Uptime monitoring for Permit.io

Permit.io is the policy-as-code authorization layer that sits between your users and your application's resources. Every time a user performs an action — reading a document, deleting a record, invoking an API — Permit.io evaluates the policy decision. When Permit.io goes down, your application faces a choice: fail open (let all requests through) or fail closed (deny everything). Neither is acceptable in production. Teams that monitor Permit.io know about failures within seconds; teams that don't discover them when users can no longer access their data.

This tutorial covers production-grade uptime monitoring for Permit.io using Vigilmon. We will walk through:

• Monitoring the Permit.io PDP (Policy Decision Point) health endpoint
• Monitoring the Permit.io cloud API
• SSL certificate monitoring for your PDP
• Webhook alerts for DOWN/UP events

Prerequisites

• Permit.io account with an active project
• Permit.io PDP deployed (Docker sidecar, Kubernetes, or cloud-hosted)
• A free account at vigilmon.online

Part 1: Expose and verify the PDP health endpoint

The Permit.io PDP is a locally-deployed OPA (Open Policy Agent) instance that evaluates authorization decisions. It exposes a health check endpoint:

Docker deployment

docker run -it -p 7766:7000 \
  --env PDP_API_KEY=<your-api-key> \
  --env PDP_CONTROL_PLANE=https://api.permit.io \
  permitio/pdp-v2:latest

Verify the health endpoint

curl http://localhost:7766/health

Expected response:

{"status": "ok"}

If the PDP is starting up, it returns 503 until it has finished syncing policies from the control plane. Once it returns 200 with {"status": "ok"}, it is ready to serve authorization requests.

Kubernetes deployment

# permit-pdp.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: permit-pdp
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      app: permit-pdp
  template:
    metadata:
      labels:
        app: permit-pdp
    spec:
      containers:
        - name: pdp
          image: permitio/pdp-v2:latest
          ports:
            - containerPort: 7000
          env:
            - name: PDP_API_KEY
              valueFrom:
                secretKeyRef:
                  name: permit-secrets
                  key: api-key
            - name: PDP_CONTROL_PLANE
              value: "https://api.permit.io"
          livenessProbe:
            httpGet:
              path: /health
              port: 7000
            initialDelaySeconds: 15
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /health
              port: 7000
            initialDelaySeconds: 30
            periodSeconds: 10
---
apiVersion: v1
kind: Service
metadata:
  name: permit-pdp
  namespace: default
spec:
  selector:
    app: permit-pdp
  ports:
    - port: 7766
      targetPort: 7000
  type: LoadBalancer

Apply and verify:

kubectl apply -f permit-pdp.yaml
kubectl get svc permit-pdp
# NAME          TYPE           CLUSTER-IP    EXTERNAL-IP      PORT(S)
# permit-pdp    LoadBalancer   10.0.15.20    203.0.113.66     7766:30766/TCP

Part 2: Set up HTTP monitoring in Vigilmon

Monitor the PDP health endpoint

1. Log in to vigilmon.online and click Add Monitor.
2. Choose HTTP(S) monitor.
3. Enter: https://pdp.example.com/health
4. Set interval to 30 seconds (authorization checks are on the critical path — faster detection matters).
5. Add a keyword check: must contain "status":"ok".
6. Add your alert channel.
7. Click Save.

A 30-second interval is appropriate here because Permit.io downtime directly blocks user actions. Fail-open logic in your application buys you time, but you want to know within seconds, not minutes.

Monitor the Permit.io cloud API

The PDP syncs policies from api.permit.io. If the cloud control plane is unreachable, the PDP can serve cached policies but will eventually drift. Add a monitor for the control plane:

1. Add an HTTP(S) monitor.
2. Enter: https://api.permit.io/v2/ (or your tenant-specific endpoint)
3. Set interval to 1 minute.
4. Add your alert channel.
5. Click Save.

This catches cases where the PDP is healthy locally but has lost connectivity to the policy control plane, which means policy updates are no longer being applied.

Part 3: Monitor authorization decision latency

Permit.io adds latency to every authorization check in your application. High latency is as impactful as downtime for interactive applications. Add a response time alert:

1. Open your Permit.io PDP monitor in Vigilmon.
2. Navigate to Alert settings.
3. Add a response time alert: alert if response time exceeds 500ms.
4. Save.

The PDP health endpoint itself is lightweight. If it takes more than 500ms to respond, the PDP is under load or experiencing memory pressure — a warning sign before it degrades further.

You can also add a deeper latency check using the actual /allowed endpoint:

// permit-latency-check.ts
import express from 'express';
import fetch from 'node-fetch';

const app = express();

app.get('/health/latency', async (req, res) => {
  const start = process.hrtime.bigint();

  try {
    const response = await fetch('http://localhost:7766/allowed', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        user: { key: 'health-check-user' },
        action: 'read',
        resource: { type: 'health-check-resource' },
      }),
    });

    const latencyMs = Number(process.hrtime.bigint() - start) / 1_000_000;
    const data = await response.json() as { allow: boolean };

    res.json({
      status: 'ok',
      latency_ms: Math.round(latencyMs),
      allow: data.allow,
    });
  } catch (err) {
    const latencyMs = Number(process.hrtime.bigint() - start) / 1_000_000;
    res.status(503).json({ status: 'error', latency_ms: Math.round(latencyMs) });
  }
});

app.listen(3000);

Add a Vigilmon monitor for https://your-server.example.com/health/latency with a keyword check for "status":"ok".

Part 4: SSL certificate monitoring

The PDP serves TLS if you put it behind a reverse proxy. A lapsed certificate blocks all authorization checks.

1. In Vigilmon, click Add Monitor.
2. Choose SSL monitor.
3. Enter your PDP domain: pdp.example.com.
4. Set alert threshold to 14 days before expiry.
5. Add your alert channel.

Part 5: Webhook alerts

Authorization infrastructure failures require immediate response. Configure Vigilmon to route alerts directly to your on-call rotation:

// webhook-receiver.ts
import express from 'express';

const app = express();
app.use(express.json());

app.post('/webhook/vigilmon', (req, res) => {
  const { monitor_name, status, url, checked_at, response_code } = req.body;

  if (status === 'down') {
    console.error('[PERMIT.IO] PDP monitor DOWN', {
      monitor: monitor_name,
      url,
      code: response_code,
      at: checked_at,
    });

    // Critical: authorization is degraded — page on-call immediately
    triggerPagerDuty({
      title: `Permit.io PDP down: ${monitor_name}`,
      severity: 'critical',
      details: { url, response_code, checked_at },
    });
  } else if (status === 'up') {
    console.info('[PERMIT.IO] PDP recovered', { monitor: monitor_name });
    resolvePagerDuty(monitor_name);
  }

  res.sendStatus(204);
});

app.listen(3002);

Vigilmon sends this payload on state transitions:

{
  "monitor_id": "mon_abc123",
  "monitor_name": "Permit.io PDP Health",
  "status": "down",
  "url": "https://pdp.example.com/health",
  "checked_at": "2026-06-30T08:01:00Z",
  "response_code": 503,
  "response_time_ms": 5000
}

Part 6: Multi-region PDP monitoring

For production deployments, Permit.io recommends running PDP sidecars close to your application servers. If you deploy in multiple regions:

| Region | Monitor URL | Name | |--------|-------------|------| | US-East | https://pdp-us.example.com/health | Permit.io PDP US-East | | EU-West | https://pdp-eu.example.com/health | Permit.io PDP EU-West | | AP-SE | https://pdp-ap.example.com/health | Permit.io PDP AP-SE |

Tag all monitors with permit-pdp in Vigilmon for a consolidated authorization infrastructure dashboard. A failure in one region means users in that region cannot perform authorized actions — catching regional failures is as important as catching global ones.

Part 7: Application-level fallback monitoring

If your application implements a fail-open or fail-closed fallback when the PDP is unreachable, add monitoring for that behavior:

// In your application's authorization middleware
import { Permit } from 'permitio';
import { incrementCounter, setGauge } from './metrics';

const permit = new Permit({ token: process.env.PERMIT_API_KEY, pdp: 'https://pdp.example.com' });

export async function authorize(user: string, action: string, resource: string): Promise<boolean> {
  try {
    const allowed = await permit.check(user, action, resource);
    setGauge('permit_pdp_healthy', 1);
    return allowed;
  } catch (err) {
    setGauge('permit_pdp_healthy', 0);
    incrementCounter('permit_pdp_fallback_total');

    // Fail closed — deny when PDP is unreachable
    console.error('[PERMIT] PDP unreachable, failing closed', err);
    return false;
  }
}

Expose a metrics endpoint that Vigilmon can check:

app.get('/metrics/permit', (req, res) => {
  const healthy = getGauge('permit_pdp_healthy');
  res.status(healthy ? 200 : 503).json({
    status: healthy ? 'ok' : 'degraded',
    fallback_count: getCounter('permit_pdp_fallback_total'),
  });
});

Add a Vigilmon monitor for this endpoint with a keyword check for "status":"ok".

Summary

Your Permit.io deployment now has four layers of monitoring:

1. PDP health endpoint — polled every 30 seconds, confirms the policy decision point is alive and serving authorization requests.
2. Control plane monitor — checks api.permit.io connectivity to catch policy sync failures before they cause drift.
3. SSL monitor — alerts you 14 days before your PDP certificate expires, before authorization checks start failing with TLS errors.
4. Webhook alerts — DOWN events go directly to your on-call rotation because authorization failures block all user actions.

Vigilmon handles check scheduling, multi-region polling, alert routing, and uptime history. You get notified within 30 seconds of any Permit.io failure.

Monitor your Permit.io authorization infrastructure free at vigilmon.online

#permitio #authorization #devops #monitoring #security