransactRelationTuplesResponse], error)
+	// Deletes relationships based on relation query
+	DeleteRelationTuples(context.Context, *connect.Request[v1alpha2.DeleteRelationTuplesRequest]) (*connect.Response[v1alpha2.DeleteRelationTuplesResponse], error)
+}
+
+// NewWriteServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewWriteServiceHandler(svc WriteServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	writeServiceMethods := v1alpha2.File_ory_keto_relation_tuples_v1alpha2_write_service_proto.Services().ByName("WriteService").Methods()
+	writeServiceTransactRelationTuplesHandler := connect.NewUnaryHandler(
+		WriteServiceTransactRelationTuplesProcedure,
+		svc.TransactRelationTuples,
+		connect.WithSchema(writeServiceMethods.ByName("TransactRelationTuples")),
+		connect.WithHandlerOptions(opts...),
+	)
+	writeServiceDeleteRelationTuplesHandler := connect.NewUnaryHandler(
+		WriteServiceDeleteRelationTuplesProcedure,
+		svc.DeleteRelationTuples,
+		connect.WithSchema(writeServiceMethods.ByName("DeleteRelationTuples")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/ory.keto.relation_tuples.v1alpha2.WriteService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case WriteServiceTransactRelationTuplesProcedure:
+			writeServiceTransactRelationTuplesHandler.ServeHTTP(w, r)
+		case WriteServiceDeleteRelationTuplesProcedure:
+			writeServiceDeleteRelationTuplesHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedWriteServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedWriteServiceHandler struct{}
+
+func (UnimplementedWriteServiceHandler) TransactRelationTuples(context.Context, *connect.Request[v1alpha2.TransactRelationTuplesRequest]) (*connect.Response[v1alpha2.TransactRelationTuplesResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ory.keto.relation_tuples.v1alpha2.WriteService.TransactRelationTuples is not implemented"))
+}
+
+func (UnimplementedWriteServiceHandler) DeleteRelationTuples(context.Context, *connect.Request[v1alpha2.DeleteRelationTuplesRequest]) (*connect.Response[v1alpha2.DeleteRelationTuplesResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ory.keto.relation_tuples.v1alpha2.WriteService.DeleteRelationTuples is not implemented"))
+}

gen/go/ory/keto/relation_tuples/v1alpha2/utils.go

@@ -0,0 +1,36 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package relationtuples
+
+// RelationTupleToDeltas is a helper that converts a slice of RelationTuple to a slice of RelationTupleDelta
+// with the specified RelationTupleDelta_Action. This allows you to conveniently assemble a request for the
+// WriteServiceClient.TransactRelationTuples operation.
+//
+// Example:
+//
+//	 c.TransactRelationTuples(context.Background(), &rts.TransactRelationTuplesRequest{
+//			RelationTupleDeltas: append(rts.RelationTupleToDeltas(insertTuples, rts.RelationTupleDelta_ACTION_INSERT), rts.RelationTupleToDeltas(deleteTuples, rts.RelationTupleDelta_ACTION_DELETE)...),
+//	 })
+func RelationTupleToDeltas(rs []*RelationTuple, action RelationTupleDelta_Action) []*RelationTupleDelta {
+	deltas := make([]*RelationTupleDelta, len(rs))
+	for i := range rs {
+		deltas[i] = &RelationTupleDelta{
+			RelationTuple: rs[i],
+			Action:        action,
+		}
+	}
+	return deltas
+}
+
+// NewSubjectSet returns a Subject with a SubjectSet ref.
+func NewSubjectSet(namespace, object, relation string) *Subject {
+	return &Subject{Ref: &Subject_Set{Set: &SubjectSet{
+		Namespace: namespace,
+		Object:    object,
+		Relation:  relation,
+	}}}
+}
+
+// NewSubjectID returns a Subject with a subject ID ref.
+func NewSubjectID(id string) *Subject { return &Subject{Ref: &Subject_Id{Id: id}} }

gen/go/ory/keto/relation_tuples/v1alpha2/utils_test.go

@@ -0,0 +1,67 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package relationtuples
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRelationTupleToDeltas(t *testing.T) {
+	for _, tc := range []struct {
+		desc     string
+		rts      []*RelationTuple
+		action   RelationTupleDelta_Action
+		expected []*RelationTupleDelta
+	}{
+		{
+			desc:     "empty list",
+			rts:      nil,
+			action:   RelationTupleDelta_ACTION_INSERT,
+			expected: []*RelationTupleDelta{},
+		},
+		{
+			desc: "some tuples",
+			rts: []*RelationTuple{
+				{
+					Namespace: "n",
+					Object:    "o1",
+					Relation:  "r",
+					Subject:   NewSubjectID("s"),
+				}, {
+					Namespace: "n",
+					Object:    "o2",
+					Relation:  "r",
+					Subject:   NewSubjectSet("sn", "so", "sr"),
+				},
+			},
+			action: RelationTupleDelta_ACTION_DELETE,
+			expected: []*RelationTupleDelta{
+				{
+					RelationTuple: &RelationTuple{
+						Namespace: "n",
+						Object:    "o1",
+						Relation:  "r",
+						Subject:   NewSubjectID("s"),
+					},
+					Action: RelationTupleDelta_ACTION_DELETE,
+				},
+				{
+					RelationTuple: &RelationTuple{
+						Namespace: "n",
+						Object:    "o2",
+						Relation:  "r",
+						Subject:   NewSubjectSet("sn", "so", "sr"),
+					},
+					Action: RelationTupleDelta_ACTION_DELETE,
+				},
+			},
+		},
+	} {
+		t.Run("case="+tc.desc, func(t *testing.T) {
+			assert.Equal(t, tc.expected, RelationTupleToDeltas(tc.rts, tc.action))
+		})
+	}
+}

gen/go/ory/keto/relation_tuples/v1alpha2/version.pb.go

@@ -0,0 +1,172 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: ory/keto/relation_tuples/v1alpha2/version.proto
+
+package relationtuples
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Request for the VersionService.GetVersion RPC.
+type GetVersionRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetVersionRequest) Reset() {
+	*x = GetVersionRequest{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_version_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetVersionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetVersionRequest) ProtoMessage() {}
+
+func (x *GetVersionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_version_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetVersionRequest.ProtoReflect.Descriptor instead.
+func (*GetVersionRequest) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_version_proto_rawDescGZIP(), []int{0}
+}
+
+// Response of the VersionService.GetVersion RPC.
+type GetVersionResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The version string of the Ory Keto instance.
+	Version       string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetVersionResponse) Reset() {
+	*x = GetVersionResponse{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_version_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetVersionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetVersionResponse) ProtoMessage() {}
+
+func (x *GetVersionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_version_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetVersionResponse.ProtoReflect.Descriptor instead.
+func (*GetVersionResponse) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_version_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *GetVersionResponse) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+var File_ory_keto_relation_tuples_v1alpha2_version_proto protoreflect.FileDescriptor
+
+const file_ory_keto_relation_tuples_v1alpha2_version_proto_rawDesc = "" +
+	"\n" +
+	"/ory/keto/relation_tuples/v1alpha2/version.proto\x12!ory.keto.relation_tuples.v1alpha2\"\x13\n" +
+	"\x11GetVersionRequest\".\n" +
+	"\x12GetVersionResponse\x12\x18\n" +
+	"\aversion\x18\x01 \x01(\tR\aversion2\x8b\x01\n" +
+	"\x0eVersionService\x12y\n" +
+	"\n" +
+	"GetVersion\x124.ory.keto.relation_tuples.v1alpha2.GetVersionRequest\x1a5.ory.keto.relation_tuples.v1alpha2.GetVersionResponseB\xa5\x02\n" +
+	"%com.ory.keto.relation_tuples.v1alpha2B\fVersionProtoP\x01ZKgithub.com/ory/keto/gen/go/ory/keto/relation_tuples/v1alpha2;relationtuples\xa2\x02\x03OKR\xaa\x02 Ory.Keto.RelationTuples.V1alpha2\xca\x02 Ory\\Keto\\RelationTuples\\V1alpha2\xe2\x02,Ory\\Keto\\RelationTuples\\V1alpha2\\GPBMetadata\xea\x02#Ory::Keto::RelationTuples::V1alpha2b\x06proto3"
+
+var (
+	file_ory_keto_relation_tuples_v1alpha2_version_proto_rawDescOnce sync.Once
+	file_ory_keto_relation_tuples_v1alpha2_version_proto_rawDescData []byte
+)
+
+func file_ory_keto_relation_tuples_v1alpha2_version_proto_rawDescGZIP() []byte {
+	file_ory_keto_relation_tuples_v1alpha2_version_proto_rawDescOnce.Do(func() {
+		file_ory_keto_relation_tuples_v1alpha2_version_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_ory_keto_relation_tuples_v1alpha2_version_proto_rawDesc), len(file_ory_keto_relation_tuples_v1alpha2_version_proto_rawDesc)))
+	})
+	return file_ory_keto_relation_tuples_v1alpha2_version_proto_rawDescData
+}
+
+var file_ory_keto_relation_tuples_v1alpha2_version_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_ory_keto_relation_tuples_v1alpha2_version_proto_goTypes = []any{
+	(*GetVersionRequest)(nil),  // 0: ory.keto.relation_tuples.v1alpha2.GetVersionRequest
+	(*GetVersionResponse)(nil), // 1: ory.keto.relation_tuples.v1alpha2.GetVersionResponse
+}
+var file_ory_keto_relation_tuples_v1alpha2_version_proto_depIdxs = []int32{
+	0, // 0: ory.keto.relation_tuples.v1alpha2.VersionService.GetVersion:input_type -> ory.keto.relation_tuples.v1alpha2.GetVersionRequest
+	1, // 1: ory.keto.relation_tuples.v1alpha2.VersionService.GetVersion:output_type -> ory.keto.relation_tuples.v1alpha2.GetVersionResponse
+	1, // [1:2] is the sub-list for method output_type
+	0, // [0:1] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_ory_keto_relation_tuples_v1alpha2_version_proto_init() }
+func file_ory_keto_relation_tuples_v1alpha2_version_proto_init() {
+	if File_ory_keto_relation_tuples_v1alpha2_version_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_ory_keto_relation_tuples_v1alpha2_version_proto_rawDesc), len(file_ory_keto_relation_tuples_v1alpha2_version_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_ory_keto_relation_tuples_v1alpha2_version_proto_goTypes,
+		DependencyIndexes: file_ory_keto_relation_tuples_v1alpha2_version_proto_depIdxs,
+		MessageInfos:      file_ory_keto_relation_tuples_v1alpha2_version_proto_msgTypes,
+	}.Build()
+	File_ory_keto_relation_tuples_v1alpha2_version_proto = out.File
+	file_ory_keto_relation_tuples_v1alpha2_version_proto_goTypes = nil
+	file_ory_keto_relation_tuples_v1alpha2_version_proto_depIdxs = nil
+}

gen/go/ory/keto/relation_tuples/v1alpha2/version_grpc.pb.go

@@ -0,0 +1,134 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             (unknown)
+// source: ory/keto/relation_tuples/v1alpha2/version.proto
+
+package relationtuples
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	VersionService_GetVersion_FullMethodName = "/ory.keto.relation_tuples.v1alpha2.VersionService/GetVersion"
+)
+
+// VersionServiceClient is the client API for VersionService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// The service returning the specific Ory Keto instance version.
+//
+// This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis) and [write-APIs](../concepts/25_api-overview.mdx#write-apis).
+type VersionServiceClient interface {
+	// Returns the version of the Ory Keto instance.
+	GetVersion(ctx context.Context, in *GetVersionRequest, opts ...grpc.CallOption) (*GetVersionResponse, error)
+}
+
+type versionServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewVersionServiceClient(cc grpc.ClientConnInterface) VersionServiceClient {
+	return &versionServiceClient{cc}
+}
+
+func (c *versionServiceClient) GetVersion(ctx context.Context, in *GetVersionRequest, opts ...grpc.CallOption) (*GetVersionResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetVersionResponse)
+	err := c.cc.Invoke(ctx, VersionService_GetVersion_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// VersionServiceServer is the server API for VersionService service.
+// All implementations must embed UnimplementedVersionServiceServer
+// for forward compatibility.
+//
+// The service returning the specific Ory Keto instance version.
+//
+// This service is part of the [read-APIs](../concepts/25_api-overview.mdx#read-apis) and [write-APIs](../concepts/25_api-overview.mdx#write-apis).
+type VersionServiceServer interface {
+	// Returns the version of the Ory Keto instance.
+	GetVersion(context.Context, *GetVersionRequest) (*GetVersionResponse, error)
+	mustEmbedUnimplementedVersionServiceServer()
+}
+
+// UnimplementedVersionServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedVersionServiceServer struct{}
+
+func (UnimplementedVersionServiceServer) GetVersion(context.Context, *GetVersionRequest) (*GetVersionResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetVersion not implemented")
+}
+func (UnimplementedVersionServiceServer) mustEmbedUnimplementedVersionServiceServer() {}
+func (UnimplementedVersionServiceServer) testEmbeddedByValue()                        {}
+
+// UnsafeVersionServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to VersionServiceServer will
+// result in compilation errors.
+type UnsafeVersionServiceServer interface {
+	mustEmbedUnimplementedVersionServiceServer()
+}
+
+func RegisterVersionServiceServer(s grpc.ServiceRegistrar, srv VersionServiceServer) {
+	// If the following call panics, it indicates UnimplementedVersionServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&VersionService_ServiceDesc, srv)
+}
+
+func _VersionService_GetVersion_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetVersionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VersionServiceServer).GetVersion(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: VersionService_GetVersion_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VersionServiceServer).GetVersion(ctx, req.(*GetVersionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// VersionService_ServiceDesc is the grpc.ServiceDesc for VersionService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var VersionService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "ory.keto.relation_tuples.v1alpha2.VersionService",
+	HandlerType: (*VersionServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetVersion",
+			Handler:    _VersionService_GetVersion_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "ory/keto/relation_tuples/v1alpha2/version.proto",
+}

gen/go/ory/keto/relation_tuples/v1alpha2/write_service.pb.go

@@ -0,0 +1,501 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: ory/keto/relation_tuples/v1alpha2/write_service.proto
+
+package relationtuples
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type RelationTupleDelta_Action int32
+
+const (
+	// Unspecified.
+	// The `TransactRelationTuples` RPC ignores this
+	// RelationTupleDelta if an action was unspecified.
+	RelationTupleDelta_ACTION_UNSPECIFIED RelationTupleDelta_Action = 0
+	// Insertion of a new RelationTuple.
+	RelationTupleDelta_ACTION_INSERT RelationTupleDelta_Action = 1
+	// Deletion of the RelationTuple.
+	// It is ignored if it does not exist.
+	RelationTupleDelta_ACTION_DELETE RelationTupleDelta_Action = 2
+)
+
+// Enum value maps for RelationTupleDelta_Action.
+var (
+	RelationTupleDelta_Action_name = map[int32]string{
+		0: "ACTION_UNSPECIFIED",
+		1: "ACTION_INSERT",
+		2: "ACTION_DELETE",
+	}
+	RelationTupleDelta_Action_value = map[string]int32{
+		"ACTION_UNSPECIFIED": 0,
+		"ACTION_INSERT":      1,
+		"ACTION_DELETE":      2,
+	}
+)
+
+func (x RelationTupleDelta_Action) Enum() *RelationTupleDelta_Action {
+	p := new(RelationTupleDelta_Action)
+	*p = x
+	return p
+}
+
+func (x RelationTupleDelta_Action) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (RelationTupleDelta_Action) Descriptor() protoreflect.EnumDescriptor {
+	return file_ory_keto_relation_tuples_v1alpha2_write_service_proto_enumTypes[0].Descriptor()
+}
+
+func (RelationTupleDelta_Action) Type() protoreflect.EnumType {
+	return &file_ory_keto_relation_tuples_v1alpha2_write_service_proto_enumTypes[0]
+}
+
+func (x RelationTupleDelta_Action) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use RelationTupleDelta_Action.Descriptor instead.
+func (RelationTupleDelta_Action) EnumDescriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDescGZIP(), []int{1, 0}
+}
+
+// The request of a WriteService.TransactRelationTuples RPC.
+type TransactRelationTuplesRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The write delta for the relationships operated in one single transaction.
+	// Either all actions succeed or no change takes effect on error.
+	RelationTupleDeltas []*RelationTupleDelta `protobuf:"bytes,1,rep,name=relation_tuple_deltas,json=relationTupleDeltas,proto3" json:"relation_tuple_deltas,omitempty"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
+}
+
+func (x *TransactRelationTuplesRequest) Reset() {
+	*x = TransactRelationTuplesRequest{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_write_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TransactRelationTuplesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TransactRelationTuplesRequest) ProtoMessage() {}
+
+func (x *TransactRelationTuplesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_write_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TransactRelationTuplesRequest.ProtoReflect.Descriptor instead.
+func (*TransactRelationTuplesRequest) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *TransactRelationTuplesRequest) GetRelationTupleDeltas() []*RelationTupleDelta {
+	if x != nil {
+		return x.RelationTupleDeltas
+	}
+	return nil
+}
+
+// Write-delta for a TransactRelationTuplesRequest.
+type RelationTupleDelta struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The action to do on the RelationTuple.
+	Action RelationTupleDelta_Action `protobuf:"varint,1,opt,name=action,proto3,enum=ory.keto.relation_tuples.v1alpha2.RelationTupleDelta_Action" json:"action,omitempty"`
+	// The target RelationTuple.
+	RelationTuple *RelationTuple `protobuf:"bytes,2,opt,name=relation_tuple,json=relationTuple,proto3" json:"relation_tuple,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RelationTupleDelta) Reset() {
+	*x = RelationTupleDelta{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_write_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RelationTupleDelta) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RelationTupleDelta) ProtoMessage() {}
+
+func (x *RelationTupleDelta) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_write_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RelationTupleDelta.ProtoReflect.Descriptor instead.
+func (*RelationTupleDelta) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *RelationTupleDelta) GetAction() RelationTupleDelta_Action {
+	if x != nil {
+		return x.Action
+	}
+	return RelationTupleDelta_ACTION_UNSPECIFIED
+}
+
+func (x *RelationTupleDelta) GetRelationTuple() *RelationTuple {
+	if x != nil {
+		return x.RelationTuple
+	}
+	return nil
+}
+
+// The response of a WriteService.TransactRelationTuples rpc.
+type TransactRelationTuplesResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// This field is not implemented yet and has no effect.
+	// <!--
+	// The list of the new latest snapshot tokens of the affected RelationTuple,
+	// with the same index as specified in the `relation_tuple_deltas` field of
+	// the TransactRelationTuplesRequest request.
+	//
+	// If the RelationTupleDelta_Action was DELETE
+	// the snaptoken is empty at the same index.
+	// -->
+	Snaptokens    []string `protobuf:"bytes,1,rep,name=snaptokens,proto3" json:"snaptokens,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TransactRelationTuplesResponse) Reset() {
+	*x = TransactRelationTuplesResponse{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_write_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TransactRelationTuplesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TransactRelationTuplesResponse) ProtoMessage() {}
+
+func (x *TransactRelationTuplesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_write_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TransactRelationTuplesResponse.ProtoReflect.Descriptor instead.
+func (*TransactRelationTuplesResponse) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *TransactRelationTuplesResponse) GetSnaptokens() []string {
+	if x != nil {
+		return x.Snaptokens
+	}
+	return nil
+}
+
+type DeleteRelationTuplesRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Deprecated: Marked as deprecated in ory/keto/relation_tuples/v1alpha2/write_service.proto.
+	Query         *DeleteRelationTuplesRequest_Query `protobuf:"bytes,1,opt,name=query,proto3" json:"query,omitempty"`
+	RelationQuery *RelationQuery                     `protobuf:"bytes,2,opt,name=relation_query,json=relationQuery,proto3" json:"relation_query,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteRelationTuplesRequest) Reset() {
+	*x = DeleteRelationTuplesRequest{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_write_service_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteRelationTuplesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteRelationTuplesRequest) ProtoMessage() {}
+
+func (x *DeleteRelationTuplesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_write_service_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteRelationTuplesRequest.ProtoReflect.Descriptor instead.
+func (*DeleteRelationTuplesRequest) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDescGZIP(), []int{3}
+}
+
+// Deprecated: Marked as deprecated in ory/keto/relation_tuples/v1alpha2/write_service.proto.
+func (x *DeleteRelationTuplesRequest) GetQuery() *DeleteRelationTuplesRequest_Query {
+	if x != nil {
+		return x.Query
+	}
+	return nil
+}
+
+func (x *DeleteRelationTuplesRequest) GetRelationQuery() *RelationQuery {
+	if x != nil {
+		return x.RelationQuery
+	}
+	return nil
+}
+
+type DeleteRelationTuplesResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteRelationTuplesResponse) Reset() {
+	*x = DeleteRelationTuplesResponse{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_write_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteRelationTuplesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteRelationTuplesResponse) ProtoMessage() {}
+
+func (x *DeleteRelationTuplesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_write_service_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteRelationTuplesResponse.ProtoReflect.Descriptor instead.
+func (*DeleteRelationTuplesResponse) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDescGZIP(), []int{4}
+}
+
+// The query for deleting relationships
+type DeleteRelationTuplesRequest_Query struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Optional. The namespace to query.
+	Namespace string `protobuf:"bytes,1,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	// Optional. The object to query for.
+	Object string `protobuf:"bytes,2,opt,name=object,proto3" json:"object,omitempty"`
+	// Optional. The relation to query for.
+	Relation string `protobuf:"bytes,3,opt,name=relation,proto3" json:"relation,omitempty"`
+	// Optional. The subject to query for.
+	Subject       *Subject `protobuf:"bytes,4,opt,name=subject,proto3" json:"subject,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteRelationTuplesRequest_Query) Reset() {
+	*x = DeleteRelationTuplesRequest_Query{}
+	mi := &file_ory_keto_relation_tuples_v1alpha2_write_service_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteRelationTuplesRequest_Query) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteRelationTuplesRequest_Query) ProtoMessage() {}
+
+func (x *DeleteRelationTuplesRequest_Query) ProtoReflect() protoreflect.Message {
+	mi := &file_ory_keto_relation_tuples_v1alpha2_write_service_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteRelationTuplesRequest_Query.ProtoReflect.Descriptor instead.
+func (*DeleteRelationTuplesRequest_Query) Descriptor() ([]byte, []int) {
+	return file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDescGZIP(), []int{3, 0}
+}
+
+func (x *DeleteRelationTuplesRequest_Query) GetNamespace() string {
+	if x != nil {
+		return x.Namespace
+	}
+	return ""
+}
+
+func (x *DeleteRelationTuplesRequest_Query) GetObject() string {
+	if x != nil {
+		return x.Object
+	}
+	return ""
+}
+
+func (x *DeleteRelationTuplesRequest_Query) GetRelation() string {
+	if x != nil {
+		return x.Relation
+	}
+	return ""
+}
+
+func (x *DeleteRelationTuplesRequest_Query) GetSubject() *Subject {
+	if x != nil {
+		return x.Subject
+	}
+	return nil
+}
+
+var File_ory_keto_relation_tuples_v1alpha2_write_service_proto protoreflect.FileDescriptor
+
+const file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDesc = "" +
+	"\n" +
+	"5ory/keto/relation_tuples/v1alpha2/write_service.proto\x12!ory.keto.relation_tuples.v1alpha2\x1a7ory/keto/relation_tuples/v1alpha2/relation_tuples.proto\"\x8a\x01\n" +
+	"\x1dTransactRelationTuplesRequest\x12i\n" +
+	"\x15relation_tuple_deltas\x18\x01 \x03(\v25.ory.keto.relation_tuples.v1alpha2.RelationTupleDeltaR\x13relationTupleDeltas\"\x8b\x02\n" +
+	"\x12RelationTupleDelta\x12T\n" +
+	"\x06action\x18\x01 \x01(\x0e2<.ory.keto.relation_tuples.v1alpha2.RelationTupleDelta.ActionR\x06action\x12W\n" +
+	"\x0erelation_tuple\x18\x02 \x01(\v20.ory.keto.relation_tuples.v1alpha2.RelationTupleR\rrelationTuple\"F\n" +
+	"\x06Action\x12\x16\n" +
+	"\x12ACTION_UNSPECIFIED\x10\x00\x12\x11\n" +
+	"\rACTION_INSERT\x10\x01\x12\x11\n" +
+	"\rACTION_DELETE\x10\x02\"@\n" +
+	"\x1eTransactRelationTuplesResponse\x12\x1e\n" +
+	"\n" +
+	"snaptokens\x18\x01 \x03(\tR\n" +
+	"snaptokens\"\xf8\x02\n" +
+	"\x1bDeleteRelationTuplesRequest\x12^\n" +
+	"\x05query\x18\x01 \x01(\v2D.ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest.QueryB\x02\x18\x01R\x05query\x12W\n" +
+	"\x0erelation_query\x18\x02 \x01(\v20.ory.keto.relation_tuples.v1alpha2.RelationQueryR\rrelationQuery\x1a\x9f\x01\n" +
+	"\x05Query\x12\x1c\n" +
+	"\tnamespace\x18\x01 \x01(\tR\tnamespace\x12\x16\n" +
+	"\x06object\x18\x02 \x01(\tR\x06object\x12\x1a\n" +
+	"\brelation\x18\x03 \x01(\tR\brelation\x12D\n" +
+	"\asubject\x18\x04 \x01(\v2*.ory.keto.relation_tuples.v1alpha2.SubjectR\asubject\"\x1e\n" +
+	"\x1cDeleteRelationTuplesResponse2\xc8\x02\n" +
+	"\fWriteService\x12\x9d\x01\n" +
+	"\x16TransactRelationTuples\x12@.ory.keto.relation_tuples.v1alpha2.TransactRelationTuplesRequest\x1aA.ory.keto.relation_tuples.v1alpha2.TransactRelationTuplesResponse\x12\x97\x01\n" +
+	"\x14DeleteRelationTuples\x12>.ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest\x1a?.ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesResponseB\xaa\x02\n" +
+	"%com.ory.keto.relation_tuples.v1alpha2B\x11WriteServiceProtoP\x01ZKgithub.com/ory/keto/gen/go/ory/keto/relation_tuples/v1alpha2;relationtuples\xa2\x02\x03OKR\xaa\x02 Ory.Keto.RelationTuples.V1alpha2\xca\x02 Ory\\Keto\\RelationTuples\\V1alpha2\xe2\x02,Ory\\Keto\\RelationTuples\\V1alpha2\\GPBMetadata\xea\x02#Ory::Keto::RelationTuples::V1alpha2b\x06proto3"
+
+var (
+	file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDescOnce sync.Once
+	file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDescData []byte
+)
+
+func file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDescGZIP() []byte {
+	file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDescOnce.Do(func() {
+		file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDesc), len(file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDesc)))
+	})
+	return file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDescData
+}
+
+var file_ory_keto_relation_tuples_v1alpha2_write_service_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_ory_keto_relation_tuples_v1alpha2_write_service_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_ory_keto_relation_tuples_v1alpha2_write_service_proto_goTypes = []any{
+	(RelationTupleDelta_Action)(0),            // 0: ory.keto.relation_tuples.v1alpha2.RelationTupleDelta.Action
+	(*TransactRelationTuplesRequest)(nil),     // 1: ory.keto.relation_tuples.v1alpha2.TransactRelationTuplesRequest
+	(*RelationTupleDelta)(nil),                // 2: ory.keto.relation_tuples.v1alpha2.RelationTupleDelta
+	(*TransactRelationTuplesResponse)(nil),    // 3: ory.keto.relation_tuples.v1alpha2.TransactRelationTuplesResponse
+	(*DeleteRelationTuplesRequest)(nil),       // 4: ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest
+	(*DeleteRelationTuplesResponse)(nil),      // 5: ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesResponse
+	(*DeleteRelationTuplesRequest_Query)(nil), // 6: ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest.Query
+	(*RelationTuple)(nil),                     // 7: ory.keto.relation_tuples.v1alpha2.RelationTuple
+	(*RelationQuery)(nil),                     // 8: ory.keto.relation_tuples.v1alpha2.RelationQuery
+	(*Subject)(nil),                           // 9: ory.keto.relation_tuples.v1alpha2.Subject
+}
+var file_ory_keto_relation_tuples_v1alpha2_write_service_proto_depIdxs = []int32{
+	2, // 0: ory.keto.relation_tuples.v1alpha2.TransactRelationTuplesRequest.relation_tuple_deltas:type_name -> ory.keto.relation_tuples.v1alpha2.RelationTupleDelta
+	0, // 1: ory.keto.relation_tuples.v1alpha2.RelationTupleDelta.action:type_name -> ory.keto.relation_tuples.v1alpha2.RelationTupleDelta.Action
+	7, // 2: ory.keto.relation_tuples.v1alpha2.RelationTupleDelta.relation_tuple:type_name -> ory.keto.relation_tuples.v1alpha2.RelationTuple
+	6, // 3: ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest.query:type_name -> ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest.Query
+	8, // 4: ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest.relation_query:type_name -> ory.keto.relation_tuples.v1alpha2.RelationQuery
+	9, // 5: ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest.Query.subject:type_name -> ory.keto.relation_tuples.v1alpha2.Subject
+	1, // 6: ory.keto.relation_tuples.v1alpha2.WriteService.TransactRelationTuples:input_type -> ory.keto.relation_tuples.v1alpha2.TransactRelationTuplesRequest
+	4, // 7: ory.keto.relation_tuples.v1alpha2.WriteService.DeleteRelationTuples:input_type -> ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesRequest
+	3, // 8: ory.keto.relation_tuples.v1alpha2.WriteService.TransactRelationTuples:output_type -> ory.keto.relation_tuples.v1alpha2.TransactRelationTuplesResponse
+	5, // 9: ory.keto.relation_tuples.v1alpha2.WriteService.DeleteRelationTuples:output_type -> ory.keto.relation_tuples.v1alpha2.DeleteRelationTuplesResponse
+	8, // [8:10] is the sub-list for method output_type
+	6, // [6:8] is the sub-list for method input_type
+	6, // [6:6] is the sub-list for extension type_name
+	6, // [6:6] is the sub-list for extension extendee
+	0, // [0:6] is the sub-list for field type_name
+}
+
+func init() { file_ory_keto_relation_tuples_v1alpha2_write_service_proto_init() }
+func file_ory_keto_relation_tuples_v1alpha2_write_service_proto_init() {
+	if File_ory_keto_relation_tuples_v1alpha2_write_service_proto != nil {
+		return
+	}
+	file_ory_keto_relation_tuples_v1alpha2_relation_tuples_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDesc), len(file_ory_keto_relation_tuples_v1alpha2_write_service_proto_rawDesc)),
+			NumEnums:      1,
+			NumMessages:   6,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_ory_keto_relation_tuples_v1alpha2_write_service_proto_goTypes,
+		DependencyIndexes: file_ory_keto_relation_tuples_v1alpha2_write_service_proto_depIdxs,
+		EnumInfos:         file_ory_keto_relation_tuples_v1alpha2_write_service_proto_enumTypes,
+		MessageInfos:      file_ory_keto_relation_tuples_v1alpha2_write_service_proto_msgTypes,
+	}.Build()
+	File_ory_keto_relation_tuples_v1alpha2_write_service_proto = out.File
+	file_ory_keto_relation_tuples_v1alpha2_write_service_proto_goTypes = nil
+	file_ory_keto_relation_tuples_v1alpha2_write_service_proto_depIdxs = nil
+}

gen/go/ory/keto/relation_tuples/v1alpha2/write_service_grpc.pb.go

@@ -0,0 +1,174 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             (unknown)
+// source: ory/keto/relation_tuples/v1alpha2/write_service.proto
+
+package relationtuples
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	WriteService_TransactRelationTuples_FullMethodName = "/ory.keto.relation_tuples.v1alpha2.WriteService/TransactRelationTuples"
+	WriteService_DeleteRelationTuples_FullMethodName   = "/ory.keto.relation_tuples.v1alpha2.WriteService/DeleteRelationTuples"
+)
+
+// WriteServiceClient is the client API for WriteService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// The write service to create and delete Access Control Lists.
+//
+// This service is part of the [write-APIs](../concepts/25_api-overview.mdx#write-apis).
+type WriteServiceClient interface {
+	// Writes one or more relationships in a single transaction.
+	TransactRelationTuples(ctx context.Context, in *TransactRelationTuplesRequest, opts ...grpc.CallOption) (*TransactRelationTuplesResponse, error)
+	// Deletes relationships based on relation query
+	DeleteRelationTuples(ctx context.Context, in *DeleteRelationTuplesRequest, opts ...grpc.CallOption) (*DeleteRelationTuplesResponse, error)
+}
+
+type writeServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewWriteServiceClient(cc grpc.ClientConnInterface) WriteServiceClient {
+	return &writeServiceClient{cc}
+}
+
+func (c *writeServiceClient) TransactRelationTuples(ctx context.Context, in *TransactRelationTuplesRequest, opts ...grpc.CallOption) (*TransactRelationTuplesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(TransactRelationTuplesResponse)
+	err := c.cc.Invoke(ctx, WriteService_TransactRelationTuples_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *writeServiceClient) DeleteRelationTuples(ctx context.Context, in *DeleteRelationTuplesRequest, opts ...grpc.CallOption) (*DeleteRelationTuplesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeleteRelationTuplesResponse)
+	err := c.cc.Invoke(ctx, WriteService_DeleteRelationTuples_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// WriteServiceServer is the server API for WriteService service.
+// All implementations must embed UnimplementedWriteServiceServer
+// for forward compatibility.
+//
+// The write service to create and delete Access Control Lists.
+//
+// This service is part of the [write-APIs](../concepts/25_api-overview.mdx#write-apis).
+type WriteServiceServer interface {
+	// Writes one or more relationships in a single transaction.
+	TransactRelationTuples(context.Context, *TransactRelationTuplesRequest) (*TransactRelationTuplesResponse, error)
+	// Deletes relationships based on relation query
+	DeleteRelationTuples(context.Context, *DeleteRelationTuplesRequest) (*DeleteRelationTuplesResponse, error)
+	mustEmbedUnimplementedWriteServiceServer()
+}
+
+// UnimplementedWriteServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedWriteServiceServer struct{}
+
+func (UnimplementedWriteServiceServer) TransactRelationTuples(context.Context, *TransactRelationTuplesRequest) (*TransactRelationTuplesResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method TransactRelationTuples not implemented")
+}
+func (UnimplementedWriteServiceServer) DeleteRelationTuples(context.Context, *DeleteRelationTuplesRequest) (*DeleteRelationTuplesResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method DeleteRelationTuples not implemented")
+}
+func (UnimplementedWriteServiceServer) mustEmbedUnimplementedWriteServiceServer() {}
+func (UnimplementedWriteServiceServer) testEmbeddedByValue()                      {}
+
+// UnsafeWriteServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to WriteServiceServer will
+// result in compilation errors.
+type UnsafeWriteServiceServer interface {
+	mustEmbedUnimplementedWriteServiceServer()
+}
+
+func RegisterWriteServiceServer(s grpc.ServiceRegistrar, srv WriteServiceServer) {
+	// If the following call panics, it indicates UnimplementedWriteServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&WriteService_ServiceDesc, srv)
+}
+
+func _WriteService_TransactRelationTuples_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(TransactRelationTuplesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(WriteServiceServer).TransactRelationTuples(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: WriteService_TransactRelationTuples_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(WriteServiceServer).TransactRelationTuples(ctx, req.(*TransactRelationTuplesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _WriteService_DeleteRelationTuples_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteRelationTuplesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(WriteServiceServer).DeleteRelationTuples(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: WriteService_DeleteRelationTuples_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(WriteServiceServer).DeleteRelationTuples(ctx, req.(*DeleteRelationTuplesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// WriteService_ServiceDesc is the grpc.ServiceDesc for WriteService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var WriteService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "ory.keto.relation_tuples.v1alpha2.WriteService",
+	HandlerType: (*WriteServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "TransactRelationTuples",
+			Handler:    _WriteService_TransactRelationTuples_Handler,
+		},
+		{
+			MethodName: "DeleteRelationTuples",
+			Handler:    _WriteService_DeleteRelationTuples_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "ory/keto/relation_tuples/v1alpha2/write_service.proto",
+}