---
title: FapiAuthorizeFilterChain
description: Configure FapiAuthorizeFilterChain to validate authorize requests for compliance with Financial-grade API (FAPI) Security Profile specifications
component: pinggateway
version: 2025.11
page_id: pinggateway:reference:FapiAuthorizeFilterChain
canonical_url: https://docs.pingidentity.com/pinggateway/2026/reference/FapiAuthorizeFilterChain.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-06-02T09:37:52Z
superseded_by: https://docs.pingidentity.com/pinggateway/2026/reference/FapiAuthorizeFilterChain.html
section_ids:
  usage: Usage
  properties: Properties
  example: Example
  more_information: More information
---

# FapiAuthorizeFilterChain

A filter chain to validate authorize requests and make sure they comply with the following FAPI specifications:

* [Financial-grade API Security Profile 1.0 - Part 1: Baseline](https://openid.net/specs/openid-financial-api-part-1-1_0.html#authorization-server)

* [Financial-grade API Security Profile 1.0 - Part 2: Advanced](https://openid.net/specs/openid-financial-api-part-2-1_0.html)

Put this filter before other filters to reject requests that would result in creating an OAuth 2.0 client that doesn't comply with the FAPI specifications.

## Usage

```none
{
    "name": string,
    "type": "FapiAuthorizeFilterChain",
    "config": {
        "forwardedHost": string,
        "apiClientService": ApiClientService reference,
        "auditService": AuditService reference,
        "extraAllowedParameters": string
    }
}
```

## Properties

* `"forwardedHost"`: *[string](preface.html#definition-string), required*

  The forwarded host added to the endpoint request.

* `"apiClientService"`: *ApiClientService [reference](preface.html#definition-reference), required*

  The `ApiClientService` to retrieve the API client, such as an [IdmApiClientService](IdmApiClientService.html).

* `"auditService"`: *AuditService [reference](preface.html#definition-reference), optional*

  The [AuditService](AuditService.html) to record audit events. Provide either the name of an AuditService object defined in the heap or an inline AuditService configuration object.

  Default: No audit service.

* `"extraAllowedParameters"`: *[string](preface.html#definition-string), optional*

  A comma-separated string of additional request parameters to keep on the forwarded request, supplementing the parameters permitted by the FAPI specifications.

  This is intended for AS-specific continuation and callback parameters, such as consent flows that submit their result back to the same endpoint.

  Default: not set

## Example

This example sets an additional request parameter, `consent_response`, that contains the consent JSON Web Token (JWT) returned from the remote consent service (RCS):

```json
{
    "name": "fapiAuthorizeFilterChain",
    "type": "FapiAuthorizeFilterChain",
    "config": {
        "forwardedHost" : "&{as.fqdn}",
        "apiClientService" : "apiClientService",
        "extraAllowedParameters" : [ "consent_response" ]
    }
}
```

## More information

[org.forgerock.openig.fapi.authorization.authorize.FapiAuthorizeFilterChainHeaplet](../_attachments/apidocs/org/forgerock/openig/fapi/authorization/authorize/FapiAuthorizeFilterChainHeaplet.html)