# Engine AuthZ API: Relating first and second plugin requests for same client API call

**URL:** <https://forums.mobyproject.org/t/engine-authz-api-relating-first-and-second-plugin-requests-for-same-client-api-call/327>\
**Category:** Uncategorized\
**Created:** [October 8, 2018, 1:01pm UTC](https://forums.mobyproject.org/t/engine-authz-api-relating-first-and-second-plugin-requests-for-same-client-api-call/327 "2018-10-08T13:01:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![reddevil](https://avatars.discourse-cdn.com/v4/letter/r/3ec8ea/32.png) [@reddevil](https://forums.mobyproject.org/u/reddevil)\
**Post date:** [October 8, 2018, 1:01pm UTC](https://forums.mobyproject.org/t/engine-authz-api-relating-first-and-second-plugin-requests-for-same-client-api-call/327/1 "2018-10-08T13:01:08Z")

</div>

I’ve got a question/request about the Docker authorization plugin API, but I’m not sure where the right place is to ask. I’ll ask here, but if this isn’t the place, please help direct me to a more appropriate forum. (I’m totally new to these forums.)

I’m writing an authorization plugin and finding a challenge in relating the AuthZReq phase to the subsequent AuthZRes phase for the same client API request. For reference, see plugin call sequence documented here:

[https://docs.docker.com/engine/extend/plugins\_authorization/#basic-principles](https://docs.docker.com/engine/extend/plugins_authorization/#basic-principles)

This is useful, for example, in order to authorize a “create” type API call during the AuthZReq phase and then intercept the new object ID in the AuthZRes phase. I can manage a hash of some partially identifying request characteristics supplied by the Docker daemon to the plugin in both phases, like \<user, api call, target object ID, URL, HTTP method\> but these do not distinguish identical requests made repeatedly. There is nothing like a client request ID, potentially referring to the single client-to-daemon API call that is the very context for the two authorization plugin calls.

Is there a reliable way to relate the AuthZReq and AuthZReq call together which process the same underlying client request? Where would I request such a feature as adding a client request ID be considered?

Thanks very much to all for your kind direction.

---

<div class="post-metadata">

**Author:** ![liron-l](https://yyz1.discourse-cdn.com/flex031/user_avatar/forums.mobyproject.org/liron-l/32/66_2.png) [@liron-l](https://forums.mobyproject.org/u/liron-l)\
**Post date:** [October 8, 2018, 1:19pm UTC](https://forums.mobyproject.org/t/engine-authz-api-relating-first-and-second-plugin-requests-for-same-client-api-call/327/2 "2018-10-08T13:19:28Z")

</div>

Hello,  
Re \>  
Is there a reliable way to relate the AuthZReq and AuthZReq call together which process the same underlying client request

I assume you mean AuthZReq and AuthZRes - technically, you receive the same request and user data in both APIs (req and resp), so you can compare the request portion of the authz.Request object.

If you’re searching for a more reliable way (e.g., request ID), i suggest you open a feature request in [https://github.com/moby/moby](https://github.com/moby/moby).

---

<div class="post-metadata">

**Author:** ![reddevil](https://avatars.discourse-cdn.com/v4/letter/r/3ec8ea/32.png) [@reddevil](https://forums.mobyproject.org/u/reddevil)\
**Post date:** [October 8, 2018, 1:25pm UTC](https://forums.mobyproject.org/t/engine-authz-api-relating-first-and-second-plugin-requests-for-same-client-api-call/327/3 "2018-10-08T13:25:07Z")

</div>

Thanks very much! I’ll do that and see if it sticks.