---
title: Configuring external PDP mode
description: To prepare the Policy Editor for making authorization decisions, configure external policy decision point (PDP) mode.
component: pingauthorize
version: 11.0
page_id: pingauthorize:pingauthorize_server_administration_guide:paz_config_external_pdp
canonical_url: https://docs.pingidentity.com/pingauthorize/11.0/pingauthorize_server_administration_guide/paz_config_external_pdp.html
revdate: December 1, 2025
section_ids:
  before-you-begin: Before you begin
  configuring-external-pdp-mode-using-the-administrative-console: Configuring external PDP mode using the administrative console
  steps: Steps
  configuring-external-pdp-mode-using-dsconfig: Configuring external PDP mode using dsconfig
  steps-2: Steps
---

# Configuring external PDP mode

You can use the admin console or `dsconfig` to configure external PDP mode. To prepare the Policy Editor for making authorization decisions, you must create a Policy External Server to represent the Policy Editor, assign the Policy External Server to the Policy Decision Service, and set the PDP mode to external.

|   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | To send a request in external PDP mode, the major versions of the PingAuthorize Server and the Policy Editor must match, and the Policy Editor's minor version must be greater than or equal to that of the PingAuthorize Server. For example:- If the PingAuthorize Server version is 10.1 and the Policy Editor version is 10.2, the request succeeds.

- If the PingAuthorize Server version is 10.2 and the Policy Editor version is 10.1, the request fails. |

## Before you begin

You need the following values to configure the PingAuthorize Server to use external PDP mode:

* The shared secret, which is specified or automatically generated when you install the Policy Editor.

  To obtain the shared secret after installation, copy the `core.Authentication.SharedSecret` value from the `PingAuthorize-PAP/config/configuration.yml` file.

* The branch name, which corresponds to the policy branch you want to evaluate requests against in the Policy Editor.

* The decision node, which is the ID of the policy tree node that is evaluated first during policy processing. To get the decision node ID:

  1. In the Policy Editor, go to **Policies**.

  2. In the policy tree, select the node that you want to use as the root node.

     This is typically the top-level node of your policy tree.

  3. Click the hamburger menu and select **Copy ID to clipboard**.

     ![Screen capture of the Policies tab showing the Copy ID to clipboard option](_images/owg1585647150212.png)

- Admin console

- `dsconfig`

## Configuring external PDP mode using the administrative console

### Steps

1. Go to **Configuration > Data Sources > External Servers**.

2. Click **New External Server** and select **Policy External Server**.

3. In the **New Policy External Server** modal, specify the following information:

   * **Name**

   * **Base URL**

   * **Shared Secret**

   * **Decision Node**

   * **Branch**

     ![Screen capture of the New Policy External Server window with the Name, Base URL, Shared Secret, Decision Node, and Branch fields highlighted.](_images/paz_pap_external_server_config.png)

4. Click **Save**.

5. Go to **Configuration > Authorization and Policies > Policy Decision Service**.

6. Under **General Configuration**, in the **PDP Mode** list, select **External**.

7. In the **Policy Server** list, select the name you gave to the policy external server in step 3.

   ![Screen capture of the Edit Policy Decision Service window with the PDP Mode and Policy Server lists configured as specified](_images/paz_policy_decision_srvc_external_pdp.png)

8. Click **Save**.

## Configuring external PDP mode using `dsconfig`

### Steps

* Use the `dsconfig` commands in the following code block to configure external PDP mode:

  ```
  dsconfig create-external-server \
    --server-name "{PAP_Name}" \
    --type policy \
    --set "base-url:https://<pap-hostname>:<pap-port>" \
    --set "shared-secret:pingauthorize" \
    --set "branch:Default Policies" \
    --set "decision-node:<your decision node ID value>"

  dsconfig set-policy-decision-service-prop \
    --set pdp-mode:external \
    --set "policy-server:{PAP_Name}"
  ```